PT-2026-103621

Name of the Vulnerable Software and Affected Versions iperf3 versions 3.20 through 3.21 Description A pre-authentication heap buffer overflow exists in the decrypt rsa message function. This occurs because a 256-byte RSA buffer is read using a ciphertext length controlled by the attacker, allowin...

CVE-2026-103500: Undefined Security Weakness

An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4...

Security Vulnerabilities fixed in Thunderbird 153.4 — Mozilla

An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size...

Security Vulnerabilities fixed in Thunderbird 140.17 — Mozilla

An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size...

Security Vulnerabilities fixed in Thunderbird 157 — Mozilla

An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size...

CentOS Linux 8 [TuxCare] Security Update: lemon / sqlite / sqlite-analyzer / sqlite-devel / sqlite-doc / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1782142827)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1782142827 advisory. - SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to...

CentOS Linux 8 [TuxCare] Security Update: wget Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1784540449)

The CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1784540449 advisory. - GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the cleanmetalinkstring...

Mozilla Thunderbird < 153.4

The version of Thunderbird installed on the remote Windows host is prior to 153.4. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-103 advisory. - Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firef...

AlmaLinux 9.2 [TuxCare] Security Update: LibRaw / LibRaw-devel / LibRaw-samples / LibRaw-static (ALMALINUX9.2:CLSA-2025:1753801728)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1753801728 advisory. - A flaw was found in LibRaw. A heap-buffer-overflow in raw2imageex caused by a maliciously crafted file may lead to an application crash...

CentOS Linux 8 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (CENTOS-STREAM8:CLSA-2026:1769092364)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1769092364 advisory. - 1. A cookie is set using the secure keyword for https://target 2. curl is redirected to or otherwise made to speak with http://target...

Mozilla Thunderbird < 140.17

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 140.17. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-102 advisory. - Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was...

AlmaLinux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (ALMALINUX9.6:CLSA-2026:1779495062)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779495062 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in readcompound in src/spellfile....

Rocky Linux 9.6 [TuxCare] Security Update: libpng / libpng-devel / libpng-static / libpng-tools (ALMALINUX9.6:CLSA-2026:1771002358)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1771002358 advisory. - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files...

AlmaLinux 9.6 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-dracut / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790784899)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790784899 advisory. - In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedur...

AlmaLinux 9.6 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl (ALMALINUX9.6:CLSA-2026:1786493710)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786493710 advisory. - Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit...

Rocky Linux 9.6 [TuxCare] Security Update: java-17-openjdk / java-17-openjdk-demo / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1770115899)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1770115899 advisory. - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster ima...

AlmaLinux 9.6 [TuxCare] Security Update: perl-XML-Parser (ALMALINUX9.6:CLSA-2026:1777396174)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777396174 advisory. - XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in stserialstack. In the case stackptr == stacksize - 1,...

CentOS Linux 8.4 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1784536924)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1784536924 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and...

Rocky Linux 9.6 [TuxCare] Security Update: bsdcat / bsdcpio / bsdtar / libarchive / libarchive-devel (ALMALINUX9.6:CLSA-2026:1777366496)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777366496 advisory. - A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic....

Rocky Linux 9.6 [TuxCare] Security Update: libsolv / libsolv-demo / libsolv-devel / libsolv-tools / perl-solv / etc (ALMALINUX9.6:CLSA-2026:1783417594)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783417594 advisory. - A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker- controlled compressed data within .so...