{"id":"CVE-2021-44538","aliases":["ALPINE-CVE-2021-44538","DEBIAN-CVE-2021-44538","DLA-2874-1","DSA-5034-1","EUVD-2021-31369","GHSA-q7f4-j236-f4hc","MGASA-2021-0571","MGASA-2021-0584","SUSE-SU-2022:0058-1","UBUNTU-CVE-2021-44538","USN-5248-1","openSUSE-SU-2022:0058-1","openSUSE-SU-2024:11698-1"],"status":"published","title":"The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer...","description":"The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is partially controllable by the remote party of the channel. Attackers can construct a crafted sequence of messages to manipulate the state of the receiver's session in such a way that, for some buffer sizes, a buffer overflow happens on a call to olm_session_describe. Furthermore, safe buffer sizes were undocumented. The overflow content is partially controllable by the attacker and limited to ASCII spaces and digits. The known affected products are Element Web And SchildiChat Web.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02001,"percentile":0.80909,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-120"],"published":"2021-12-14T13:26:32Z","modified":"2026-11-05T03:28:40Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"element-web","fixed_in":["1.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"element-web","fixed_in":["1.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"element-web","fixed_in":["1.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"element-web","fixed_in":["1.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"element-web","fixed_in":["1.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"element-web","fixed_in":["1.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"element-web","fixed_in":["1.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"riot-web","fixed_in":["1.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"riot-web","fixed_in":["1.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"riot-web","fixed_in":["1.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"riot-web","fixed_in":["1.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"thunderbird","fixed_in":["91.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"thunderbird","fixed_in":["91.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"thunderbird","fixed_in":["91.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"thunderbird","fixed_in":["91.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"thunderbird","fixed_in":["91.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"thunderbird","fixed_in":["91.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"thunderbird","fixed_in":["91.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"thunderbird","fixed_in":["91.4.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"olm","fixed_in":["3.2.8~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"olm","fixed_in":["3.2.8~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"olm","fixed_in":["3.2.8~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"thunderbird","fixed_in":["1:91.4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"thunderbird","fixed_in":["1:91.4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"thunderbird","fixed_in":["1:91.4.1-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"olm","fixed_in":["3.2.1-1.1.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","fixed_in":["1:91.5.0+build1-0ubuntu0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","fixed_in":["1:91.5.0+build1-0ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","fixed_in":["1:91.5.0+build1-0ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"element-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"element-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"element-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"element-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"element-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"element-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"element-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"riot-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"riot-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"riot-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"riot-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.4.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"olm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.8~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"olm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.8~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"olm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.8~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.4.1-1~deb9u1"}]}],"versions":["1.5-4","1.5.0.2-1","1.5.0.2-2","1.5.0.2-3","1.5.0.4-1","1.5.0.4-2","1.5.0.4-3","1.5.0.5-1","1.5.0.7-1","1.5.0.7-2","1:52.4.0-1","1:52.4.0-1~deb7u1","1:52.4.0-1~deb8u1","1:52.4.0-1~deb9u1","1:52.4.0-2~exp1","1:52.5.0-1","1:52.5.0-1~deb7u1","1:52.5.0-1~deb8u1","1:52.5.0-1~deb9u1","1:52.5.2-1","1:52.5.2-1~deb7u1","1:52.5.2-2","1:52.5.2-2~deb8u1","1:52.5.2-2~deb9u1","1:52.6.0-1","1:52.6.0-1+alpha.1","1:52.6.0-1+alpha.2","1:52.6.0-1~deb7u1","1:52.6.0-1~deb8u1","1:52.6.0-1~deb9u1","1:52.7.0-1","1:52.7.0-1~deb7u1","1:52.7.0-1~deb8u1","1:52.7.0-1~deb9u1","1:52.8.0-1","1:52.8.0-1~deb7u1","1:52.8.0-1~deb8u1","1:52.8.0-1~deb9u1","1:52.9.0-1","1:52.9.1-1","1:52.9.1-1~deb8u1","1:52.9.1-1~deb9u1","1:58.0~b3-1","1:60.0-1","1:60.0-2","1:60.0-2~deb9u1","1:60.0-3","1:60.0-3~deb9u1","1:60.0~b10-1","1:60.0~b2-1","1:60.0~b3-1","1:60.0~b4-1","1:60.0~b5-1","1:60.0~b6-1","1:60.0~b9-1","1:60.0~b9-2","1:60.2.1-1","1:60.2.1-2~deb9u1","1:60.3.0-1","1:60.3.0-1~deb8u1","1:60.3.0-1~deb9u1","1:60.3.1-1","1:60.4.0-1","1:60.4.0-1~deb8u1","1:60.4.0-1~deb9u1","1:60.5.0-1","1:60.5.0-2","1:60.5.0-3","1:60.5.1-1","1:60.5.1-1~deb8u1","1:60.5.1-1~deb9u1","1:60.6.1-1","1:60.6.1-1~deb8u1","1:60.6.1-1~deb9u1","1:60.7.0-1","1:60.7.0-1~deb8u1","1:60.7.0-1~deb9u1","1:60.7.1-1","1:60.7.1-1~deb8u1","1:60.7.1-1~deb9u1","1:60.7.2-1","1:60.7.2-1~deb8u1","1:60.7.2-1~deb9u1","1:60.8.0-1","1:60.8.0-1~deb10u1","1:60.8.0-1~deb8u1","1:60.8.0-1~deb9u1","1:60.8.0-2","1:60.9.0-1","1:60.9.0-1~deb10u1","1:60.9.0-1~deb8u1","1:60.9.0-1~deb9u1","1:65.0~b1-1","1:66.0~b1-1","1:67.0~b3-1","1:68.0~b1-1","1:68.1.1-1~exp1","1:68.1.2-1~exp1","1:68.10.0-1","1:68.10.0-1~deb10u1","1:68.10.0-1~deb9u1","1:68.11.0-1","1:68.11.0-1~deb10u1","1:68.11.0-1~deb9u1","1:68.11.0-2","1:68.11.0-3","1:68.12.0-1","1:68.12.0-1~deb10u1","1:68.12.0-1~deb9u1","1:68.12.0-1~deb9u2","1:68.2.1-1","1:68.2.2-1","1:68.2.2-1~deb10u1","1:68.2.2-1~deb8u1","1:68.2.2-1~deb9u1","1:68.3.0-1","1:68.3.0-2","1:68.3.0-2~deb10u1","1:68.3.0-2~deb8u1","1:68.3.0-2~deb9u1","1:68.3.1-1","1:68.4.1-1","1:68.4.1-1~deb10u1","1:68.4.1-1~deb8u1","1:68.4.1-1~deb9u1","1:68.4.2-1","1:68.5.0-1","1:68.5.0-1~deb10u1","1:68.5.0-1~deb8u1","1:68.5.0-1~deb9u1","1:68.6.0-1","1:68.6.0-1~deb10u1","1:68.6.0-1~deb8u1","1:68.6.0-1~deb9u1","1:68.7.0-1","1:68.7.0-1~deb10u1","1:68.7.0-1~deb8u1","1:68.7.0-1~deb9u1","1:68.8.0-1","1:68.8.0-1~deb10u1","1:68.8.0-1~deb8u1","1:68.8.0-1~deb9u1","1:68.8.1-1","1:68.9.0-1","1:68.9.0-1~deb10u1","1:68.9.0-1~deb8u1","1:68.9.0-1~deb8u2","1:68.9.0-1~deb9u1","1:76.0~b1-1","1:76.0~b2-1","1:77.0~b1-1","1:77.0~b2-1","1:77.0~b3-1","1:78.0-1","1:78.0.1-1","1:78.0~b1-1","1:78.0~b2-1","1:78.1.0-1","1:78.1.1-1","1:78.10.0-1","1:78.10.0-1~deb10u1","1:78.10.0-1~deb9u1","1:78.10.2-1","1:78.11.0-1","1:78.11.0-1~deb10u1","1:78.11.0-1~deb9u1","1:78.11.0-2","1:78.12.0-1","1:78.12.0-1~deb10u1","1:78.12.0-1~deb9u1","1:78.13.0-1","1:78.13.0-1~deb10u1","1:78.13.0-1~deb11u1","1:78.13.0-1~deb9u1","1:78.14.0-1","1:78.14.0-1~deb10u1","1:78.14.0-1~deb11u1","1:78.14.0-1~deb9u1","1:78.2.0-1","1:78.2.1-1","1:78.2.2-1","1:78.3.1-1","1:78.3.1-2","1:78.3.1-2~deb10u1","1:78.3.1-2~deb10u2","1:78.3.1-2~deb9u1","1:78.3.2-1","1:78.3.3-1","1:78.4.0-1","1:78.4.0-1~deb10u1","1:78.4.0-1~deb9u1","1:78.4.1-1","1:78.4.2-1","1:78.4.2-1~deb10u1","1:78.4.2-1~deb9u1","1:78.5.0-1","1:78.5.0-1~deb10u1","1:78.5.0-1~deb9u1","1:78.5.1-1","1:78.5.1-1~deb10u1","1:78.5.1-1~deb9u1","1:78.6.0-1","1:78.6.0-1~deb10u1","1:78.6.0-1~deb9u1","1:78.6.1-1","1:78.7.0-1","1:78.7.0-1~deb10u1","1:78.7.0-1~deb9u1","1:78.7.1-1","1:78.8.0-1","1:78.8.0-1~deb10u1","1:78.8.0-1~deb9u1","1:78.9.0-1","1:78.9.0-1~deb10u1","1:78.9.0-1~deb9u1","1:84.0~b3-1","1:85.0~b3-1","1:86.0~b3-1","1:88.0~b2-1","1:89.0~b2-1","1:90.0~b2-1","1:91.0-1","1:91.0.2-1","1:91.0~b1-1","1:91.0~b3-1","1:91.0~b5-1","1:91.1.0-1","1:91.1.1-1","1:91.2.0-1","1:91.2.1-1","1:91.3.0-1","1:91.3.2-1","1:91.4.0-1"],"bundled":24},{"source":"osv","ecosystem":"Debian:10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.4.1-1~deb10u1"}]}],"versions":["1:60.7.2-1","1:60.8.0-1","1:60.8.0-1~deb10u1","1:60.8.0-1~deb8u1","1:60.8.0-1~deb9u1","1:60.8.0-2","1:60.9.0-1","1:60.9.0-1~deb10u1","1:60.9.0-1~deb8u1","1:60.9.0-1~deb9u1","1:65.0~b1-1","1:66.0~b1-1","1:67.0~b3-1","1:68.0~b1-1","1:68.1.1-1~exp1","1:68.1.2-1~exp1","1:68.10.0-1","1:68.10.0-1~deb10u1","1:68.10.0-1~deb9u1","1:68.11.0-1","1:68.11.0-1~deb10u1","1:68.11.0-1~deb9u1","1:68.11.0-2","1:68.11.0-3","1:68.12.0-1","1:68.12.0-1~deb10u1","1:68.12.0-1~deb9u1","1:68.12.0-1~deb9u2","1:68.2.1-1","1:68.2.2-1","1:68.2.2-1~deb10u1","1:68.2.2-1~deb8u1","1:68.2.2-1~deb9u1","1:68.3.0-1","1:68.3.0-2","1:68.3.0-2~deb10u1","1:68.3.0-2~deb8u1","1:68.3.0-2~deb9u1","1:68.3.1-1","1:68.4.1-1","1:68.4.1-1~deb10u1","1:68.4.1-1~deb8u1","1:68.4.1-1~deb9u1","1:68.4.2-1","1:68.5.0-1","1:68.5.0-1~deb10u1","1:68.5.0-1~deb8u1","1:68.5.0-1~deb9u1","1:68.6.0-1","1:68.6.0-1~deb10u1","1:68.6.0-1~deb8u1","1:68.6.0-1~deb9u1","1:68.7.0-1","1:68.7.0-1~deb10u1","1:68.7.0-1~deb8u1","1:68.7.0-1~deb9u1","1:68.8.0-1","1:68.8.0-1~deb10u1","1:68.8.0-1~deb8u1","1:68.8.0-1~deb9u1","1:68.8.1-1","1:68.9.0-1","1:68.9.0-1~deb10u1","1:68.9.0-1~deb8u1","1:68.9.0-1~deb8u2","1:68.9.0-1~deb9u1","1:76.0~b1-1","1:76.0~b2-1","1:77.0~b1-1","1:77.0~b2-1","1:77.0~b3-1","1:78.0-1","1:78.0.1-1","1:78.0~b1-1","1:78.0~b2-1","1:78.1.0-1","1:78.1.1-1","1:78.10.0-1","1:78.10.0-1~deb10u1","1:78.10.0-1~deb9u1","1:78.10.2-1","1:78.11.0-1","1:78.11.0-1~deb10u1","1:78.11.0-1~deb9u1","1:78.11.0-2","1:78.12.0-1","1:78.12.0-1~deb10u1","1:78.12.0-1~deb9u1","1:78.13.0-1","1:78.13.0-1~deb10u1","1:78.13.0-1~deb11u1","1:78.13.0-1~deb9u1","1:78.14.0-1","1:78.14.0-1~deb10u1","1:78.14.0-1~deb11u1","1:78.14.0-1~deb9u1","1:78.2.0-1","1:78.2.1-1","1:78.2.2-1","1:78.3.1-1","1:78.3.1-2","1:78.3.1-2~deb10u1","1:78.3.1-2~deb10u2","1:78.3.1-2~deb9u1","1:78.3.2-1","1:78.3.3-1","1:78.4.0-1","1:78.4.0-1~deb10u1","1:78.4.0-1~deb9u1","1:78.4.1-1","1:78.4.2-1","1:78.4.2-1~deb10u1","1:78.4.2-1~deb9u1","1:78.5.0-1","1:78.5.0-1~deb10u1","1:78.5.0-1~deb9u1","1:78.5.1-1","1:78.5.1-1~deb10u1","1:78.5.1-1~deb9u1","1:78.6.0-1","1:78.6.0-1~deb10u1","1:78.6.0-1~deb9u1","1:78.6.1-1","1:78.7.0-1","1:78.7.0-1~deb10u1","1:78.7.0-1~deb9u1","1:78.7.1-1","1:78.8.0-1","1:78.8.0-1~deb10u1","1:78.8.0-1~deb9u1","1:78.9.0-1","1:78.9.0-1~deb10u1","1:78.9.0-1~deb9u1","1:84.0~b3-1","1:85.0~b3-1","1:86.0~b3-1","1:88.0~b2-1","1:89.0~b2-1","1:90.0~b2-1","1:91.0-1","1:91.0.2-1","1:91.0~b1-1","1:91.0~b3-1","1:91.0~b5-1","1:91.1.0-1","1:91.1.1-1","1:91.2.0-1","1:91.2.1-1","1:91.3.0-1","1:91.3.2-1","1:91.4.0-1","1:91.4.1-1~deb9u1"],"bundled":25},{"source":"osv","ecosystem":"Debian:11","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.4.1-1~deb11u1"}]}],"versions":["1:78.12.0-1","1:78.13.0-1","1:78.13.0-1~deb10u1","1:78.13.0-1~deb11u1","1:78.13.0-1~deb9u1","1:78.14.0-1","1:78.14.0-1~deb10u1","1:78.14.0-1~deb11u1","1:78.14.0-1~deb9u1","1:84.0~b3-1","1:85.0~b3-1","1:86.0~b3-1","1:88.0~b2-1","1:89.0~b2-1","1:90.0~b2-1","1:91.0-1","1:91.0.2-1","1:91.0~b1-1","1:91.0~b3-1","1:91.0~b5-1","1:91.1.0-1","1:91.1.1-1","1:91.2.0-1","1:91.2.1-1","1:91.3.0-1","1:91.3.2-1","1:91.4.0-1","1:91.4.1-1~deb10u1","1:91.4.1-1~deb9u1"],"bundled":25},{"source":"osv","ecosystem":"Mageia:8","package":"olm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-1.1.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.4.1-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.4.1-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.4.1-8.48.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.5.0+build1-0ubuntu0.18.04.1"}]}],"versions":["1:52.4.0+build1-0ubuntu2","1:52.6.0+build1-0ubuntu1","1:52.7.0+build1-0ubuntu1","1:52.8.0+build1-0ubuntu0.18.04.1","1:52.9.1+build3-0ubuntu0.18.04.1","1:60.2.1+build1-0ubuntu0.18.04.2","1:60.4.0+build2-0ubuntu0.18.04.1","1:60.5.1+build2-0ubuntu0.18.04.1","1:60.6.1+build2-0ubuntu0.18.04.1","1:60.7.0+build1-0ubuntu0.18.04.1","1:60.7.1+build1-0ubuntu0.18.04.1","1:60.7.2+build2-0ubuntu0.18.04.1","1:60.8.0+build1-0ubuntu0.18.04.1","1:60.9.0+build1-0ubuntu0.18.04.1","1:68.2.1+build1-0ubuntu0.18.04.1","1:68.2.2+build1-0ubuntu0.18.04.1","1:68.4.1+build1-0ubuntu0.18.04.1","1:68.7.0+build1-0ubuntu0.18.04.1","1:68.8.0+build2-0ubuntu0.18.04.2","1:68.10.0+build1-0ubuntu0.18.04.1","1:78.8.1+build1-0ubuntu0.18.04.1","1:78.11.0+build1-0ubuntu0.18.04.2","1:78.13.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"olm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.2+git20170526.0fd768e+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.5.0+build1-0ubuntu0.20.04.1"}]}],"versions":["1:68.1.2+build1-0ubuntu1","1:68.1.2+build1-0ubuntu2","1:68.2.1+build1-0ubuntu1","1:68.2.2+build1-0ubuntu1","1:68.3.0+build2-0ubuntu1","1:68.3.1+build1-0ubuntu2","1:68.4.1+build1-0ubuntu1","1:68.4.2+build2-0ubuntu1","1:68.5.0+build1-0ubuntu1","1:68.6.0+build2-0ubuntu1","1:68.7.0+build1-0ubuntu1","1:68.7.0+build1-0ubuntu2","1:68.8.0+build2-0ubuntu0.20.04.2","1:68.10.0+build1-0ubuntu0.20.04.1","1:78.7.1+build1-0ubuntu0.20.04.1","1:78.8.1+build1-0ubuntu0.20.04.1","1:78.11.0+build1-0ubuntu0.20.04.2","1:78.13.0+build1-0ubuntu0.20.04.2","1:78.14.0+build1-0ubuntu0.20.04.1","1:78.14.0+build1-0ubuntu0.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-matrix-js-sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"olm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.3+dfsg-2","3.1.3+dfsg-2build1","3.1.3+dfsg-2build2","3.1.3+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-matrix-js-sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.3.0+~cs9.9.16-2","9.11.0+~cs9.9.16-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"olm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.1~dfsg-7ubuntu2","3.2.1~dfsg-7ubuntu3","3.2.10~dfsg-4ubuntu1","3.2.10~dfsg-5ubuntu1","3.2.10~dfsg-6ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.5.0+build1-0ubuntu1"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-matrix-js-sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.11.0+~cs9.9.16-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"olm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.13~dfsg-1ubuntu1","3.2.15~dfsg-1ubuntu1","3.2.16+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"olm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.16+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"olm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.16+dfsg-5","3.2.16+dfsg-6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"olm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.16+dfsg-3","3.2.16+dfsg-5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.5.0+build1-0ubuntu0.18.04.1"}]}],"versions":["1:52.4.0+build1-0ubuntu2","1:52.6.0+build1-0ubuntu1","1:52.7.0+build1-0ubuntu1","1:52.8.0+build1-0ubuntu0.18.04.1","1:52.9.1+build3-0ubuntu0.18.04.1","1:60.2.1+build1-0ubuntu0.18.04.2","1:60.4.0+build2-0ubuntu0.18.04.1","1:60.5.1+build2-0ubuntu0.18.04.1","1:60.6.1+build2-0ubuntu0.18.04.1","1:60.7.0+build1-0ubuntu0.18.04.1","1:60.7.1+build1-0ubuntu0.18.04.1","1:60.7.2+build2-0ubuntu0.18.04.1","1:60.8.0+build1-0ubuntu0.18.04.1","1:60.9.0+build1-0ubuntu0.18.04.1","1:68.2.1+build1-0ubuntu0.18.04.1","1:68.2.2+build1-0ubuntu0.18.04.1","1:68.4.1+build1-0ubuntu0.18.04.1","1:68.7.0+build1-0ubuntu0.18.04.1","1:68.8.0+build2-0ubuntu0.18.04.2","1:68.10.0+build1-0ubuntu0.18.04.1","1:78.8.1+build1-0ubuntu0.18.04.1","1:78.11.0+build1-0ubuntu0.18.04.2","1:78.13.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.1","1:78.14.0+build1-0ubuntu0.18.04.2"],"bundled":44},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:91.5.0+build1-0ubuntu0.20.04.1"}]}],"versions":["1:68.1.2+build1-0ubuntu1","1:68.1.2+build1-0ubuntu2","1:68.2.1+build1-0ubuntu1","1:68.2.2+build1-0ubuntu1","1:68.3.0+build2-0ubuntu1","1:68.3.1+build1-0ubuntu2","1:68.4.1+build1-0ubuntu1","1:68.4.2+build2-0ubuntu1","1:68.5.0+build1-0ubuntu1","1:68.6.0+build2-0ubuntu1","1:68.7.0+build1-0ubuntu1","1:68.7.0+build1-0ubuntu2","1:68.8.0+build2-0ubuntu0.20.04.2","1:68.10.0+build1-0ubuntu0.20.04.1","1:78.7.1+build1-0ubuntu0.20.04.1","1:78.8.1+build1-0ubuntu0.20.04.1","1:78.11.0+build1-0ubuntu0.20.04.2","1:78.13.0+build1-0ubuntu0.20.04.2","1:78.14.0+build1-0ubuntu0.20.04.1","1:78.14.0+build1-0ubuntu0.20.04.2"],"bundled":44},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.38-bp153.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.38-bp153.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.4.1-8.48.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.38-bp153.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.4.1-8.48.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.4.1-1.1"}]}],"bundled":2}],"products":[{"vendor":"cinny_project","product":"cinny"},{"vendor":"debian","product":"debian_linux"},{"vendor":"matrix","product":"element"},{"vendor":"matrix","product":"javascript_sdk"},{"vendor":"matrix","product":"olm"},{"vendor":"schildi","product":"schildichat"}],"references":[{"url":"https://gitlab.matrix.org/matrix-org/olm/-/tags","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","advisory"]},{"url":"https://matrix.org/blog/2021/12/13/disclosure-buffer-overflow-in-libolm-and-matrix-js-sdk","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://www.debian.org/security/2022/dsa-5034","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44538"},{"url":"https://github.com/advisories/GHSA-q7f4-j236-f4hc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-44538","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-44538","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0571.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29773","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2021-0584.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29794","tags":["report"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/91.4.1/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2021-55/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220058-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1194020","tags":["report"]},{"url":"https://bugzilla.suse.com/1194215","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44538","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-44538","tags":["report"]},{"url":"https://matrix.org/blog/2021/12/13/disclosure-buffer-overflow-in-libolm-and-matrix-js-sdk/","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2021-55/#CVE-2021-44538","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5246-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5248-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-4126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-4129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-4140","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-29981","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-29982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-29987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-29991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38495","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38496","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38497","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38498","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38500","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38501","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38502","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38503","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38504","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38506","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38507","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38508","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38509","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-43528","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-43534","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-43535","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-43536","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-43537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-43538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-43539","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-43541","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-43542","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-43543","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-43545","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-43546","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22737","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22738","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22739","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22740","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22743","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22745","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22747","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22748","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22751","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZTUQBSMWYBVSTVDYNNRW5EOI5CCOSTPZ/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-44538","description":"The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is partially controllable by the remote party of the channel. Attackers can construct a crafted sequence of messages to manipulate the state of the receiver's session in such a way that, for some buffer sizes, a buffer overflow happens on a call to olm_session_describe. Furthermore, safe buffer sizes were undocumented. The overflow content is partially controllable by the attacker and limited to ASCII spaces and digits. The known affected products are Element Web And SchildiChat Web.","status":"published","published":"2021-12-14T13:26:32Z","modified":"2024-08-04T04:25:16.851Z","updated_at":"2026-11-02T14:33:01.166399Z"}],"euvd":[{"id":"EUVD-2021-31369","description":"The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is partially controllable by the remote party of the channel. Attackers can construct a crafted sequence of messages to manipulate the state of the receiver's session in such a way that, for some buffer sizes, a buffer overflow happens on a call to olm_session_describe. Furthermore, safe buffer sizes were undocumented. The overflow content is partially controllable by the attacker and limited to ASCII spaces and digits. The known affected products are Element Web And SchildiChat Web.","status":"published","published":"2021-12-14T13:26:32Z","modified":"2024-08-04T04:25:16Z","updated_at":"2026-11-03T03:08:29.150764Z"}],"ghsa":[{"id":"GHSA-q7f4-j236-f4hc","title":"The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer...","description":"The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is partially controllable by the remote party of the channel. Attackers can construct a crafted sequence of messages to manipulate the state of the receiver's session in such a way that, for some buffer sizes, a buffer overflow happens on a call to olm_session_describe. Furthermore, safe buffer sizes were undocumented. The overflow content is partially controllable by the attacker and limited to ASCII spaces and digits. The known affected products are Element Web And SchildiChat Web.","status":"published","published":"2021-12-15T00:01:03Z","modified":"2023-02-01T05:06:52Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:50:26.062502Z"}],"nvd":[{"id":"CVE-2021-44538","description":"The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is partially controllable by the remote party of the channel. Attackers can construct a crafted sequence of messages to manipulate the state of the receiver's session in such a way that, for some buffer sizes, a buffer overflow happens on a call to olm_session_describe. Furthermore, safe buffer sizes were undocumented. The overflow content is partially controllable by the attacker and limited to ASCII spaces and digits. The known affected products are Element Web And SchildiChat Web.","status":"published","published":"2021-12-14T14:15:09.41Z","modified":"2026-06-17T04:12:32.31Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:07:02.189991Z"}],"osv":[{"id":"ALPINE-CVE-2021-44538","description":"The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is partially controllable by the remote party of the channel. Attackers can construct a crafted sequence of messages to manipulate the state of the receiver's session in such a way that, for some buffer sizes, a buffer overflow happens on a call to olm_session_describe. Furthermore, safe buffer sizes were undocumented. The overflow content is partially controllable by the attacker and limited to ASCII spaces and digits. The known affected products are Element Web And SchildiChat Web.","status":"published","published":"2021-12-14T14:15:09.41Z","modified":"2026-11-03T06:32:41.661452504Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"CVE-2021-44538","description":"The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is partially controllable by the remote party of the channel. Attackers can construct a crafted sequence of messages to manipulate the state of the receiver's session in such a way that, for some buffer sizes, a buffer overflow happens on a call to olm_session_describe. Furthermore, safe buffer sizes were undocumented. The overflow content is partially controllable by the attacker and limited to ASCII spaces and digits. The known affected products are Element Web And SchildiChat Web.","status":"published","published":"2021-12-14T14:15:09.41Z","modified":"2026-11-06T10:46:27.004720874Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-06T11:08:57.800854Z"},{"id":"DEBIAN-CVE-2021-44538","description":"The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is partially controllable by the remote party of the channel. Attackers can construct a crafted sequence of messages to manipulate the state of the receiver's session in such a way that, for some buffer sizes, a buffer overflow happens on a call to olm_session_describe. Furthermore, safe buffer sizes were undocumented. The overflow content is partially controllable by the attacker and limited to ASCII spaces and digits. The known affected products are Element Web And SchildiChat Web.","status":"published","published":"2021-12-14T14:15:09.41Z","modified":"2026-10-23T18:05:23.574479928Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"UBUNTU-CVE-2021-44538","description":"The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is partially controllable by the remote party of the channel. Attackers can construct a crafted sequence of messages to manipulate the state of the receiver's session in such a way that, for some buffer sizes, a buffer overflow happens on a call to olm_session_describe. Furthermore, safe buffer sizes were undocumented. The overflow content is partially controllable by the attacker and limited to ASCII spaces and digits. The known affected products are Element Web And SchildiChat Web.","status":"published","published":"2021-12-14T14:15:00Z","modified":"2026-10-17T12:55:47.650135397Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"DLA-2874-1","title":"thunderbird - security update","status":"published","published":"2022-01-04T00:00:00Z","modified":"2026-03-09T01:20:17.063136Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5034-1","title":"thunderbird - security update","status":"published","published":"2022-01-02T00:00:00Z","modified":"2026-03-09T02:10:58.437575Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2021-0571","title":"Updated olm packages fix security vulnerability","description":"Updated olm packages fix security vulnerability:\n\nThe olm_session_describe function in Matrix libolm before 3.2.7 is\nvulnerable to a buffer overflow. The Olm session object represents a\ncryptographic channel between two parties. Therefore, its state is\npartially controllable by the remote party of the channel. Attackers\ncan construct a crafted sequence of messages to manipulate the state\nof the receiver's session in such a way that, for some buffer sizes,\na buffer overflow happens on a call to olm_session_describe.\nFurthermore, safe buffer sizes were undocumented. The overflow content\nis partially controllable by the attacker and limited to ASCII spaces\nand digits (CVE-2021-44538).\n","status":"published","published":"2021-12-19T16:13:42Z","modified":"2026-04-16T04:43:54.391583816Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"MGASA-2021-0584","title":"Updated thunderbird packages fix security vulnerability","description":"OpenPGP signature status doesn't consider additional message content.\n(CVE-2021-4126)\n\nMatrix chat library libolm bundled with Thunderbird vulnerable to a\nbuffer overflow. (CVE-2021-44538)\n","status":"published","published":"2021-12-23T21:01:45Z","modified":"2026-04-16T04:43:44.994541452Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2022:0058-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\n- Mozilla Thunderbird 91.4.1\n- CVE-2021-4126: OpenPGP signature status doesn't consider additional message content. (bsc#1194215)\n- CVE-2021-44538: Matrix chat library libolm bundled with Thunderbird vulnerable to a buffer overflow. (bsc#1194020)\n","status":"published","published":"2022-01-12T08:20:27Z","modified":"2026-02-04T02:38:58.754337Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11698-1","title":"MozillaThunderbird-91.4.1-1.1 on GA media","description":"These are all security issues fixed in the MozillaThunderbird-91.4.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:51:55.431653Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2022:0058-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\n- Mozilla Thunderbird 91.4.1\n- CVE-2021-4126: OpenPGP signature status doesn't consider additional message content. (bsc#1194215)\n- CVE-2021-44538: Matrix chat library libolm bundled with Thunderbird vulnerable to a buffer overflow. (bsc#1194020)\n","status":"published","published":"2022-01-12T08:20:26Z","modified":"2026-02-04T03:56:43.837868Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"USN-5248-1","title":"thunderbird vulnerabilities","description":"Multiple security issues were discovered in Thunderbird. If a user were\ntricked into opening a specially crafted website in a browsing context, an\nattacker could potentially exploit these to cause a denial of service,\nobtain sensitive information, trick a user into accepting unwanted\npermissions, conduct header splitting attacks, conduct spoofing attacks,\nbypass security restrictions, confuse the user, or execute arbitrary code.\n(CVE-2021-4129, CVE-2021-4140, CVE-2021-29981, CVE-2021-29982,\nCVE-2021-29987, CVE-2021-29991, CVE-2021-38495, CVE-2021-38496,\nCVE-2021-38497, CVE-2021-38498, CVE-2021-38500, CVE-2021-38501,\nCVE-2021-38503, CVE-2021-38504, CVE-2021-38506, CVE-2021-38507,\nCVE-2021-38508, CVE-2021-38509, CVE-2021-43534, CVE-2021-43535,\nCVE-2021-43536, CVE-2021-43537, CVE-2021-43538, CVE-2021-43539,\nCVE-2021-43541, CVE-2021-43542, CVE-2021-43543, CVE-2021-43545,\nCVE-2021-43656, CVE-2022-22737, CVE-2022-22738, CVE-2022-22739,\nCVE-2022-22740, CVE-2022-22741, CVE-2022-22742, CVE-2022-22743,\nCVE-2022-22745, CVE-2022-22747, CVE-2022-22748, CVE-2022-22751)\n\nIt was discovered that Thunderbird ignored the configuration to require\nSTARTTLS for an SMTP connection. A person-in-the-middle could potentially\nexploit this to perform a downgrade attack in order to intercept messages\nor take control of a session. (CVE-2021-38502)\n\nIt was discovered that JavaScript was unexpectedly enabled in the\ncomposition area. An attacker could potentially exploit this in\ncombination with another vulnerability, with unspecified impacts.\n(CVE-2021-43528)\n\nA buffer overflow was discovered in the Matrix chat library bundled with\nThunderbird. An attacker could potentially exploit this to cause a denial\nof service, or execute arbitrary code. (CVE-2021-44538)\n\nIt was discovered that Thunderbird's OpenPGP integration only considered\nthe inner signed message when checking signature validity in a message\nthat contains an additional outer MIME layer. An attacker could\npotentially exploit this to trick the user into thinking that a message\nhas a valid signature. (CVE-2021-4126)\n","status":"published","published":"2022-01-21T17:00:48Z","modified":"2026-04-27T15:48:44.123941204Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}