CVE-2010-5109

Name	CVE-2010-5109
Description	Off-by-one error in the DecompressRTF function in ytnef.c in Yerase's TNEF Stream Reader allows remote attackers to cause a denial of service (crash) via a crafted TNEF file, which triggers a buffer overflow.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	705468, 771360

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
claws-mail (PTS)	jessie, jessie (lts)	3.11.1-3+deb8u1	fixed
	stretch	3.14.1-3	fixed
	buster	3.17.3-2	fixed
	bullseye	3.17.8-1	fixed
	bookworm	4.1.1-2	fixed
	sid, trixie	4.3.0-2	fixed
libytnef (PTS)	jessie, jessie (lts)	1.5-6+deb8u1	fixed
	stretch	1.9.2-2	fixed
	buster	1.9.3-1	fixed
	bullseye	1.9.3-3	fixed
	bookworm	2.0-1	fixed
	sid, trixie	2.1.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
claws-mail	source	squeeze	(not affected)
claws-mail	source	wheezy	(not affected)
claws-mail	source	(unstable)	3.11.1-2		771360
claws-mail-extra-plugins	source	(unstable)	(unfixed)	low
libytnef	source	(unstable)	1.5-5	low	705468

Notes

[squeeze] - libytnef <no-dsa> (Minor issue)
[wheezy] - libytnef <no-dsa> (Minor issue)
[squeeze] - claws-mail-extra-plugins <no-dsa> (Minor issue)
[wheezy] - claws-mail-extra-plugins <no-dsa> (Minor issue)
[squeeze] - claws-mail <not-affected> (In Squeeze, the problematic package claws-mail-tnef-parser is built by claws-mail-extra-plugins)
[wheezy] - claws-mail <not-affected> (In Wheezy, the problematic package claws-mail-tnef-parser is built by claws-mail-extra-plugins)