Bug 774255 – <net-mail/ytnef-2.0: multiple vulnerabilities (CVE-2021-{3403,3404})

• Status: IN_PROGRESS
• Product: Gentoo Security

[Description John Helmert III 2021-03-05 03:10:20 UTC]

CVE-2021-3403 (https://github.com/Yeraze/ytnef/issues/85):

In ytnef 1.9.3, the TNEFSubjectHandler function in lib/ytnef.c allows remote attackers to cause a denial-of-service (and potentially code execution) due to a double free which can be triggered via a crafted file.

CVE-2021-3404 (https://github.com/Yeraze/ytnef/issues/86):

In ytnef 1.9.3, the SwapWord function in lib/ytnef.c allows remote attackers to cause a denial-of-service (and potentially code execution) due to a heap buffer overflow which can be triggered via a crafted file.


Might be further exploitable so the 3 rating may be worth rethinking later.

[addCollapseLink(1, 1, 'Toggle comment display'); Comment 1 NATTkA bot 2021-07-29 17:23:45 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(2, 1, 'Toggle comment display'); Comment 2 NATTkA bot 2021-07-29 17:32:10 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(3, 1, 'Toggle comment display'); Comment 3 NATTkA bot 2021-07-29 17:40:03 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(4, 1, 'Toggle comment display'); Comment 4 NATTkA bot 2021-07-29 17:48:14 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(5, 1, 'Toggle comment display'); Comment 5 NATTkA bot 2021-07-29 18:04:10 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[Comment 6 NATTkA bot 2021-07-29 18:12:28 UTC]

Package list is empty or all packages have requested keywords.

[Comment 7 Sam James 2021-09-18 04:06:56 UTC]

Please backport the patches linked.

[Comment 8 Larry the Git Cow 2021-09-20 14:21:48 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ba52d365d7a5c9e48b2911010cd26546896ba4ff

commit ba52d365d7a5c9e48b2911010cd26546896ba4ff
Author:     Lars Wendler <[e-mail]>
AuthorDate: 2021-09-20 14:21:28 +0000
Commit:     Lars Wendler <[e-mail]>
CommitDate: 2021-09-20 14:21:42 +0000

    net-mail/ytnef: Bump to version 2.0
    
    Bug: https://bugs.gentoo.org/774255
    Signed-off-by: Lars Wendler <[e-mail]>

 net-mail/ytnef/Manifest         |  1 +
 net-mail/ytnef/ytnef-2.0.ebuild | 31 +++++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+)

[Comment 9 John Helmert III 2021-10-19 13:17:10 UTC]

Please cleanup.

[Comment 10 Larry the Git Cow 2022-07-10 12:55:08 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5ce2cc8f7fe504a91f355a4ff2716dcfaa2bf95e

commit 5ce2cc8f7fe504a91f355a4ff2716dcfaa2bf95e
Author:     Bernard Cafarelli <[e-mail]>
AuthorDate: 2022-07-10 12:54:03 +0000
Commit:     Bernard Cafarelli <[e-mail]>
CommitDate: 2022-07-10 12:55:04 +0000

    net-mail/ytnef: drop 1.9.3
    
    Bug: https://bugs.gentoo.org/774255
    Signed-off-by: Bernard Cafarelli <[e-mail]>

 net-mail/ytnef/Manifest           |  1 -
 net-mail/ytnef/ytnef-1.9.3.ebuild | 31 -------------------------------
 2 files changed, 32 deletions(-)