← Vulnerability feed
Start free
Open in platform
Vulnerability record · CVE-2009-3887 · published 29 October 2019
CVE-2009-3887: Ytnef project ytnef path traversal vulnerability
YYtnef Project · Ytnef
ytnef has directory traversal
9.8 CVSS 3.1 Critical EPSS 2.5% · top 15.7% CWE-22 · Path traversal
9.8CVSS 3.1 base score, v2 7.5
2.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References, 2 tagged exploit
16 Jun 2026Last modified by NVD
Description
ytnef has directory traversal
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://ocert.org/advisories/ocert-2009-013.html | Third Party Advisory |
| https://access.redhat.com/security/cve/cve-2009-3887 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-3887 | Issue TrackingThird Party Advisory |
| https://security-tracker.debian.org/tracker/CVE-2009-3887 | Third Party Advisory |
| https://www.akitasecurity.nl/advisory.php?id=AK20090601 | ExploitThird Party Advisory |
| http://ocert.org/advisories/ocert-2009-013.html | Third Party Advisory |
| https://access.redhat.com/security/cve/cve-2009-3887 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-3887 | Issue TrackingThird Party Advisory |
| https://security-tracker.debian.org/tracker/CVE-2009-3887 | Third Party Advisory |
| https://www.akitasecurity.nl/advisory.php?id=AK20090601 | ExploitThird Party Advisory |
Track CVE-2009-3887 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
9.8CVE-2017-9058Ytnef project ytnef out-of-bounds read vulnerabilityIn libytnef in ytnef through 1.9.2, there is a heap-based buffer over-read due to incorrect boundary checking in the SIZECHECK macro in lib/ytnef.c.EPSS 1.5%8.8CVE-2017-9146Ytnef project ytnef memory buffer overflow vulnerabilityThe TNEFFillMapi function in lib/ytnef.c in libytnef in ytnef through 1.9.2 does not ensure a nonzero count value before a certain memory allocation,…EPSS 2.4%7.8CVE-2009-3721Gnome evolution path traversal vulnerabilityMultiple directory traversal and buffer overflow vulnerabilities were discovered in yTNEF, and in Evolution's TNEF parser that is derived from yTNEF.…EPSS 1.6%7.8CVE-2021-3403Ytnef project ytnef use after free vulnerabilityIn ytnef 1.9.3, the TNEFSubjectHandler function in lib/ytnef.c allows remote attackers to cause a denial-of-service (and potentially code execution) …EPSS 1.8%7.8CVE-2021-3404Ytnef project ytnef memory buffer overflow vulnerabilityIn ytnef 1.9.3, the SwapWord function in lib/ytnef.c allows remote attackers to cause a denial-of-service (and potentially code execution) due to a h…EPSS 1.9%7.8CVE-2017-6298Ytnef project ytnef null pointer dereference vulnerabilityAn issue was discovered in ytnef before 1.9.1. This is related to a patch described as "1 of 9. Null Pointer Deref / calloc return value not checked."EPSS 1.5%7.8CVE-2017-6300Ytnef project ytnef memory buffer overflow vulnerabilityAn issue was discovered in ytnef before 1.9.1. This is related to a patch described as "3 of 9. Buffer Overflow in version field in lib/tnef-types.h."EPSS 1.3%7.8CVE-2017-6301Ytnef project ytnef out-of-bounds read vulnerabilityAn issue was discovered in ytnef before 1.9.1. This is related to a patch described as "4 of 9. Out of Bounds Reads."EPSS 1.2%
Source: NIST National Vulnerability Database (record CVE-2009-3887), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
