CLSA-2026-1783075621
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1783075621.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1783075621
- Upstream
CVE (2)
- CVE-2026-12313
- CVE-2026-33636
- Published
- 2026-07-03T10:47:19Z
- Modified
- 2026-10-26T09:30:09Z
- Summary
- thunderbird: Fix of 2 CVEs
- Details
-
- CVE-2026-12313: Linux sandbox broker SymlinkPath() accepted paths containing /.. components, allowing a compromised content process to traverse out of allowed directories; reject any path that contains /../, equals .., starts with ../, or ends with /.. (Bug 2040477)
- CVE-2026-33636: bundled libpng 1.6.39 NEON palette expansion (arm/palette_neon_intrinsics.c) had an out-of-bounds read/write when row_width was not aligned to chunk size; backport upstream libpng commit aba9f18 that rewrites the loop guard and removes the unsafe post-loop adjustment (compiled but unreachable on x86_64 ESU builds)
- References