thunderbird: The olm_session_describe function in Matrix libolm before 3.2.7 isvulnerable to a buffer overflow

The olm_session_describe function in Matrix libolm before 3.2.7 isvulnerable to a buffer overflow. The Olm session object represents acryptographic channel between two parties. Therefore, its state ispartially controllable by the remote party of the channel. Attackers canconstruct a crafted sequence of messages to manipulate the state of thereceiver's session in such a way that, for some buffer sizes, a bufferoverflow happens on a call to olm_session_describe. Furthermore, safebuffer sizes were undocumented. The overflow content is partiallycontrollable by the attacker and limited to ASCII spaces and digits. Theknown affected products are Element Web And SchildiChat Web.

Where it's fixed