This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 153.5 (MFSA 2026-110, bsc#1284493):
- CVE-2026-109704: Privilege escalation in the Application Update component.
- CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the
Networking component.
- CVE-2026-109706: Use-after-free in the Storage: IndexedDB component.
- CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component.
- CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component.
- CVE-2026-109709: Information disclosure, pri
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 153.4 (MFSA 2026-96, MFSA 2026-103, bsc#1280371, bsc#1282929):
- CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component.
- CVE-2026-92006: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
- CVE-2026-92007: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
- CVE-2026-92008: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
- CVE-2026-92009: Privilege escalation due to incorrect boundary cond
This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird 153.2:
* fixed: Deleting an Exchange account retained the outgoing
server settings
* fixed: Thunderbird upgrade disabled Settings menu for
versions before macOS 13
* fixed: Windows jump list menu no longer functioned correctly
* fixed: Security fixes MFSA 2026-88 (bsc#1278001):
* CVE-2026-84639
Uninitialized memory in MIME parsing
* CVE-2026-84640
One byte overflow read in mail parser
* CVE-2026-84641
Information disclosure due to malicious IMAP server response
* CVE-2026-84637
Calendar invitation attachments coul
This update for MozillaThunderbird fixes the following issue:
Update to Mozilla Thunderbird 140.14.
- MFSA 2026-79 (bsc#1274867)
* CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL component
* CVE-2026-74935: Privilege escalation in the DOM: Networking component
* CVE-2026-74936: Use-after-free in the JavaScript: WebAssembly component
* CVE-2026-74939: Privilege escalation in the DOM: Navigation component
* CVE-2026-74940: Use-after-free in the Graphics: Text component
* CVE-2026-74941: Privilege escalation in the Graphics: CanvasWebGL component
* CVE-2026-74942: Privilege escalation in the Remote Settings Clie
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 140.13.
- MFSA 2026-72 (bsc#1271649)
* CVE-2026-14899: Off-by-one out of bounds read in MIME header parser for forwarding
* CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component
* CVE-2026-15719: Site isolation issue in the DOM: Navigation component
* CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation component
* CVE-2026-16350: Incorrect boundary conditions in the Audio/Video: cubeb component
* CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component
* CVE-2026-16351: Sandbox escape due to us
This update for MozillaThunderbird fixes the following issues
Update to Firefox 140.12.0 ESR (MFSA 2026-58, bsc#1268071):
- CVE-2026-12289: Privilege escalation in the Graphics: WebRender component.
- CVE-2026-12290: Memory safety bug fixed in Firefox ESR 140.12.
- CVE-2026-12291: Use-after-free in the Networking: HTTP component.
- CVE-2026-12292: Incorrect boundary conditions in the Web Audio component.
- CVE-2026-12294: Sandbox escape in the DOM: Workers component.
- CVE-2026-12295: Sandbox escape in the DOM: Navigation component.
- CVE-2026-12296: Sandbox escape in the Security: Process Sandboxing component.
- CVE-2026-12297: Sandbox esc
This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird 140.8 MFSA 2026-17 (bsc#1258568):
- CVE-2026-2757: Incorrect boundary conditions in the WebRTC: Audio/Video
component
- CVE-2026-2758: Use-after-free in the JavaScript: GC component
- CVE-2026-2759: Incorrect boundary conditions in the Graphics: ImageLib
component
- CVE-2026-2760: Sandbox escape due to incorrect boundary conditions in the
Graphics: WebRender component
- CVE-2026-2761: Sandbox escape in the Graphics: WebRender component
- CVE-2026-2762: Integer overflow in the JavaScript: Standard Library component
- CVE-2026-2763: Use-after-free in the
This update for MozillaThunderbird fixes the following issues:
- Update to Thunderbird 140.7.2
- CVE-2026-2447: Fixed a heap buffer overflow in libvpx. (bsc#1258231)
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 140.7.1 MFSA 2026-08 (bsc#1257397):
- CVE-2026-0818: CSS-based exfiltration of the content from partially encrypted emails when allowing remote content
This update for MozillaThunderbird fixes the following issues:
MFSA 2026-05 (bsc#1256340):
- CVE-2026-0877: Mitigation bypass in the DOM in Security component
- CVE-2026-0878: Sandbox escape due to incorrect boundary conditions in the
Graphics in CanvasWebGL component
- CVE-2026-0879: Sandbox escape due to incorrect boundary conditions in the
Graphics component
- CVE-2026-0880: Sandbox escape due to integer overflow in the Graphics
component
- CVE-2026-0882: Use-after-free in the IPC component
- CVE-2025-14327: Spoofing issue in the Downloads Panel component
- CVE-2026-0883: Information disclosure in the Networking
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 140.6 (bsc#1254551).
- MFSA 2025-96
* CVE-2025-14321: use-after-free in the WebRTC: Signaling component.
* CVE-2025-14322: sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
* CVE-2025-14323: privilege escalation in the DOM: Notifications component.
* CVE-2025-14324: JIT miscompilation in the JavaScript Engine: JIT component.
* CVE-2025-14325: JIT miscompilation in the JavaScript Engine: JIT component.
* CVE-2025-14328: privilege escalation in the Netmonitor component.
* CVE-2025-14329: priv
This update for MozillaThunderbird fixes the following issues:
- Update Mozilla Thunderbird to version 140.5 (bsc#1253188)
- CVE-2025-13012: Race condition in the Graphics component.
- CVE-2025-13016: Incorrect boundary conditions in the JavaScript: WebAssembly component.
- CVE-2025-13017: Same-origin policy bypass in the DOM: Notifications component.
- CVE-2025-13018: Mitigation bypass in the DOM: Security component.
- CVE-2025-13019: Same-origin policy bypass in the DOM: Workers component.
- CVE-2025-13013: Mitigation bypass in the DOM: Core & HTML component.
- CVE-2025-13020: Use-after-free in the WebRTC: Audio/Video component.
- CVE-2025
This update for MozillaThunderbird fixes the following issue:
Mozilla Thunderbird is updated to 140.4.
* changed: Account Hub is now disabled by default for second
email account (bmo#1992027)
* changed: Flatpak runtime has been updated to Freedesktop SDK
24.08 (bmo#1952100)
* fixed: Users could not read mail signed with OpenPGP v6 and
PQC keys (bmo#1986845)
* fixed: Image preview in Insert Image dialog failed with CSP
error for web resources (bmo#1989392)
* fixed: Emptying trash on exit did not work with some
providers (bmo#1975147)
* fixed: Thunderbird could crash when applying filters
(bmo#1987880)
* fixed: Users
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 140.3 (bsc#1249391).
Security issues fixed:
- MFSA 2025-78
* CVE-2025-10527: sandbox escape due to use-after-free in the Graphics: Canvas2D component.
* CVE-2025-10528: sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component.
* CVE-2025-10529: same-origin policy bypass in the Layout component.
* CVE-2025-10532: incorrect boundary conditions in the JavaScript: GC component.
* CVE-2025-10533: integer overflow in the SVG component.
* CVE-2025-10536: information disclosure in the Networking: Cache compo
This update for MozillaThunderbird fixes the following issues:
Updated to Mozilla Thunderbird 140.2 MFSA 2025-72 (bsc#1248162):
* CVE-2025-9179: Sandbox escape due to invalid pointer in the Audio/Video: GMP
component
* CVE-2025-9180: Same-origin policy bypass in the Graphics: Canvas2D component
* CVE-2025-9181: Uninitialized memory in the JavaScript Engine component
* CVE-2025-9182: Denial-of-service due to out-of-memory in the Graphics:
WebRender component
* CVE-2025-9184: Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
ESR 140.2, Firefox 142 and Thunderbird 142
* CVE-2025-9185: Memory safety bugs fixed in
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 140.1 (MFSA 2025-63) (bsc#1246664):
- CVE-2025-8027: JavaScript engine only wrote partial return value to stack (bmo#1968423)
- CVE-2025-8028: Large branch table could lead to truncated instruction (bmo#1971581)
- CVE-2025-8029: javascript: URLs executed on object and embed tags (bmo#1928021)
- CVE-2025-8036: DNS rebinding circumvents CORS (bmo#1960834)
- CVE-2025-8037: Nameless cookies shadow secure cookies (bmo#1964767)
- CVE-2025-8030: Potential user-assisted code execution in 'Copy as cURL' command (bmo#1968414)
- CVE-2025-8031: Incorrect URL st
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 128.12 (MFSA 2025-55, bsc#1244670):
- CVE-2025-6424: Use-after-free in FontFaceSet (bmo#1966423)
- CVE-2025-6425: The WebCompat WebExtension shipped exposed a persistent UUID (bmo#1717672)
- CVE-2025-6426: No warning when opening executable terminal files on macOS (bmo#1964385)
- CVE-2025-6429: Incorrect parsing of URLs could have allowed embedding of youtube.com (bmo#1970658)
- CVE-2025-6430: Content-Disposition header ignored when a file is included in an embed or object tag (bmo#1971140)
This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird 128.11.1
- CVE-2025-5986: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (MFSA 2025-49) (bsc#1244468).
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 128.11 (MFSA 2025-46, bsc#1243353):
- CVE-2025-5262: Double-free in libvpx encoder (bmo#1962421)
- CVE-2025-5263: Error handling for script execution was incorrectly isolated from web content (bmo#1960745)
- CVE-2025-5264: Potential local code execution in 'Copy as cURL' command (bmo#1950001)
- CVE-2025-5265: Potential local code execution in 'Copy as cURL' command (bmo#1962301)
- CVE-2025-5266: Script element events leaked cross-origin resource status (bmo#1965628)
- CVE-2025-5267: Clickjacking vulnerability could have led to leaking saved payment