OESA-2026-3113 glib2 security update

GLib is a bundle of three formerly five low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since. Security Fixes: A vulnerability was found in GNOME GLib...

OESA-2026-3112 glib2 security update

GLib is a bundle of three formerly five low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since. Security Fixes: A flaw was found in GLib. An off-by-one...

OESA-2026-3109 glib2 security update

GLib is a bundle of three formerly five low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since. Security Fixes: A flaw was found in GLib. An integer...

UBUNTU-CVE-2026-16473

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one e...

CVE-2026-14899

CVE-2026-14899 describes an off-by-one read in Thunderbird’s MIME header parser when forwarding with the “view all headers” option enabled, allowing reading a byte beyond the header buffer and potentially crashing Thunderbird. The issue is fixed in Thunderbird 153 and Thunderbird 140.13. This ana...

gnutls: gnutls: Memory corruption due to off-by-one error in PKCS#12 bag handling

A flaw was found in gnutls. An off-by-one error exists in the PKCS12 bag element bounds check. This vulnerability allows an remote attacker to write past the internal array of a PKCS12 bag when appending to a bag that already contains 32 elements. This memory corruption could lead to a denial of...

CVE-2026-44687

In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in...

CVE-2026-44687 Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN

In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in...

CVE-2026-16473

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

CVE-2026-16473

The CVE-2026-16473 vulnerability affects the sbc library used by the BlueZ SBC codec. A off-by-one bug in the SBC frame decoder enables a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of a...

CVE-2026-16473

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

CVE-2026-16473 Sbc: sbc: heap out-of-bounds read via crafted sbc audio frame

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

EUVD-2026-47623

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

CVE-2026-16473

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory. Mitigation...

CVE-2026-16473

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

PT-2026-63484

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153 Thunderbird versions prior to 140.13 Description An off-by-one error exists in the code used to parse MIME headers Multipurpose Internet Mail Extensions for display when forwarding a message, specifically when...

Security Vulnerabilities fixed in Thunderbird 153 — Mozilla

The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. Memory safety bugs present in...

Security Vulnerabilities fixed in Thunderbird 140.13 — Mozilla

The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. We are aware that exploit code for...

CVE-2026-64047

A flaw was found in the Linux kernel's Transport Layer Security TLS component. An off-by-one error in how memory is managed for network messages can lead to memory corruption. This vulnerability may allow a local attacker to cause the system to crash, resulting in a denial of service DoS...

gnutls: gnutls: Memory corruption due to off-by-one error in PKCS#12 bag handling

A flaw was found in gnutls. An off-by-one error exists in the PKCS12 bag element bounds check. This vulnerability allows an remote attacker to write past the internal array of a PKCS12 bag when appending to a bag that already contains 32 elements. This memory corruption could lead to a denial of...