{"kind": "product", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp5/mozillathunderbird", "name": "mozillathunderbird", "product": "mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP5", "items": [{"id": "SUSE-SU-2024:4326-1", "noindex": false, "published": "2024-12-16T13:11:14Z", "modified": "2026-02-04T03:03:59.139925Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2024:4326-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\n- CVE-2024-50336: Fixed insufficient MXC URI validation which could allow client-side path traversal (bsc#1234413)\n\nOther fixes:\n- Updated to Mozilla Thunderbird 128.5.2i (bsc#1234413): \n  * fixed: Large virtual folders could be very slow \n  * fixed: Message could disappear after moving from IMAP folder\n    followed by Undo and Redo \n  * fixed: XMPP chat did not display messages sent inside a CDATA\n    element \n  * fixed: Selected calendar day did not move forward at midnight \n  * fixed: Today pane agenda sometimes scrolled for no apparent\n    reason\n  * fixed: CalDAV calendars w", "references": ["https://www.suse.com/support/update/announcement/2024/suse-su-20244326-1/", "https://bugzilla.suse.com/1234413", "https://www.suse.com/security/cve/CVE-2024-50336"], "fixes": ["128.5.2-150200.8.194.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp5/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP5"}]}, {"id": "SUSE-SU-2024:4148-1", "noindex": false, "published": "2024-12-03T09:10:17Z", "modified": "2026-02-04T04:10:59.069561Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2024:4148-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\n- Mozilla Thunderbird 128.5\n  * fixed: IMAP could crash when reading cached messages\n  * fixed: Enabling 'Show Folder Size' on Maildir profile could\n    render Thunderbird unusable\n  * fixed: Messages corrupted by folder compaction were only\n    fixed by user intervention\n  * fixed: Reading a message from past the end of an mbox file\n    did not cause an error\n  * fixed: View -> Folders had duplicate F access keys\n  * fixed: Add-ons adding columns to the message list could fail\n    and cause display issue\n  * fixed: 'Empty trash on exit' and 'Expunge inbox on exit' did\n    not al", "references": ["https://www.suse.com/support/update/announcement/2024/suse-su-20244148-1/", "https://bugzilla.suse.com/1233650", "https://bugzilla.suse.com/1233695"], "fixes": ["128.5.0-150200.8.191.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp5/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP5"}]}, {"id": "SUSE-SU-2024:4050-1", "noindex": false, "published": "2024-11-25T15:37:44Z", "modified": "2026-02-04T02:32:08.826147Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2024:4050-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\n- Mozilla Thunderbird 128.4.3\n  * fixed: Folder corruption could cause Thunderbird to freeze\n    and become unusable\n  * fixed: Message corruption could be propagated when reading mbox\n  * fixed: Folder compaction was not abandoned on shutdown\n  * fixed: Folder compaction did not clean up on failure\n  * fixed: Collapsed NNTP thread incorrectly indicated there were\n    unread messages\n  * fixed: Navigating to next unread message did not wait for all\n    messages to be loaded\n  * fixed: Applying column view to folder and children could\n    break if folder error occurred\n  * fixed: ", "references": ["https://www.suse.com/support/update/announcement/2024/suse-su-20244050-1/", "https://bugzilla.suse.com/1231879", "https://bugzilla.suse.com/1233355"], "fixes": ["128.4.3-150200.8.188.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp5/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP5"}]}, {"id": "SUSE-SU-2024:3731-1", "noindex": false, "published": "2024-10-18T14:29:47Z", "modified": "2026-02-04T04:09:17.136563Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2024:3731-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\nUpdate to Mozilla Thunderbird 128.3.1 (MFSA 2024-52, bsc#1231413):\n\n  - CVE-2024-9680: Fixed use-after-free in Animation timeline (bmo#1923344)\n", "references": ["https://www.suse.com/support/update/announcement/2024/suse-su-20243731-1/", "https://bugzilla.suse.com/1231413", "https://www.suse.com/security/cve/CVE-2024-9680"], "fixes": ["128.3.1-150200.8.185.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp5/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP5"}]}, {"id": "SUSE-SU-2024:3629-1", "noindex": false, "published": "2024-10-15T06:57:38Z", "modified": "2026-02-04T03:23:36.718075Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2024:3629-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\nUpdate to Mozilla Thunderbird 128.3.1 (MFSA 2024-51, bsc#1231413):\n\n- CVE-2024-9680: Use-after-free in Animation timeline   \n    \nUpdate to Mozilla Thunderbird 128.3 (MFSA 2024-49, bsc#1230979):\n\n- CVE-2024-9392: Compromised content process can bypass site isolation\n- CVE-2024-9393: Cross-origin access to PDF contents through multipart responses\n- CVE-2024-9394: Cross-origin access to JSON contents through multipart responses\n- CVE-2024-8900: Clipboard write permission bypass\n- CVE-2024-9396: Potential memory corruption may occur when cloning certain objects\n- CVE-2024-9397: Pote", "references": ["https://www.suse.com/support/update/announcement/2024/suse-su-20243629-1/", "https://bugzilla.suse.com/1230979", "https://bugzilla.suse.com/1231413"], "fixes": ["128.3.0-150200.8.182.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp5/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP5"}]}, {"id": "SUSE-SU-2024:3507-1", "noindex": false, "published": "2024-10-01T15:02:17Z", "modified": "2026-02-04T02:34:04.416686Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2024:3507-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\n- Mozilla Thunderbird 128.2.3\n  MFSA 2024-43 (bsc#1229821)\n  * CVE-2024-8394: Crash when aborting verification of OTR chat.\n  * CVE-2024-8385: WASM type confusion involving ArrayTypes.\n  * CVE-2024-8381: Type confusion when looking up a property name in a 'with' block.\n  * CVE-2024-8382: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks\n    ran.\n  * CVE-2024-8384: Garbage collection could mis-color cross-compartment objects in OOM conditions.\n  * CVE-2024-8386: SelectElements could be shown over another site if popups are allowed.\n", "references": ["https://www.suse.com/support/update/announcement/2024/suse-su-20243507-1/", "https://bugzilla.suse.com/1184272", "https://bugzilla.suse.com/1226316"], "fixes": ["128.2.3-150200.8.177.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp5/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP5"}]}, {"id": "SUSE-SU-2024:3112-1", "noindex": false, "published": "2024-09-03T15:03:52Z", "modified": "2025-05-02T04:37:23.755772Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2024:3112-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\n- Mozilla Thunderbird 115.14\n  * fixed: When using an external installation of GnuPG,\n    Thunderbird occassionally sent/received corrupted messages\n  * fixed: Users of external GnuPG were unable to decrypt\n    incorrectly encoded messages (bmo#1906903)\n  * fixed: Flatpak install of 128.0esr was incorrectly downgraded\n    to 115.13.0esr (bmo#1908299)\n  * fixed: Security fixes\n  MFSA 2024-38 (bsc#1228648)\n  * CVE-2024-7519: Out of bounds memory access in graphics shared memory handling\n  * CVE-2024-7521: Incomplete WebAssembly exception handing\n  * CVE-2024-7522: Out of bounds rea", "references": ["https://www.suse.com/support/update/announcement/2024/suse-su-20243112-1/", "https://bugzilla.suse.com/1228648", "https://www.suse.com/security/cve/CVE-2024-7519"], "fixes": ["115.14.0-150200.8.174.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp5/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP5"}]}, {"id": "SUSE-SU-2024:2790-1", "noindex": false, "published": "2024-08-06T14:18:49Z", "modified": "2026-02-04T02:14:45.268520Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2024:2790-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\nUpdate to Mozilla Thunderbird 115.13 (MFSA 2024-31, bsc#1226316):\n\nSecurity fixes:\n\n- CVE-2024-6600: Memory corruption in WebGL API (bmo#1888340)\n- CVE-2024-6601: Race condition in permission assignment (bmo#1890748)\n- CVE-2024-6602: Memory corruption in NSS (bmo#1895032)\n- CVE-2024-6603: Memory corruption in thread creation (bmo#1895081)\n- CVE-2024-6604: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, Thunderbird 128, and Thunderbird 115.13 (bmo#1748105, bmo#1837550, bmo#1884266)\n\nOther fixes:\n\n- fixed: After starting Thunderbird, the message list position  was some", "references": ["https://www.suse.com/support/update/announcement/2024/suse-su-20242790-1/", "https://bugzilla.suse.com/1226316", "https://www.suse.com/security/cve/CVE-2024-6600"], "fixes": ["115.13.0-150200.8.171.4"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp5/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP5"}]}, {"id": "SUSE-SU-2024:2415-1", "noindex": false, "published": "2024-07-12T08:28:29Z", "modified": "2026-02-04T02:43:21.556265Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2024:2415-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2024-34703: Fixed denial of service due to overly large elliptic curve parameters in Botan (bsc#1227239)\n    \nOther fixes:    \n    \n- Mozilla Thunderbird 115.12.1\n  * 115.12.0 got pulled because of upstream automation process errors\n    and Windows installer signing changes.\n    No code changes, changelog is the same as 115.12.0 (bsc#1226495)\n", "references": ["https://www.suse.com/support/update/announcement/2024/suse-su-20242415-1/", "https://bugzilla.suse.com/1226495", "https://bugzilla.suse.com/1227239"], "fixes": ["115.12.2-150200.8.168.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp5/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP5"}]}, {"id": "SUSE-SU-2024:2073-1", "noindex": false, "published": "2024-06-18T15:47:16Z", "modified": "2026-02-04T04:33:50.713603Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2024:2073-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\n- Update to version 115.12.0 ESR (bsc#1226027)\n- CVE-2024-5702: Use-after-free in networking\n- CVE-2024-5688: Use-after-free in JavaScript object transplant\n- CVE-2024-5690: External protocol handlers leaked by timing attack\n- CVE-2024-5691: Sandboxed iframes were able to bypass sandbox restrictions to open a new window\n- CVE-2024-5692: Bypass of file name restrictions during saving\n- CVE-2024-5693: Cross-Origin Image leak via Offscreen Canvas\n- CVE-2024-5696: Memory Corruption in Text Fragments\n- CVE-2024-5700: Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12, and Thu", "references": ["https://www.suse.com/support/update/announcement/2024/suse-su-20242073-1/", "https://bugzilla.suse.com/1226027", "https://www.suse.com/security/cve/CVE-2024-5688"], "fixes": ["115.12.0-150200.8.163.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp5/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP5"}]}, {"id": "SUSE-SU-2024:1858-1", "noindex": false, "published": "2024-05-30T12:13:47Z", "modified": "2026-02-04T03:32:27.851531Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2024:1858-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\nUpdate to version 115.11 (bsc#1224056):\n\n- CVE-2024-4367: Arbitrary JavaScript execution in PDF.js\n- CVE-2024-4767: IndexedDB files retained in private browsing mode\n- CVE-2024-4768: Potential permissions request bypass via clickjacking\n- CVE-2024-4769: Cross-origin responses could be distinguished between script and non-script content-types\n- CVE-2024-4770: Use-after-free could occur when printing to PDF\n- CVE-2024-4777: Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11\n- fixed: Splitter arrow between task list and task description did not behav", "references": ["https://www.suse.com/support/update/announcement/2024/suse-su-20241858-1/", "https://bugzilla.suse.com/1224056", "https://www.suse.com/security/cve/CVE-2024-4367"], "fixes": ["115.11.0-150200.8.160.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp5/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP5"}]}, {"id": "SUSE-SU-2024:1437-1", "noindex": false, "published": "2024-04-25T17:26:00Z", "modified": "2026-02-04T02:38:36.465891Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2024:1437-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\nUpdate to Mozilla Thunderbird 115.10.1\n\nSecurity fixes (MFSA 2024-20) (bsc#1222535):\n\n- CVE-2024-3852: GetBoundName in the JIT returned the wrong object (bmo#1883542) \n- CVE-2024-3854: Out-of-bounds-read after mis-optimized switch statement (bmo#1884552) \n- CVE-2024-3857: Incorrect JITting of arguments led to use-after-free during garbage collection (bmo#1886683) \n- CVE-2024-2609: Permission prompt input delay could expire when not in focus (bmo#1866100) \n- CVE-2024-3859: Integer-overflow led to out-of-bounds-read in the OpenType sanitizer (bmo#1874489) \n- CVE-2024-3861: Potentia", "references": ["https://www.suse.com/support/update/announcement/2024/suse-su-20241437-1/", "https://bugzilla.suse.com/1222535", "https://www.suse.com/security/cve/CVE-2024-2609"], "fixes": ["115.10.1-150200.8.157.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp5/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP5"}]}, {"id": "SUSE-SU-2024:1147-1", "noindex": false, "published": "2024-04-08T09:35:13Z", "modified": "2026-02-04T02:15:06.720192Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2024:1147-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\n- Mozilla Thunderbird 115.9 (bsc#1221327)\n- CVE-2024-0743: Crash in NSS TLS method\n- CVE-2024-2605: Windows Error Reporter could be used as a Sandbox escape vector\n- CVE-2024-2607: JIT code failed to save return registers on Armv7-A\n- CVE-2024-2608: Integer overflow could have led to out of bounds write\n- CVE-2024-2616: Improve handling of out-of-memory conditions in ICU\n- CVE-2023-5388: NSS susceptible to timing attack against RSA decryption\n- CVE-2024-2610: Improper handling of html and body tags enabled CSP nonce leakage\n- CVE-2024-2611: Clickjacking vulnerability could have l", "references": ["https://www.suse.com/support/update/announcement/2024/suse-su-20241147-1/", "https://bugzilla.suse.com/1221327", "https://www.suse.com/security/cve/CVE-2023-5388"], "fixes": ["115.9.0-150200.8.154.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp5/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP5"}]}, {"id": "SUSE-SU-2024:0893-1", "noindex": false, "published": "2024-03-14T13:25:57Z", "modified": "2026-02-04T02:47:51.602475Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2024:0893-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\nSecurity Vulnerabilities fixed in Thunderbird 115.8.1 (bsc#1221054):\n\n- CVE-2024-1936: Fixed leaking of encrypted email subjects to other conversations (MFSA 2024-11) (bsc#1221054). \n", "references": ["https://www.suse.com/support/update/announcement/2024/suse-su-20240893-1/", "https://bugzilla.suse.com/1221054", "https://www.suse.com/security/cve/CVE-2024-1936"], "fixes": ["115.8.1-150200.8.151.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp5/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP5"}]}, {"id": "SUSE-SU-2024:0608-1", "noindex": false, "published": "2024-02-23T19:01:43Z", "modified": "2026-02-04T04:00:16.816724Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2024:0608-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\nMozilla Thunderbird 115.8 (bsc#1220048):\n\n- CVE-2024-1546: Out-of-bounds memory read in networking channels\n- CVE-2024-1547: Alert dialog could have been spoofed on another site\n- CVE-2024-1548: Fullscreen Notification could have been hidden by select element\n- CVE-2024-1549: Custom cursor could obscure the permission dialog\n- CVE-2024-1550: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants\n- CVE-2024-1551: Multipart HTTP Responses would accept the Set-Cookie header in response parts\n- CVE-2024-1552: Incorrect code generation on 32-bit ARM dev", "references": ["https://www.suse.com/support/update/announcement/2024/suse-su-20240608-1/", "https://bugzilla.suse.com/1220048", "https://www.suse.com/security/cve/CVE-2024-1546"], "fixes": ["115.8.0-150200.8.148.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp5/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP5"}]}, {"id": "SUSE-SU-2024:0242-1", "noindex": false, "published": "2024-01-26T10:33:31Z", "modified": "2026-02-04T02:26:25.005467Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2024:0242-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\nUpdate to Mozilla Thunderbird 115.7 (MFSA 2024-04) (bsc#1218955):\n\n  - CVE-2024-0741: Out of bounds write in ANGLE\n  - CVE-2024-0742: Failure to update user input timestamp\n  - CVE-2024-0746: Crash when listing printers on Linux\n  - CVE-2024-0747: Bypass of Content Security Policy when directive unsafe-inline was set\n  - CVE-2024-0749: Phishing site popup could show local origin in address bar\n  - CVE-2024-0750: Potential permissions request bypass via clickjacking\n  - CVE-2024-0751: Privilege escalation through devtools\n  - CVE-2024-0753: HSTS policy on subdomain could bypass po", "references": ["https://www.suse.com/support/update/announcement/2024/suse-su-20240242-1/", "https://bugzilla.suse.com/1218955", "https://www.suse.com/security/cve/CVE-2024-0741"], "fixes": ["115.7.0-150200.8.145.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp5/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP5"}]}, {"id": "SUSE-SU-2024:0044-1", "noindex": false, "published": "2024-01-07T12:09:57Z", "modified": "2026-02-04T02:41:45.597148Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2024:0044-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\nFirefox Extended Support Release 115.6.0 ESR (bsc#1217974):\n\t* CVE-2023-6856: Heap-buffer-overflow affecting WebGL  DrawElementsInstanced method with Mesa VM driver (bmo#1843782).\n\t* CVE-2023-6857: Symlinks may resolve to smaller than expected buffers (bmo#1796023).\n\t* CVE-2023-6858: Heap buffer overflow in nsTextFragment (bmo#1826791).\n\t* CVE-2023-6859: Use-after-free in PR_GetIdentitiesLayer (bmo#1840144).\n\t* CVE-2023-6860: Potential sandbox escape due to VideoBridge lack of texture validation (bmo#1854669).\n\t* CVE-2023-6861: Heap buffer overflow affected nsWindow::PickerOpen(v", "references": ["https://www.suse.com/support/update/announcement/2024/suse-su-20240044-1/", "https://bugzilla.suse.com/1217974", "https://www.suse.com/security/cve/CVE-2023-50761"], "fixes": ["115.6.0-150200.8.142.2"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp5/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP5"}]}, {"id": "SUSE-SU-2023:4588-1", "noindex": false, "published": "2023-11-27T13:28:12Z", "modified": "2026-02-04T02:58:29.496085Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2023:4588-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\n- Mozilla Thunderbird 115.5.0 MFSA 2023-52 (bsc#1217230)\n\n  * CVE-2023-6204: Out-of-bound memory access in WebGL2 blitFramebuffer\n  * CVE-2023-6205: Use-after-free in MessagePort::Entangled\n  * CVE-2023-6206: Clickjacking permission prompts using the fullscreen transition\n  * CVE-2023-6207: Use-after-free in ReadableByteStreamQueueEntry::Buffer\n  * CVE-2023-6208: Using Selection API would copy contents into X11 primary selection.\n  * CVE-2023-6209: Incorrect parsing of relative URLs starting with '///'\n  * CVE-2023-6212: Memory safety bugs\n", "references": ["https://www.suse.com/support/update/announcement/2023/suse-su-20234588-1/", "https://bugzilla.suse.com/1217230", "https://www.suse.com/security/cve/CVE-2023-6204"], "fixes": ["115.5.0-150200.8.139.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp5/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP5"}]}, {"id": "SUSE-SU-2023:4302-1", "noindex": false, "published": "2023-10-31T09:33:57Z", "modified": "2025-05-02T04:36:01.726262Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2023:4302-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\n- Updated to version 115.4.1:\n\n  - CVE-2023-5721: Fixed a potential clickjack via queued up\n    rendering.\n  - CVE-2023-5732: Fixed an address bar spoofing via bidirectional\n    characters\n  - CVE-2023-5724: Fixed a crash due to a large WebGL draw.\n  - CVE-2023-5725: Fixed an issue where WebExtensions could open\n    arbitrary URLs.\n  - CVE-2023-5726: Fixed an issue where fullscreen notifications would\n    be obscured by file the open dialog on macOS.\n  - CVE-2023-5727: Fixed a download protection bypass on on Windows.\n  - CVE-2023-5728: Fixed a crash caused by improper object tra", "references": ["https://www.suse.com/support/update/announcement/2023/suse-su-20234302-1/", "https://bugzilla.suse.com/1216338", "https://www.suse.com/security/cve/CVE-2023-5721"], "fixes": ["115.4.1-150200.8.136.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp5/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP5"}]}, {"id": "SUSE-SU-2023:4016-1", "noindex": false, "published": "2023-10-09T17:22:59Z", "modified": "2026-02-04T04:38:49.222612Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2023:4016-1", "title": "Security update for MozillaThunderbird", "description": "This update for MozillaThunderbird fixes the following issues:\n\nSecurity fixes:\n- CVE-2023-5217: Fixed a heap buffer overflow in libvpx. (bsc#1215814)\n- CVE-2023-5168: Out-of-bounds write in FilterNodeD2D1. (bsc#1215575)\n- CVE-2023-5169: Out-of-bounds write in PathOps. (bsc#1215575)\n- CVE-2023-5171: Use-after-free in Ion Compiler. (bsc#1215575)\n- CVE-2023-5174: Double-free in process spawning on Windows. (bsc#1215575)\n- CVE-2023-5176: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. (bsc#1215575)\n\nOther fixes:\n\n- Mozilla Thunderbird 115.3.1\n  * fixed: In Unified Folders view, some folders had incorrect\n    un", "references": ["https://www.suse.com/support/update/announcement/2023/suse-su-20234016-1/", "https://bugzilla.suse.com/1210168", "https://bugzilla.suse.com/1215309"], "fixes": ["115.3.1-150200.8.133.1"], "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp5/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP5"}]}], "total": 24, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "mozillathunderbird", "path": "vulns/suse-linux-enterprise-workstation-extension-15-sp5/mozillathunderbird", "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP5"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-02-04T04:38:49.222612Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}