Description
In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a heap-based buffer over-read involving strdup.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tnef | 1.4.18-1 | — |
| Debian 13 | tnef | 1.4.18-1 | — |
| Debian 12 | tnef | 1.4.18-1 | — |
| Debian 9 | tnef | 1.4.12-1.2+deb9u1 | DLA-2748-1 |
| Debian 8 | tnef | 1.4.9-1+deb8u4 | DLA-2005-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | tnef | No fix yet | — |
| Ubuntu 16.04 LTS | tnef | 1.4.9-1+deb8u4build0.16.04.1 | USN-4524-1 |
Advisories 3
- USN-4524-1 tnef vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-2748-1 tnef - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2005-1 tnef - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://github.com/verdammelt/tnef/pull/40
- https://github.com/verdammelt/tnef/compare/1.4.17...1.4.18
- [debian-lts-announce] 20191129 [SECURITY] [DLA 2005-1] tnef security update mailing-list
- FEDORA-2019-5f14b810f8 vendor-advisory
- FEDORA-2019-815807c020 vendor-advisory
- USN-4524-1 vendor-advisory
- [debian-lts-announce] 20210823 [SECURITY] [DLA 2748-1] tnef security update mailing-list