This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 128.7 (MFSA 2025-10, bsc#1236539).
Security fixes:
- CVE-2025-1009: use-after-free in XSLT.
- CVE-2025-1010: use-after-free in Custom Highlight.
- CVE-2025-1011: a bug in WebAssembly code generation could result in a crash.
- CVE-2025-1012: use-after-free during concurrent delazification.
- CVE-2024-11704: potential double-free vulnerability in PKCS#7 decryption handling.
- CVE-2025-1013: potential opening of private browsing tabs in normal browsing windows.
- CVE-2025-1014: certificate length was not properly checked.
- CVE-2025-10
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird ESR 128.6 (MFSA 2025-05, bsc#1234991)
Security fixes:
- CVE-2025-0237 (bmo#1915257)
WebChannel APIs susceptible to confused deputy attack
- CVE-2025-0238 (bmo#1915535)
Use-after-free when breaking lines in text
- CVE-2025-0239 (bmo#1929156)
Alt-Svc ALPN validation failure when redirected
- CVE-2025-0240 (bmo#1929623)
Compartment mismatch when parsing JavaScript JSON module
- CVE-2025-0241 (bmo#1933023)
Memory corruption when using JavaScript Text Segmentation
- CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
This update for MozillaThunderbird fixes the following issues:
- CVE-2024-50336: Fixed insufficient MXC URI validation which could allow client-side path traversal (bsc#1234413)
Other fixes:
- Updated to Mozilla Thunderbird 128.5.2i (bsc#1234413):
* fixed: Large virtual folders could be very slow
* fixed: Message could disappear after moving from IMAP folder
followed by Undo and Redo
* fixed: XMPP chat did not display messages sent inside a CDATA
element
* fixed: Selected calendar day did not move forward at midnight
* fixed: Today pane agenda sometimes scrolled for no apparent
reason
* fixed: CalDAV calendars w
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 128.5
* fixed: IMAP could crash when reading cached messages
* fixed: Enabling 'Show Folder Size' on Maildir profile could
render Thunderbird unusable
* fixed: Messages corrupted by folder compaction were only
fixed by user intervention
* fixed: Reading a message from past the end of an mbox file
did not cause an error
* fixed: View -> Folders had duplicate F access keys
* fixed: Add-ons adding columns to the message list could fail
and cause display issue
* fixed: 'Empty trash on exit' and 'Expunge inbox on exit' did
not al
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 128.4.3
* fixed: Folder corruption could cause Thunderbird to freeze
and become unusable
* fixed: Message corruption could be propagated when reading mbox
* fixed: Folder compaction was not abandoned on shutdown
* fixed: Folder compaction did not clean up on failure
* fixed: Collapsed NNTP thread incorrectly indicated there were
unread messages
* fixed: Navigating to next unread message did not wait for all
messages to be loaded
* fixed: Applying column view to folder and children could
break if folder error occurred
* fixed:
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 128.3.1 (MFSA 2024-52, bsc#1231413):
- CVE-2024-9680: Fixed use-after-free in Animation timeline (bmo#1923344)
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 128.3.1 (MFSA 2024-51, bsc#1231413):
- CVE-2024-9680: Use-after-free in Animation timeline
Update to Mozilla Thunderbird 128.3 (MFSA 2024-49, bsc#1230979):
- CVE-2024-9392: Compromised content process can bypass site isolation
- CVE-2024-9393: Cross-origin access to PDF contents through multipart responses
- CVE-2024-9394: Cross-origin access to JSON contents through multipart responses
- CVE-2024-8900: Clipboard write permission bypass
- CVE-2024-9396: Potential memory corruption may occur when cloning certain objects
- CVE-2024-9397: Pote
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 128.2.3
MFSA 2024-43 (bsc#1229821)
* CVE-2024-8394: Crash when aborting verification of OTR chat.
* CVE-2024-8385: WASM type confusion involving ArrayTypes.
* CVE-2024-8381: Type confusion when looking up a property name in a 'with' block.
* CVE-2024-8382: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks
ran.
* CVE-2024-8384: Garbage collection could mis-color cross-compartment objects in OOM conditions.
* CVE-2024-8386: SelectElements could be shown over another site if popups are allowed.
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 115.14
* fixed: When using an external installation of GnuPG,
Thunderbird occassionally sent/received corrupted messages
* fixed: Users of external GnuPG were unable to decrypt
incorrectly encoded messages (bmo#1906903)
* fixed: Flatpak install of 128.0esr was incorrectly downgraded
to 115.13.0esr (bmo#1908299)
* fixed: Security fixes
MFSA 2024-38 (bsc#1228648)
* CVE-2024-7519: Out of bounds memory access in graphics shared memory handling
* CVE-2024-7521: Incomplete WebAssembly exception handing
* CVE-2024-7522: Out of bounds rea
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 115.13 (MFSA 2024-31, bsc#1226316):
Security fixes:
- CVE-2024-6600: Memory corruption in WebGL API (bmo#1888340)
- CVE-2024-6601: Race condition in permission assignment (bmo#1890748)
- CVE-2024-6602: Memory corruption in NSS (bmo#1895032)
- CVE-2024-6603: Memory corruption in thread creation (bmo#1895081)
- CVE-2024-6604: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, Thunderbird 128, and Thunderbird 115.13 (bmo#1748105, bmo#1837550, bmo#1884266)
Other fixes:
- fixed: After starting Thunderbird, the message list position was some
This update for MozillaThunderbird fixes the following issues:
Security fixes:
- CVE-2024-34703: Fixed denial of service due to overly large elliptic curve parameters in Botan (bsc#1227239)
Other fixes:
- Mozilla Thunderbird 115.12.1
* 115.12.0 got pulled because of upstream automation process errors
and Windows installer signing changes.
No code changes, changelog is the same as 115.12.0 (bsc#1226495)
This update for MozillaThunderbird fixes the following issues:
- Update to version 115.12.0 ESR (bsc#1226027)
- CVE-2024-5702: Use-after-free in networking
- CVE-2024-5688: Use-after-free in JavaScript object transplant
- CVE-2024-5690: External protocol handlers leaked by timing attack
- CVE-2024-5691: Sandboxed iframes were able to bypass sandbox restrictions to open a new window
- CVE-2024-5692: Bypass of file name restrictions during saving
- CVE-2024-5693: Cross-Origin Image leak via Offscreen Canvas
- CVE-2024-5696: Memory Corruption in Text Fragments
- CVE-2024-5700: Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12, and Thu
This update for MozillaThunderbird fixes the following issues:
Update to version 115.11 (bsc#1224056):
- CVE-2024-4367: Arbitrary JavaScript execution in PDF.js
- CVE-2024-4767: IndexedDB files retained in private browsing mode
- CVE-2024-4768: Potential permissions request bypass via clickjacking
- CVE-2024-4769: Cross-origin responses could be distinguished between script and non-script content-types
- CVE-2024-4770: Use-after-free could occur when printing to PDF
- CVE-2024-4777: Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11
- fixed: Splitter arrow between task list and task description did not behav