SUSE-SU-2026:4627-1

SUSE-SU-2026:4627-1 · Security update for MozillaThunderbird

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Cette page présente une partie des faits des sources. Consultez les avis liés pour la description complète et les versions concernées.

This update for MozillaThunderbird fixes the following issues: Update to Mozilla Thunderbird 153.4 (MFSA 2026-96, MFSA 2026-103, bsc#1280371, bsc#1282929): - CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component. - CVE-2026-92006: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. - CVE-2026-92007: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. - CVE-2026-92008: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. - CVE-2026-92009: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. - CVE-2026-92010: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. - CVE-2026-92011: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. - CVE-2026-92012: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. - CVE-2026-92013: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. - CVE-2026-92015: Privilege escalation in the WebExtensions component. - CVE-2026-92016: Use-after-free in the Disability Access APIs component. - CVE-2026-92017: Privilege escalation in the DOM: Service Workers component. - CVE-2026-92018: Sandbox escape in the DOM: Core & HTML component. - CVE-2026-92019: Mitigation bypass in the Remote Settings Client component. - CVE-2026-92020: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. - CVE-2026-92022: Use-after-free in the DOM: HTML Parser component. - CVE-2026-92023: Use-after-free in the XML component. - CVE-2026-92024: Use-after-free in the SVG component. - CVE-2026-92025: Use-after-free in the DOM: Navigation component. - CVE-2026-92026: Use-after-free in the Networking component. - CVE-2026-92027: Use-after-free in the DOM: Streams component. - CVE-2026-92028: Use-after-free in the DOM: Core & HTML component. - CVE-2026-92029: Use-after-free in the SVG component. - CVE-2026-92030: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. - CVE-2026-92031: Information disclosure in the Graphics: ImageLib component. - CVE-2026-92032: Sandbox escape due to invalid pointer in the Graphics component. - CVE-2026-92035: Sandbox escape due to incorrect boundary conditions in the Graphics component. - CVE-2026-92038: Mitigation bypass in the Remote Settings Client component. - CVE-2026-92039: Mitigation bypass in the DOM: Notifications component. - CVE-2026-92041: Mitigation bypass in the DOM: Networking component. - CVE-2026-92042: Race condition in the DOM: Content Processes component. - CVE-2026-92043: Privilege escalation due to incorrect boundary conditions in the Audio/Video component. - CVE-2026-92044: Information disclosure in the Networking: HTTP component. - CVE-2026-92045: Sandbox escape due to incorrect boundary conditions in the WebRTC component. - CVE-2026-92046: Use-after-free in the Graphics component. - CVE-2026-92047: Privilege escalation in the Crash Reporting component. - CVE-2026-92048: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. - CVE-2026-92049: Use-after-free in the Widget: Win32 component. - CVE-2026-92052: Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component. - CVE-2026-92053: Privilege escalation in the Graphics: CanvasWebGL component. - CVE-2026-92054: Privilege escalation in the Memory component. - CVE-2026-92055: Privilege escalation in the DevTools component. - CVE-2026-92056: Use-after-free in the Graphics: Text component. - CVE-2026-92057: Mitigation bypass in the Enterprise Policies component. - CVE-2026-92058: Use-after-free in the Graphics component. - CVE-2026-92059: Incorrect boundary conditions in the DOM: Editor component. - CVE-2026-92060: Use-after-free in the Internationalization component. - CVE-2026-92062: Privilege escalation in the Session Restore component. - CVE-2026-92064: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. - CVE-2026-92065: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. - CVE-2026-92067: Use-after-free in the Widget: Gtk component. - CVE-2026-92068: Site isolation issue in the Reader Mode component. - CVE-2026-92069: Spoofing issue in the DOM: Navigation component. - CVE-2026-92070: Information disclosure in the Networking component. - CVE-2026-92071: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. - CVE-2026-92072: Incorrect boundary conditions in the Safe Browsing component. - CVE-2026-92073: Privilege escalation in the Enterprise Policies component. - CVE-2026-92074: Mitigation bypass in the Popup Blocker component. - CVE-2026-92075: Mitigation bypass in the Networking component. - CVE-2026-92076: Incorrect boundary conditions in the Networking component. - CVE-2026-92077: Denial-of-service in the SVG component. - CVE-2026-92078: Denial-of-service in the Security component. - CVE-2026-92079: Mitigation bypass in the Widget: Win32 component. - CVE-2026-92238: Ambiguous parsing of mail headers. - CVE-2026-92239: Buffer overrun in IMAP. - CVE-2026-92240: Out-of-bounds read in IMAP response parser. - CVE-2026-96869: Information disclosure in the Networking component. - CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback component. - CVE-2026-100757: Use-after-free in the Widget component. - CVE-2026-100758: Sandbox escape in the DOM: Navigation component. - CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager component. - CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing component. - CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content Processes component. - CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component. - CVE-2026-100766: Information disclosure in the Networking: JAR component. - CVE-2026-100767: Use-after-free in the Networking: Cache component. - CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component. - CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content Processes component. - CVE-2026-100771: Undefined behavior in the DOM: Streams component. - CVE-2026-100772: Use-after-free in the DOM: Core & HTML component. - CVE-2026-100773: Use-after-free in the Storage: IndexedDB component. - CVE-2026-100774: Use-after-free in the DOM: Core & HTML component. - CVE-2026-100775: Sandbox escape in the Graphics component. - CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component. - CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component. - CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core & HTML component. - CVE-2026-100779: Use-after-free in the XSLT component. - CVE-2026-100780: Use-after-free in the DOM: Core & HTML component. - CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. - CVE-2026-100782: Privilege escalation due to incorrect boundary conditions in the Graphics component. - CVE-2026-100783: Uninitialized memory in the Audio/Video component. - CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component. - CVE-2026-100785: Use-after-free in the DOM: Core & HTML component. - CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics component. - CVE-2026-100787: Sandbox escape in the XUL component. - CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component. - CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component. - CVE-2026-100790: Use-after-free in the XSLT component. - CVE-2026-100791: Use-after-free in the DOM: Core & HTML component. - CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly component. - CVE-2026-100794: Sandbox escape due to incorrect bound

Correctif disponible

Publication

2026-10-12T14:57:41Z

Mise à jour

2026-10-13T10:30:05.948962102Z

Pile logicielle: system

Vérifiez votre serveur →