PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-6304 Debian CVE debrief

CVE-2017-6304 affects ytnef and describes an out-of-bounds read in releases before 1.9.1. NVD rates the issue 7.8 (High) with local attack conditions and required user interaction, so systems that process untrusted input through ytnef should treat it as a serious patching priority.

Vendor
Debian
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-24
Original CVE updated
2026-05-13
Advisory published
2017-02-24
Advisory updated
2026-05-13

Who should care

Administrators and maintainers running ytnef, especially in packaged Linux distributions; teams that process user-supplied TNEF content; and security owners for email or attachment-processing workflows that depend on ytnef.

Technical summary

The NVD record identifies the weakness as CWE-125 (out-of-bounds read) and gives the CVSS 3.0 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The CVE description states the issue is present in ytnef before 1.9.1, while the NVD CPE data marks vulnerable ytnef versions through 1.9. The record includes Debian DSA-3846, an Openwall patch discussion, GitHub pull request 27, and an X41 advisory as supporting references for remediation and fix context.

Defensive priority

High priority for any environment that uses ytnef or packages it downstream; patch promptly and reduce exposure to untrusted inputs.

Recommended defensive actions

  • Upgrade ytnef to 1.9.1 or later.
  • Apply vendor or distribution updates, including Debian security fixes where applicable.
  • Review systems that ingest untrusted TNEF content and limit where ytnef is allowed to run.
  • Use sandboxing or least-privilege controls around attachment or content conversion workflows.
  • Verify packaged builds are not pinned to affected older ytnef releases.

Evidence notes

Primary evidence comes from the official CVE and NVD records. The CVE was published on 2017-02-24, and the NVD entry was modified on 2026-05-13. NVD lists CVSS 7.8 with AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and maps the weakness to CWE-125. Supporting references in the record include Debian DSA-3846, the Openwall mailing-list patch thread, GitHub pull request 27, a Fedora package announcement, SecurityFocus BID 96423, and the X41 advisory. One nuance to validate in deployments: the textual description says 'before 1.9.1' while the CPE range in NVD ends at 1.9.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-6304 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-6304

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-6304 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-6304

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.