{"id":"CLSA-2026-1783075621","summary":"thunderbird: Fix of 2 CVEs","details":"- CVE-2026-12313: Linux sandbox broker SymlinkPath() accepted paths\n  containing /.. components, allowing a compromised content process to\n  traverse out of allowed directories; reject any path that contains\n  /../, equals .., starts with ../, or ends with /.. (Bug 2040477)\n- CVE-2026-33636: bundled libpng 1.6.39 NEON palette expansion\n  (arm/palette_neon_intrinsics.c) had an out-of-bounds read/write when\n  row_width was not aligned to chunk size; backport upstream libpng\n  commit aba9f18 that rewrites the loop guard and removes the unsafe\n  post-loop adjustment (compiled but unreachable on x86_64 ESU builds)","modified":"2026-10-26T09:30:09.773581828Z","published":"2026-07-03T10:47:19Z","upstream":["CVE-2026-12313","CVE-2026-33636"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1783075621.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12313"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33636"}],"affected":[{"package":{"name":"thunderbird","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/thunderbird?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"115.4.1-1.el9_2.alma.tuxcare.els16"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1783075621.json"}}],"schema_version":"1.9.0"}