Mozilla Thunderbird < 153.4

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 153.4. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-103 advisory. - Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixe...

Mozilla Thunderbird < 157.0

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 157.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-101 advisory. - Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefo...

Security Vulnerabilities fixed in Thunderbird 157 — Mozilla

An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size...

Security Vulnerabilities fixed in Thunderbird 140.17 — Mozilla

An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size...

Security Vulnerabilities fixed in Thunderbird 153.4 — Mozilla

An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size...

Mozilla Thunderbird < 140.17

The version of Thunderbird installed on the remote Windows host is prior to 140.17. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-102 advisory. - Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in...

Mozilla Thunderbird < 153.4

The version of Thunderbird installed on the remote Windows host is prior to 153.4. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-103 advisory. - Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firef...

Mozilla Thunderbird < 157.0

The version of Thunderbird installed on the remote Windows host is prior to 157.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-101 advisory. - Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153....

SUSE CVE-2026-97957

In the Linux kernel, the following vulnerability has been resolved: net: hinic: fix mailbox segment buffer overflow checkmboxseqidandseglen validates that seqid does not exceed SEQIDMAXVAL 42 and seglen does not exceed MBOXSEGLEN 48. However, this allows the last segment seqid=42 to carry a full...

DEBIAN-CVE-2026-71973

U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfsreaddirectorytable function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablkscount value that causes heap buffer under-allocation and...

CVE-2026-71973

U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfsreaddirectorytable function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablkscount value that causes heap buffer under-allocation and...

UBUNTU-CVE-2026-71973

U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfsreaddirectorytable function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablkscount value that causes heap buffer under-allocation and...

CVE-2026-71973 U-Boot before 2026.10-rc4 Integer Overflow in SquashFS Directory Table Allocation

U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfsreaddirectorytable function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablkscount value that causes heap buffer under-allocation and...

CVE-2026-71973 U-Boot before 2026.10-rc4 Integer Overflow in SquashFS Directory Table Allocation

U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfsreaddirectorytable function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablkscount value that causes heap buffer under-allocation and...

CVE-2026-102729

gxbinresthemeload sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id at or past the theme count declared by the resource gets a buffer of zero bytes. The load pass then walks past the end of the theme table, takes...

CVE-2026-102720

A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received message. The option walk keeps a pointer and an offset in step, and the only bound check uses the offset: c / addons/dhcp/nxddhcpclient.c:7538, 7572 / while i...

CVE-2026-102721

A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path checks only that the datagram is at least four bytes long nxdtftpclient.c:1229, 1521, 1984. When the opcode is NXTFTPCODEERROR the message string is copied with ...

CVE-2026-102713

The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes nxdtftpserver.c:1037 and nothing anywhere checks an upper bound, in particular not against the protocol maximum of 4 + NXTFTPFILETRANSFERMAX. Two things follow from that one missing check...

CVE-2026-102715

Any host on the LAN can send two mDNS records and make the responder write past the end of its transmit packet. The string table stores each name in a slot rounded up to a multiple of four: c / addons/mdns/nxdmdns.c:11436, 11443, 11447 / memorylen = memorylen & 0xFFFFFFFC + 8 & 0xFFFFFFFF; ... le...

DEBIAN-CVE-2026-102559

A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow...