Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
Thunderbird and LibreWolf may read beyond memory limits
published 4 days ago
Summary
Both Thunderbird and LibreWolf include an older usrsctp library that can read data past the end of a memory buffer. This can cause the program to crash or expose sensitive information to an attacker. Upgrade to the latest versions of Thunderbird and LibreWolf, which contain the corrected library released after December 20, 2019.
What to do
- Update cleanstart thunderbird to version 68.6.0-r0.
- Update cleanstart librewolf to version 74.0-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | thunderbird |
< 68.6.0-r0 Fix: upgrade to 68.6.0-r0
|
| CleanStart | cleanstart | librewolf |
< 74.0-r0 Fix: upgrade to 74.0-r0
|
Original advisory text
usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init
CVE-2019-20503 affects multiple packages. usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init. See references for individual vulnerability details.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published31 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2024-YG47016 · OSV
Track software like this
Free during beta