https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T12:08:51.858408+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:70642 ALSA-2026:70642 — Important: thunderbird security update 2026-10-02T12:08:51.980934+00:00

Affected: AlmaLinux:9: thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365) * firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874) * firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121) * firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145) * firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119) * firefox: Use-after-free in the Audio/Video component (CVE-2026-84120) * firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124) * firefox: Use-after-free in the Audio/Video component (CVE-2026-84122) * firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143) * thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639) * thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641) * thunderbird: One byte overflow read in mail parser (CVE-2026-84640) * firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024) * firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019) * firefox: thunderbird: U…

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1106 certfr-2026-avi-1106 — De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un atta… 2026-10-02T12:08:51.981021+00:00 certfr-2026-avi-1106 https://cve.radiocsirt.org/vuln/euvd-2026-363284 EUVD-2026-363284 2026-10-02T12:08:51.981042+00:00 EUVD-2026-363284 https://cve.radiocsirt.org/vuln/fkie_cve-2026-84641 fkie_cve-2026-84641 2026-10-02T12:08:51.981055+00:00

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

 https://cve.radiocsirt.org/vuln/ghsa-f2hg-25f8-vgfj GHSA-f2hg-25f8-vgfj 2026-10-02T12:08:51.981076+00:00

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

 https://cve.radiocsirt.org/vuln/oesa-2026-3842 OESA-2026-3842 — thunderbird security update 2026-10-02T12:08:51.981090+00:00

Affected: openEuler:24.03-LTS-SP4: thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es):

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84119)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84120)

Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84121)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84122)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84124)

Privilege escalation due to invalid pointer in the Graphics component of Mozilla Firefox. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84131)

Internally found bugs present in Firefox 154, Firefox ESR 153.1 and Firefox ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and F…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11678-1 openSUSE-SU-2026:11678-1 — MozillaThunderbird-140.15.0-1.1 on GA media 2026-10-02T12:08:51.981130+00:00

MozillaThunderbird-140.15.0-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:73971 RHSA-2026:73971 — Red Hat Security Advisory: thunderbird security update 2026-10-02T12:08:51.981154+00:00

firefox: thunderbird: Privilege escalation in the DOM: Workers component firefox: thunderbird: Sandbox escape in the Remote Settings Client component firefox: Sandbox escape due to use-after-free in the DOM: Navigation component firefox: Use-after-free in the Audio/Video component firefox: Sandbox escape due to use-after-free in the DOM: Security component firefox: Use-after-free in the Audio/Video component firefox: Use-after-free in the DOM: Core & HTML component firefox: Privilege escalation due to invalid pointer in the Graphics component firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 thunderbird: Uninitialized memory in MIME parsing thunderbird: One byte overflow read in mail parser thunderbird: Information disclosure due to malicious IMAP server response firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component firefox: thun…

 https://cve.radiocsirt.org/vuln/rlsa-2026:70642 RLSA-2026:70642 — Important: thunderbird security update 2026-10-02T12:08:51.981250+00:00

Affected: Rocky Linux:9: thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)

* firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)

* firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)

* firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)

* firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)

* firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)

* firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)

* firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)

* firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)

* firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

* thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)

* thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)

* thunderbird: One byte overflow read in mail parser (CVE-2026-84640)

* firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)

* firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)

* firefox: thunderbird: Use-after-free in the…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-84641 UBUNTU-CVE-2026-84641 2026-10-02T12:08:51.981304+00:00

Affected: Ubuntu:22.04:LTS: thunderbird, Ubuntu:24.04:LTS: thunderbird, Ubuntu:26.04:LTS: thunderbird

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3132 WID-SEC-W-2026-3132 — Mozilla Firefox und Thunderbird: Mehrere Schwachstellen 2026-10-02T12:08:51.981326+00:00

Ein Angreifer kann mehrere Schwachstellen in Mozilla Firefox und Thunderbird ausnutzen, um Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, sensible Informationen offenzulegen, Daten zu manipulieren, Spoofing-Angriffe durchzuführen, möglicherweise durch Speicherbeschädigungen beliebigen Code auszuführen oder Denial-of-Service-Zustände herbeizuführen.