This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 140.9 (MFSA 2026-24, bsc#1260083):
- CVE-2026-3889: Spoofing issue in Thunderbird
- CVE-2026-4371: Out of bounds read in IMAP parsing
- CVE-2026-4684: Race condition, use-after-free in the Graphics: WebRender component
- CVE-2026-4685: Incorrect boundary conditions in the Graphics: Canvas2D component
- CVE-2026-4686: Incorrect boundary conditions in the Graphics: Canvas2D component
- CVE-2026-4687: Sandbox escape due to incorrect boundary conditions in the Telemetry component
- CVE-2026-4688: Sandbox escape due to use-after-free in the Disability Ac
This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird 140.8 MFSA 2026-17 (bsc#1258568):
- CVE-2026-2757: Incorrect boundary conditions in the WebRTC: Audio/Video
component
- CVE-2026-2758: Use-after-free in the JavaScript: GC component
- CVE-2026-2759: Incorrect boundary conditions in the Graphics: ImageLib
component
- CVE-2026-2760: Sandbox escape due to incorrect boundary conditions in the
Graphics: WebRender component
- CVE-2026-2761: Sandbox escape in the Graphics: WebRender component
- CVE-2026-2762: Integer overflow in the JavaScript: Standard Library component
- CVE-2026-2763: Use-after-free in the
This update for MozillaThunderbird fixes the following issues:
- Update to Thunderbird 140.7.2
- CVE-2026-2447: Fixed a heap buffer overflow in libvpx. (bsc#1258231)
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 140.7.1 MFSA 2026-08 (bsc#1257397):
- CVE-2026-0818: CSS-based exfiltration of the content from partially encrypted emails when allowing remote content
This update for MozillaThunderbird fixes the following issues:
MFSA 2026-05 (bsc#1256340):
- CVE-2026-0877: Mitigation bypass in the DOM in Security component
- CVE-2026-0878: Sandbox escape due to incorrect boundary conditions in the
Graphics in CanvasWebGL component
- CVE-2026-0879: Sandbox escape due to incorrect boundary conditions in the
Graphics component
- CVE-2026-0880: Sandbox escape due to integer overflow in the Graphics
component
- CVE-2026-0882: Use-after-free in the IPC component
- CVE-2025-14327: Spoofing issue in the Downloads Panel component
- CVE-2026-0883: Information disclosure in the Networking
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 140.6 (bsc#1254551).
- MFSA 2025-96
* CVE-2025-14321: use-after-free in the WebRTC: Signaling component.
* CVE-2025-14322: sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
* CVE-2025-14323: privilege escalation in the DOM: Notifications component.
* CVE-2025-14324: JIT miscompilation in the JavaScript Engine: JIT component.
* CVE-2025-14325: JIT miscompilation in the JavaScript Engine: JIT component.
* CVE-2025-14328: privilege escalation in the Netmonitor component.
* CVE-2025-14329: priv
This update for MozillaThunderbird fixes the following issues:
- Update Mozilla Thunderbird to version 140.5 (bsc#1253188)
- CVE-2025-13012: Race condition in the Graphics component.
- CVE-2025-13016: Incorrect boundary conditions in the JavaScript: WebAssembly component.
- CVE-2025-13017: Same-origin policy bypass in the DOM: Notifications component.
- CVE-2025-13018: Mitigation bypass in the DOM: Security component.
- CVE-2025-13019: Same-origin policy bypass in the DOM: Workers component.
- CVE-2025-13013: Mitigation bypass in the DOM: Core & HTML component.
- CVE-2025-13020: Use-after-free in the WebRTC: Audio/Video component.
- CVE-2025
This update for MozillaThunderbird fixes the following issue:
Mozilla Thunderbird is updated to 140.4.
* changed: Account Hub is now disabled by default for second
email account (bmo#1992027)
* changed: Flatpak runtime has been updated to Freedesktop SDK
24.08 (bmo#1952100)
* fixed: Users could not read mail signed with OpenPGP v6 and
PQC keys (bmo#1986845)
* fixed: Image preview in Insert Image dialog failed with CSP
error for web resources (bmo#1989392)
* fixed: Emptying trash on exit did not work with some
providers (bmo#1975147)
* fixed: Thunderbird could crash when applying filters
(bmo#1987880)
* fixed: Users
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 140.3 (bsc#1249391).
Security issues fixed:
- MFSA 2025-78
* CVE-2025-10527: sandbox escape due to use-after-free in the Graphics: Canvas2D component.
* CVE-2025-10528: sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component.
* CVE-2025-10529: same-origin policy bypass in the Layout component.
* CVE-2025-10532: incorrect boundary conditions in the JavaScript: GC component.
* CVE-2025-10533: integer overflow in the SVG component.
* CVE-2025-10536: information disclosure in the Networking: Cache compo
This update for MozillaThunderbird fixes the following issues:
Updated to Mozilla Thunderbird 140.2 MFSA 2025-72 (bsc#1248162):
* CVE-2025-9179: Sandbox escape due to invalid pointer in the Audio/Video: GMP
component
* CVE-2025-9180: Same-origin policy bypass in the Graphics: Canvas2D component
* CVE-2025-9181: Uninitialized memory in the JavaScript Engine component
* CVE-2025-9182: Denial-of-service due to out-of-memory in the Graphics:
WebRender component
* CVE-2025-9184: Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
ESR 140.2, Firefox 142 and Thunderbird 142
* CVE-2025-9185: Memory safety bugs fixed in
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 140.1 (MFSA 2025-63) (bsc#1246664):
- CVE-2025-8027: JavaScript engine only wrote partial return value to stack (bmo#1968423)
- CVE-2025-8028: Large branch table could lead to truncated instruction (bmo#1971581)
- CVE-2025-8029: javascript: URLs executed on object and embed tags (bmo#1928021)
- CVE-2025-8036: DNS rebinding circumvents CORS (bmo#1960834)
- CVE-2025-8037: Nameless cookies shadow secure cookies (bmo#1964767)
- CVE-2025-8030: Potential user-assisted code execution in 'Copy as cURL' command (bmo#1968414)
- CVE-2025-8031: Incorrect URL st
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 128.12 (MFSA 2025-55, bsc#1244670):
- CVE-2025-6424: Use-after-free in FontFaceSet (bmo#1966423)
- CVE-2025-6425: The WebCompat WebExtension shipped exposed a persistent UUID (bmo#1717672)
- CVE-2025-6426: No warning when opening executable terminal files on macOS (bmo#1964385)
- CVE-2025-6429: Incorrect parsing of URLs could have allowed embedding of youtube.com (bmo#1970658)
- CVE-2025-6430: Content-Disposition header ignored when a file is included in an embed or object tag (bmo#1971140)
This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird 128.11.1
- CVE-2025-5986: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (MFSA 2025-49) (bsc#1244468).
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 128.11 (MFSA 2025-46, bsc#1243353):
- CVE-2025-5262: Double-free in libvpx encoder (bmo#1962421)
- CVE-2025-5263: Error handling for script execution was incorrectly isolated from web content (bmo#1960745)
- CVE-2025-5264: Potential local code execution in 'Copy as cURL' command (bmo#1950001)
- CVE-2025-5265: Potential local code execution in 'Copy as cURL' command (bmo#1962301)
- CVE-2025-5266: Script element events leaked cross-origin resource status (bmo#1965628)
- CVE-2025-5267: Clickjacking vulnerability could have led to leaking saved payment
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 128.10.2 (MFSA 2025-40, bsc#1243303):
Security fixes:
- CVE-2025-4918: Out-of-bounds access when resolving Promise objects (bmo#1966612)
- CVE-2025-4919: Out-of-bounds access when optimizing linear sums (bmo#1966614)
Other fixes:
- Messages could not be viewed if the profile used a UNC path (bmo#1966256)
- Visual and UX improvements (bmo#1964156)
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 128.10.1.
Security fixes:
- MFSA 2025-34 (bsc#1243216)
* CVE-2025-3875: Sender Spoofing via Malformed From Header in Thunderbird.
* CVE-2025-3877: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links.
* CVE-2025-3909: JavaScript Execution via Spoofed PDF Attachment and file:/// Link.
* CVE-2025-3932: Tracking Links in Attachments Bypassed Remote Content Blocking.
Other bug fixes:
- Fixed: standalone message windows/tabs that no longer responded after folder compaction.
- Fixed: Thunderbird could c
This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird ESR 128.10 update (bsc#1241621):
- CVE-2025-4082: WebGL shader attribute memory corruption in Thunderbird for macOS.
- CVE-2025-4087: Unsafe attribute access during XPath parsing.
- CVE-2025-4093: Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird.
- CVE-2025-4091: Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10.
- CVE-2025-4083: Process isolation bypass using 'javascript:' URI links in cross-origin frames.
- CVE-2025-4084: Potential local code execution in 'copy as cURL' command.
- CVE-2025-2817
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 128.9.2 (bsc#1241277)
- CVE-2025-3522: Leak of hashed Window credentials via crafted attachment URL
- CVE-2025-2830: Information Disclosure of /tmp directory listing
- CVE-2025-3523: User Interface (UI) Misrepresentation of attachment URL
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird ESR 128.9 MFSA 2025-24 (bsc#1240083)
* CVE-2025-3028: Use-after-free triggered by XSLTProcessor
* CVE-2025-3029: URL Bar Spoofing via non-BMP Unicode characters
* CVE-2025-3030: Memory safety bugs fixed in Firefox 137, Thunderbird 137,
Firefox ESR 128.9, and Thunderbird 128.9
Other fixes:
* new: Thunderbird now has a notification system for real-time
desktop alerts
* fixed: Data corruption occurred when compacting IMAP Drafts
folder after saving a message
* fixed: Right-clicking 'Decrypt and Save As...' on an
attachment file
This update for MozillaThunderbird fixes the following issues:
Updated to Mozilla Thunderbird 128.8 MFSA 2025-18 (bsc#1237683):
- CVE-2024-43097: Overflow when growing an SkRegion's RunArray
- CVE-2025-1930: AudioIPC StreamData could trigger a use-after-free in the
Browser process
- CVE-2025-1931: Use-after-free in WebTransportChild
- CVE-2025-1932: Inconsistent comparator in XSLT sorting led to out-of-bounds
access
- CVE-2025-1933: JIT corruption of WASM i32 return values on 64-bit CPUs
- CVE-2025-1934: Unexpected GC during RegExp bailout processing
- CVE-2025-1935: Clickjacking the registerProtocolHandler info-