CVE-2026-118175
CVE-2026-118175 · Content of other messages could be included when replying to a crafted message
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
EPSS 0.2%
- Published
- Updated
Stack: system
Affected products and versions
thunderbird
- Versions
- ≥ 153.6, ≤ 153.*: Not affected (rpm)
- ≥ 159: Not affected (rpm)
No fix published
thunderbird Debian:12
- Versions
- 1:102.11.0-1
- 1:102.12.0-1
- 1:102.12.0-1~deb10u1
- 1:102.12.0-1~deb11u1
- 1:102.12.0-1~deb12u1
- 1:102.13.0-1
- 1:102.13.0-1~deb10u1
- 1:102.13.0-1~deb11u1
- 1:102.13.0-1~deb12u1
- 1:102.13.1-1
- 1:102.13.1-1~deb10u1
- 1:102.13.1-1~deb11u1
- 1:102.13.1-1~deb12u1
- 1:102.14.0-1~deb10u1
- 1:102.14.0-1~deb11u1
- 1:102.14.0-1~deb12u1
- 1:102.15.0-1~deb10u1
- 1:102.15.0-1~deb11u1
- 1:102.15.0-1~deb12u1
- 1:102.15.1-1~deb10u1
- 1:102.15.1-1~deb11u1
- 1:102.15.1-1~deb12u1
- 1:103.0~b5-1
- 1:104.0~b2-1
- 1:110.0~b4-1
- 1:112.0~b1-1
- 1:113.0~b3-1
- 1:114.0~b2-1
- 1:115.0-1
- 1:115.0.1-1
- 1:115.0.1-2
- 1:115.0~b4-1
- 1:115.0~b6-1
- 1:115.1.0-1
- 1:115.1.1-1
- 1:115.10.1-1
- 1:115.10.1-1~deb10u1
- 1:115.10.1-1~deb11u1
- 1:115.10.1-1~deb12u1
- 1:115.11.0-1
- 1:115.11.0-1~deb10u1
- 1:115.11.0-1~deb11u1
- 1:115.11.0-1~deb12u1
- 1:115.12.0-1
- 1:115.12.0-1~deb10u1
- 1:115.12.0-1~deb11u1
- 1:115.12.0-1~deb12u1
- 1:115.13.0-1
- 1:115.13.0-1~deb11u1
- 1:115.13.0-1~deb12u1
- 1:115.14.0-1~deb11u1
- 1:115.14.0-1~deb12u1
- 1:115.15.0-1~deb11u1
- 1:115.15.0-1~deb12u1
- 1:115.16.0esr-1~deb11u1
- 1:115.16.0esr-1~deb12u1
- 1:115.2.0-1
- 1:115.2.2-1
- 1:115.3.0-1
- 1:115.3.0-1~deb12u1
- 1:115.3.1-1
- 1:115.3.1-1~deb10u1
- 1:115.3.1-1~deb11u1
- 1:115.3.1-1~deb12u1
- 1:115.4.1-1
- 1:115.4.1-1~deb10u1
- 1:115.4.1-1~deb11u1
- 1:115.4.1-1~deb12u1
- 1:115.5.0-1
- 1:115.5.0-1~deb10u1
- 1:115.5.0-1~deb11u1
- 1:115.5.0-1~deb12u1
- 1:115.5.1-1
- 1:115.5.2-1
- 1:115.6.0-1
- 1:115.6.0-1~deb10u1
- 1:115.6.0-1~deb11u1
- 1:115.6.0-1~deb12u1
- 1:115.7.0-1
- 1:115.7.0-1~deb10u1
- 1:115.7.0-1~deb11u1
- 1:115.7.0-1~deb12u1
- 1:115.8.0-1
- 1:115.8.0-1~deb10u1
- 1:115.8.0-1~deb11u1
- 1:115.8.0-1~deb12u1
- 1:115.8.1-1
- 1:115.9.0-1
- 1:115.9.0-1~deb10u1
- 1:115.9.0-1~deb11u1
- 1:115.9.0-1~deb12u1
- 1:116.0~b7-1
- 1:117.0~b5-1
- 1:120.0~b1-1
- 1:121.0~b3-1
- 1:122.0~b2-1
- 1:124.0~b5-1
- 1:125.0~b3-1
- 1:127.0~b5-1
- 1:128.0esr-1
- 1:128.0~b5-1
- 1:128.1.0esr-1
- 1:128.1.1esr-1
- 1:128.10.0esr-1
- 1:128.10.0esr-1~deb11u1
- 1:128.10.0esr-1~deb12u1
- 1:128.10.1esr-1
- 1:128.10.1esr-1~deb11u1
- 1:128.10.1esr-1~deb12u1
- 1:128.11.0esr-1
- 1:128.11.0esr-1~deb11u1
- 1:128.11.0esr-1~deb12u1
- 1:128.12.0esr-1
- 1:128.12.0esr-1~deb11u1
- 1:128.12.0esr-1~deb12u1
- 1:128.13.0esr-1
- 1:128.13.0esr-1~deb11u1
- 1:128.13.0esr-1~deb12u1
- 1:128.14.0esr-1
- 1:128.14.0esr-1~deb11u1
- 1:128.14.0esr-1~deb12u1
- 1:128.14.0esr-1~deb13u1
- 1:128.2.0esr-1
- 1:128.2.1esr-1
- 1:128.2.3esr-1
- 1:128.3.0esr-1
- 1:128.3.2esr-1
- 1:128.4.0esr-1
- 1:128.4.0esr-1~deb11u1
- 1:128.4.0esr-1~deb12u1
- 1:128.4.2esr-1
- 1:128.4.3esr-1
- 1:128.4.3esr-1~deb11u1
- 1:128.4.3esr-1~deb12u1
- 1:128.5.0esr-1
- 1:128.5.0esr-1~deb11u1
- 1:128.5.0esr-1~deb12u1
- 1:128.5.2esr-1
- 1:128.6.0esr-1
- 1:128.6.0esr-1~deb11u1
- 1:128.6.0esr-1~deb12u1
- 1:128.7.0esr-1
- 1:128.7.0esr-1~deb11u1
- 1:128.7.0esr-1~deb12u1
- 1:128.8.0esr-1
- 1:128.8.0esr-1~deb11u1
- 1:128.8.0esr-1~deb12u1
- 1:128.9.0esr-1
- 1:128.9.0esr-1~deb11u1
- 1:128.9.0esr-1~deb12u1
- 1:129.0~b6-1
- 1:130.0~b3-1
- 1:132.0~b6-1
- 1:135.0-1
- 1:136.0-1
- 1:137.0-1
- 1:138.0-1
- 1:140.0.1esr-1
- 1:140.1.0esr-1
- 1:140.1.1esr-1
- 1:140.10.0esr-1
- 1:140.10.0esr-1~deb11u1
- 1:140.10.0esr-1~deb12u1
- 1:140.10.0esr-1~deb13u1
- 1:140.10.1esr-1
- 1:140.10.1esr-1~deb11u1
- 1:140.10.1esr-1~deb12u1
- 1:140.10.1esr-1~deb13u1
- 1:140.10.2esr-1
- 1:140.10.2esr-1~deb11u1
- 1:140.10.2esr-1~deb12u1
- 1:140.10.2esr-1~deb13u1
- 1:140.11.0esr-1
- 1:140.11.0esr-1~deb11u1
- 1:140.11.0esr-1~deb12u1
- 1:140.11.0esr-1~deb13u1
- 1:140.12.0esr-1
- 1:140.12.0esr-1~deb11u1
- 1:140.12.0esr-1~deb12u1
- 1:140.12.0esr-1~deb13u1
- 1:140.13.0esr-1
- 1:140.13.0esr-2
- 1:140.13.0esr-2~deb11u1
- 1:140.13.0esr-2~deb12u1
- 1:140.13.0esr-2~deb13u1
- 1:140.14.0esr-1
- 1:140.14.0esr-1~deb11u1
- 1:140.14.0esr-1~deb12u1
- 1:140.14.0esr-1~deb13u1
- 1:140.15.0esr-1~deb12u1
- 1:140.15.0esr-1~deb13u1
- 1:140.16.0esr-1~deb12u1
- 1:140.16.0esr-1~deb13u1
- 1:140.17.0esr-1~deb12u1
- 1:140.17.0esr-1~deb13u1
- 1:140.2.0esr-1
- 1:140.3.0esr-1
- 1:140.3.0esr-1~deb11u1
- 1:140.3.0esr-1~deb12u1
- 1:140.3.0esr-1~deb13u1
- 1:140.3.1esr-1
- 1:140.4.0esr-1
- 1:140.4.0esr-1~deb11u1
- 1:140.4.0esr-1~deb12u1
- 1:140.4.0esr-1~deb13u1
- 1:140.5.0esr-1
- 1:140.5.0esr-1~deb11u1
- 1:140.5.0esr-1~deb12u1
- 1:140.5.0esr-1~deb13u1
No fix published
thunderbird Debian:13
- Versions
- 1:128.13.0esr-1
- 1:128.14.0esr-1
- 1:128.14.0esr-1~deb11u1
- 1:128.14.0esr-1~deb12u1
- 1:128.14.0esr-1~deb13u1
- 1:129.0~b6-1
- 1:130.0~b3-1
- 1:132.0~b6-1
- 1:135.0-1
- 1:136.0-1
- 1:137.0-1
- 1:138.0-1
- 1:140.0.1esr-1
- 1:140.1.0esr-1
- 1:140.1.1esr-1
- 1:140.10.0esr-1
- 1:140.10.0esr-1~deb11u1
- 1:140.10.0esr-1~deb12u1
- 1:140.10.0esr-1~deb13u1
- 1:140.10.1esr-1
- 1:140.10.1esr-1~deb11u1
- 1:140.10.1esr-1~deb12u1
- 1:140.10.1esr-1~deb13u1
- 1:140.10.2esr-1
- 1:140.10.2esr-1~deb11u1
- 1:140.10.2esr-1~deb12u1
- 1:140.10.2esr-1~deb13u1
- 1:140.11.0esr-1
- 1:140.11.0esr-1~deb11u1
- 1:140.11.0esr-1~deb12u1
- 1:140.11.0esr-1~deb13u1
- 1:140.12.0esr-1
- 1:140.12.0esr-1~deb11u1
- 1:140.12.0esr-1~deb12u1
- 1:140.12.0esr-1~deb13u1
- 1:140.13.0esr-1
- 1:140.13.0esr-2
- 1:140.13.0esr-2~deb11u1
- 1:140.13.0esr-2~deb12u1
- 1:140.13.0esr-2~deb13u1
- 1:140.14.0esr-1
- 1:140.14.0esr-1~deb11u1
- 1:140.14.0esr-1~deb12u1
- 1:140.14.0esr-1~deb13u1
- 1:140.15.0esr-1~deb12u1
- 1:140.15.0esr-1~deb13u1
- 1:140.16.0esr-1~deb12u1
- 1:140.16.0esr-1~deb13u1
- 1:140.17.0esr-1~deb12u1
- 1:140.17.0esr-1~deb13u1
- 1:140.2.0esr-1
- 1:140.3.0esr-1
- 1:140.3.0esr-1~deb11u1
- 1:140.3.0esr-1~deb12u1
- 1:140.3.0esr-1~deb13u1
- 1:140.3.1esr-1
- 1:140.4.0esr-1
- 1:140.4.0esr-1~deb11u1
- 1:140.4.0esr-1~deb12u1
- 1:140.4.0esr-1~deb13u1
- 1:140.5.0esr-1
- 1:140.5.0esr-1~deb11u1
- 1:140.5.0esr-1~deb12u1
- 1:140.5.0esr-1~deb13u1
- 1:140.6.0esr-1
- 1:140.6.0esr-1~deb11u1
- 1:140.6.0esr-1~deb12u1
- 1:140.6.0esr-1~deb13u1
- 1:140.7.0esr-1
- 1:140.7.0esr-1~deb11u1
- 1:140.7.0esr-1~deb12u1
- 1:140.7.0esr-1~deb13u1
- 1:140.7.1esr-1
- 1:140.7.1esr-1~deb11u1
- 1:140.7.1esr-1~deb12u1
- 1:140.7.1esr-1~deb13u1
- 1:140.8.0esr-1
- 1:140.8.0esr-1~deb11u1
- 1:140.8.0esr-1~deb12u1
- 1:140.8.0esr-1~deb13u1
- 1:140.9.0esr-1
- 1:140.9.0esr-1~deb11u1
- 1:140.9.0esr-1~deb12u1
- 1:140.9.0esr-1~deb13u1
- 1:140.9.1esr-1
- 1:140.9.1esr-1~deb11u1
- 1:140.9.1esr-1~deb12u1
- 1:140.9.1esr-1~deb13u1
- 1:143.0.1-1
- 1:144.0.1-1
- 1:148.0.1-1
- 1:149.0.2-1
- 1:152.0-1
- 1:153.0.1esr-1
- 1:153.0.3esr-1
- 1:153.1.0esr-1
- 1:153.2.0esr-1
- 1:153.3.0esr-1
- 1:153.3.0esr-2
- 1:153.4.0esr-1
- 1:153.5.0esr-1
- 1:153.5.1esr-1
- 1:153.5.1esr-1~deb12u1
- 1:153.5.1esr-1~deb13u1
- 1:153.5.1esr-1~deb13u2
- 1:153.6.0esr-1
- 1:155.0.1-1
- 1:155.0.1-2
- 1:157.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
thunderbird Debian:14
- Versions
- 1:128.13.0esr-1
- 1:128.14.0esr-1
- 1:128.14.0esr-1~deb11u1
- 1:128.14.0esr-1~deb12u1
- 1:128.14.0esr-1~deb13u1
- 1:129.0~b6-1
- 1:130.0~b3-1
- 1:132.0~b6-1
- 1:135.0-1
- 1:136.0-1
- 1:137.0-1
- 1:138.0-1
- 1:140.0.1esr-1
- 1:140.1.0esr-1
- 1:140.1.1esr-1
- 1:140.10.0esr-1
- 1:140.10.0esr-1~deb11u1
- 1:140.10.0esr-1~deb12u1
- 1:140.10.0esr-1~deb13u1
- 1:140.10.1esr-1
- 1:140.10.1esr-1~deb11u1
- 1:140.10.1esr-1~deb12u1
- 1:140.10.1esr-1~deb13u1
- 1:140.10.2esr-1
- 1:140.10.2esr-1~deb11u1
- 1:140.10.2esr-1~deb12u1
- 1:140.10.2esr-1~deb13u1
- 1:140.11.0esr-1
- 1:140.11.0esr-1~deb11u1
- 1:140.11.0esr-1~deb12u1
- 1:140.11.0esr-1~deb13u1
- 1:140.12.0esr-1
- 1:140.12.0esr-1~deb11u1
- 1:140.12.0esr-1~deb12u1
- 1:140.12.0esr-1~deb13u1
- 1:140.13.0esr-1
- 1:140.13.0esr-2
- 1:140.13.0esr-2~deb11u1
- 1:140.13.0esr-2~deb12u1
- 1:140.13.0esr-2~deb13u1
- 1:140.14.0esr-1
- 1:140.14.0esr-1~deb11u1
- 1:140.14.0esr-1~deb12u1
- 1:140.14.0esr-1~deb13u1
- 1:140.15.0esr-1~deb12u1
- 1:140.15.0esr-1~deb13u1
- 1:140.16.0esr-1~deb12u1
- 1:140.16.0esr-1~deb13u1
- 1:140.17.0esr-1~deb12u1
- 1:140.17.0esr-1~deb13u1
- 1:140.2.0esr-1
- 1:140.3.0esr-1
- 1:140.3.0esr-1~deb11u1
- 1:140.3.0esr-1~deb12u1
- 1:140.3.0esr-1~deb13u1
- 1:140.3.1esr-1
- 1:140.4.0esr-1
- 1:140.4.0esr-1~deb11u1
- 1:140.4.0esr-1~deb12u1
- 1:140.4.0esr-1~deb13u1
- 1:140.5.0esr-1
- 1:140.5.0esr-1~deb11u1
- 1:140.5.0esr-1~deb12u1
- 1:140.5.0esr-1~deb13u1
- 1:140.6.0esr-1
- 1:140.6.0esr-1~deb11u1
- 1:140.6.0esr-1~deb12u1
- 1:140.6.0esr-1~deb13u1
- 1:140.7.0esr-1
- 1:140.7.0esr-1~deb11u1
- 1:140.7.0esr-1~deb12u1
- 1:140.7.0esr-1~deb13u1
- 1:140.7.1esr-1
- 1:140.7.1esr-1~deb11u1
- 1:140.7.1esr-1~deb12u1
- 1:140.7.1esr-1~deb13u1
- 1:140.8.0esr-1
- 1:140.8.0esr-1~deb11u1
- 1:140.8.0esr-1~deb12u1
- 1:140.8.0esr-1~deb13u1
- 1:140.9.0esr-1
- 1:140.9.0esr-1~deb11u1
- 1:140.9.0esr-1~deb12u1
- 1:140.9.0esr-1~deb13u1
- 1:140.9.1esr-1
- 1:140.9.1esr-1~deb11u1
- 1:140.9.1esr-1~deb12u1
- 1:140.9.1esr-1~deb13u1
- 1:143.0.1-1
- 1:144.0.1-1
- 1:148.0.1-1
- 1:149.0.2-1
- 1:152.0-1
- 1:153.0.1esr-1
- 1:153.0.3esr-1
- 1:153.1.0esr-1
- 1:153.2.0esr-1
- 1:153.3.0esr-1
- 1:153.3.0esr-2
- 1:153.4.0esr-1
- 1:153.5.0esr-1
- 1:153.5.1esr-1
- 1:153.5.1esr-1~deb12u1
- 1:153.5.1esr-1~deb13u1
- 1:153.5.1esr-1~deb13u2
- 1:153.6.0esr-1
- 1:155.0.1-1
- 1:155.0.1-2
- 1:157.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mozjs52 Ubuntu:18.04:LTS
- Versions
- 52.3.1-0ubuntu3
- 52.3.1-7fakesync1
- 52.8.1-0ubuntu0.18.04.1
- 52.9.1-0ubuntu0.18.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mozjs38 Ubuntu:18.04:LTS
- Versions
- 38.8.0~repack1-0ubuntu1
- 38.8.0~repack1-0ubuntu3
- 38.8.0~repack1-0ubuntu4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mozjs68 Ubuntu:20.04:LTS
- Versions
- 68.5.0-1~fakesync
- 68.5.0-2~fakesync
- 68.6.0-1
- 68.6.0-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mozjs52 Ubuntu:20.04:LTS
- Versions
- 52.9.1-1build1
- 52.9.1-1ubuntu3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mozjs102 Ubuntu:22.04:LTS
- Versions
- 102.11.0-0ubuntu0.22.04.1
- 102.12.0-0ubuntu0.22.04.1
- 102.13.0-0ubuntu0.22.04.1
- 102.15.1-0ubuntu0.22.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mozjs78 Ubuntu:22.04:LTS
- Versions
- 78.13.0-1
- 78.15.0-2
- 78.15.0-4ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mozjs91 Ubuntu:22.04:LTS
- Versions
- 91.5.1-0ubuntu1
- 91.6.0-1
- 91.6.0-2
- 91.7.0-2
- 91.10.0-0ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
thunderbird Ubuntu:22.04:LTS
- Versions
- 1:91.1.2+build1-0ubuntu1
- 1:91.3.0+build2-0ubuntu1
- 1:91.3.1+build1-0ubuntu1
- 1:91.3.2+build1-0ubuntu1
- 1:91.4.0+build1.1-0ubuntu1
- 1:91.4.0+build2-0ubuntu1
- 1:91.5.0+build1-0ubuntu1
- 1:91.5.1+build1-0ubuntu1
- 1:91.6.1+build1-0ubuntu1
- 1:91.7.0+build1-0ubuntu1
- 1:91.7.0+build2-0ubuntu1
- 1:91.8.0+build2-0ubuntu1
- 1:91.9.1+build1-0ubuntu0.22.04.1
- 1:91.11.0+build2-0ubuntu0.22.04.1
- 1:102.2.2+build1-0ubuntu0.22.04.1
- 1:102.4.2+build2-0ubuntu0.22.04.1
- 1:102.7.1+build2-0ubuntu0.22.04.1
- 1:102.8.0+build2-0ubuntu0.22.04.1
- 1:102.9.0+build1-0ubuntu0.22.04.1
- 1:102.10.0+build2-0ubuntu0.22.04.1
- 1:102.11.0+build1-0ubuntu0.22.04.1
- 1:102.13.0+build1-0ubuntu0.22.04.1
- 1:102.15.0+build1-0ubuntu0.22.04.1
- 1:102.15.1+build1-0ubuntu0.22.04.1
- 1:115.3.1+build1-0ubuntu0.22.04.2
- 1:115.4.1+build1-0ubuntu0.22.04.1
- 1:115.5.0+build1-0ubuntu0.22.04.1
- 1:115.6.0+build2-0ubuntu0.22.04.1
- 1:115.8.1+build1-0ubuntu0.22.04.1
- 1:115.9.0+build1-0ubuntu0.22.04.1
- 1:115.10.1+build1-0ubuntu0.22.04.1
- 1:115.11.0+build2-0ubuntu0.22.04.1
- 1:115.12.0+build3-0ubuntu0.22.04.1
- 1:115.13.0+build5-0ubuntu0.22.04.1
- 1:115.15.0+build1-0ubuntu0.22.04.1
- 1:115.16.0+build2-0ubuntu0.22.04.1
- 1:115.18.0+build1-0ubuntu0.22.04.1
- 1:128.12.0+build1-0ubuntu0.22.04.1
- 1:140.7.1+build1-0ubuntu0.22.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mozjs102 Ubuntu:24.04:LTS
- Versions
- 102.15.1-1
- 102.15.1-3ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mozjs115 Ubuntu:24.04:LTS
- Versions
- 115.3.0-0ubuntu1
- 115.4.0-2
- 115.5.0-1
- 115.6.0-1
- 115.7.0-4
- 115.8.0-1
- 115.9.0-1
- 115.9.0-1build1
- 115.10.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published