Most recent entries from all

ALSA-2026:6188 — Important: thunderbird security update

Affected: AlmaLinux:9: thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4721) * firefox: thunderbird: Privilege escalation in the Netmonitor component (CVE-2026-4717) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-4688) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4706) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4695) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4689) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-4698) * firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component (CVE-2026-4716) * firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component (CVE-2026-4684) * firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4705) * firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component (CVE-2026-4715) * firefox: thunderbird: Incorrect boundary conditions…

bdu:2026-12134

certfr-2026-avi-0354 — De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un atta…

certfr-2026-avi-0354

cnvd-2026-16380

EUVD-2026-290607

fkie_cve-2026-3889

Spoofing issue in Thunderbird. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.

GHSA-g3qh-qhp8-8f86

Spoofing issue in Thunderbird. This vulnerability affects Thunderbird < 149 and Thunderbird < 140.9.

OESA-2026-1993 — thunderbird security update

Affected: openEuler:24.03-LTS-SP2: thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es):

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.(CVE-2025-59375)

Spoofing issue in Thunderbird. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.(CVE-2026-3889)

A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.(CVE-2026-4371)

Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4684)

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4685)

Sandbox escape due to incorrect boundary conditions in the…

openSUSE-SU-2026:10447-1 — MozillaThunderbird-140.9.0-1.1 on GA media

MozillaThunderbird-140.9.0-1.1 on GA media

RHSA-2026:8285 — Red Hat Security Advisory: thunderbird security update

thunderbird: Spoofing issue in Thunderbird thunderbird: Out of bounds read in IMAP parsing firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component firefox: thunderbird: Sandbox escape in the Responsive Design Mode component firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics component firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component firefox: thunderbird:…

UBUNTU-CVE-2026-3889

Affected: Ubuntu:18.04:LTS: mozjs52, Ubuntu:18.04:LTS: mozjs38, Ubuntu:20.04:LTS: mozjs68, Ubuntu:20.04:LTS: mozjs52, Ubuntu:22.04:LTS: mozjs102, Ubuntu:22.04:LTS: mozjs78, Ubuntu:22.04:LTS: mozjs91, Ubuntu:22.04:LTS: thunderbird, Ubuntu:24.04:LTS: mozjs102, Ubuntu:24.04:LTS: mozjs115

Spoofing issue in Thunderbird. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.

WID-SEC-W-2026-0850 — Mozilla Firefox und Mozilla Thunderbird: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Firefox und Mozilla Thunderbird ausnutzen, um beliebigen Code auszuführen, um einen Denial of Service herbeizuführen, um Informationen offenzulegen, um Sicherheitsmechanismen zu umgehen, um den Benutzer zu täuschen und um nicht näher spezifizierte Auswirkungen zu erzielen.