SUSE-SU-2026:4268-1

SUSE-SU-2026:4268-1 · Security update for MozillaThunderbird

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Cette page présente une partie des faits des sources. Consultez les avis liés pour la description complète et les versions concernées.

This update for MozillaThunderbird fixes the following issues: Mozilla Thunderbird 153.2: * fixed: Deleting an Exchange account retained the outgoing server settings * fixed: Thunderbird upgrade disabled Settings menu for versions before macOS 13 * fixed: Windows jump list menu no longer functioned correctly * fixed: Security fixes MFSA 2026-88 (bsc#1278001): * CVE-2026-84639 Uninitialized memory in MIME parsing * CVE-2026-84640 One byte overflow read in mail parser * CVE-2026-84641 Information disclosure due to malicious IMAP server response * CVE-2026-84637 Calendar invitation attachments could launch local executables * CVE-2026-84642 Allowed UNC hostnames for attachments interpreted as a regular expression * CVE-2026-75874 Sandbox escape in the Remote Settings Client component * CVE-2026-84118 Use-after-free in the JavaScript: GC component * CVE-2026-84119 Sandbox escape due to use-after-free in the DOM: Navigation component * CVE-2026-84120 Use-after-free in the Audio/Video component * CVE-2026-84121 Sandbox escape due to use-after-free in the DOM: Security component * CVE-2026-84122 Use-after-free in the Audio/Video component * CVE-2026-84123 Privilege escalation due to use-after-free in the Graphics: WebGPU component * CVE-2026-84124 Use-after-free in the DOM: Core & HTML component * CVE-2026-84125 Use-after-free in the DOM: Core & HTML component * CVE-2026-74952 Privilege escalation in the Application Update component * CVE-2026-84129 Site isolation issue in the DOM: Navigation component * CVE-2026-84130 Information disclosure in the Graphics: WebGPU component * CVE-2026-84131 Privilege escalation due to invalid pointer in the Graphics component * CVE-2026-84132 Information disclosure in the Networking: HTTP component * CVE-2026-84133 Site isolation issue in the DOM: Push Subscriptions component * CVE-2026-84134 Other issue in the Profile Backup component * CVE-2026-84136 Other issue in the DOM: Navigation component * CVE-2026-84137 Spoofing issue in the DOM: Core & HTML component * CVE-2026-84139 Clickjacking issue in the DOM: Events component * CVE-2026-84140 Site isolation issue in the DOM: Navigation component * CVE-2026-84141 Integer overflow in the Graphics: ImageLib component * CVE-2026-84143 Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15 * CVE-2026-84144 Internally found bugs fixed in Thunderbird 155 and Thunderbird ESR 153.2 * CVE-2026-84145 Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15 - Mozilla Thunderbird 153.1.1 * fixed: Thunderbird upgrade disabled composition toolbar * fixed: Draft was not preserved when encrypted message send failed * fixed: Account Hub prompted for calendar credentials after successful login * fixed: Thunderbird crash fixes * fixed: Folder compaction showed incorrect disk space recovery estimates * fixed: Thunderbird failed to launch GPU process - Mozilla Thunderbird 153.1 * fixed: Autoscroll icon was missing directional arrows in scrollable messages * fixed: Security fixes MFSA 2026-80 (bsc#1274867): * CVE-2026-74934 Site isolation issue in the Graphics: CanvasWebGL component * CVE-2026-74935 Privilege escalation in the DOM: Networking component * CVE-2026-74936 Use-after-free in the JavaScript: WebAssembly component * CVE-2026-74937 Use-after-free in the JavaScript: GC component * CVE-2026-74938 Mitigation bypass in the JavaScript: GC component * CVE-2026-74939 Privilege escalation in the DOM: Navigation component * CVE-2026-74940 Use-after-free in the Graphics: Text component * CVE-2026-74941 Privilege escalation in the Graphics: CanvasWebGL component * CVE-2026-74942 Privilege escalation in the Remote Settings Client component * CVE-2026-74943 Use-after-free in the Graphics: ImageLib component * CVE-2026-74944 Use-after-free in the DOM: Core & HTML component * CVE-2026-74945 Information disclosure in the Graphics: Text component * CVE-2026-74946 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component * CVE-2026-74947 Privilege escalation due to invalid pointer in the Graphics component * CVE-2026-74948 Information disclosure in the Graphics component * CVE-2026-74949 Privilege escalation due to use-after-free in the Graphics: Canvas2D component * CVE-2026-74950 Privilege escalation in the Downloads API component * CVE-2026-74953 Privilege escalation in the Networking: Cookies component * CVE-2026-74954 Information disclosure due to side-channel in the Storage: Cache API component * CVE-2026-74955 Privilege escalation in the Request Handling component * CVE-2026-74956 Same-origin policy bypass in the DOM: Service Workers component * CVE-2026-74957 Mitigation bypass in the Safe Browsing component * CVE-2026-74958 Information disclosure in the WebRTC component * CVE-2026-74959 Mitigation bypass in the Storage: Cache API component * CVE-2026-74960 Site isolation issue in the WebExtensions component * CVE-2026-74961 Side-channel in the Web Audio component * CVE-2026-74962 Site isolation issue in the Networking: Cookies component * CVE-2026-74963 Same-origin policy bypass in the Networking: Cookies component * CVE-2026-74964 Integer overflow in the Graphics component * CVE-2026-74965 Privilege escalation in the Shell Integration component * CVE-2026-74966 Information disclosure in the Form Autofill component * CVE-2026-74967 Same-origin policy bypass in the Audio/Video: Playback component * CVE-2026-74968 Site isolation issue in the Graphics: WebRender component * CVE-2026-74969 Use-after-free in the Layout: Text and Fonts component * CVE-2026-74970 Site isolation issue in the Graphics component * CVE-2026-74971 Information disclosure in the DOM: UI Events & Focus Handling component * CVE-2026-74972 Information disclosure in the DOM: Push Subscriptions component * CVE-2026-74973 Race condition, use-after-free in the Graphics component * CVE-2026-74974 Same-origin policy bypass in the Graphics: ImageLib component * CVE-2026-74976 JIT miscompilation in the JavaScript Engine: JIT component * CVE-2026-74977 Integer overflow in the Graphics component * CVE-2026-74978 Clickjacking issue in the Widget component * CVE-2026-74979 Mitigation bypass in the Add-ons Manager component * CVE-2026-74981 Site isolation issue in the Audio/Video: Web Codecs component * CVE-2026-74982 Denial-of-service in the Widget component * CVE-2026-74983 Mitigation bypass in the Data Loss Prevention component * CVE-2026-74984 Race condition in the JavaScript Engine component * CVE-2026-74985 Privilege escalation in the Enterprise Policies component * CVE-2026-74986 Site isolation issue in the CSS Parsing and Computation component * CVE-2026-74987 Internally found bugs fixed in Thunderbird ESR 140.14, Thunderbird ESR 153.1 and Thunderbird 154 * CVE-2026-74988 Internally found bugs fixed in Thunderbird ESR 153.1 and Thunderbird 154 * CVE-2026-74990 Internally found bugs fixed in Thunderbird ESR 140.14, Thunderbird ESR 153.1 and Thunderbird 154 - Mozilla Thunderbird 153.0.3 * fixed: Dragging attachments from Local Folders to the desktop failed on Windows * fixed: IMAP tags did not sync automatically across clients * fixed: DisablePasswordReveal policy failed to prevent revealing saved

Correctif disponible

Publication

2026-09-18T14:51:02Z

Mise à jour

2026-09-19T09:00:04.375866356Z

Pile logicielle: system

Vérifiez votre serveur →