rpm package

almalinux/thunderbird

pkg:rpm/almalinux/thunderbird

Vulnerabilities (678)

CVE	Sev	CVSS	Affected versions	Fixed in	Published	Description
CVE-2026-92240	Cri	9.1	< 140.16.0-1.el9_8.alma.1	140.16.0-1.el9_8.alma.1	Sep 15, 2026	A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunde
CVE-2026-92239	Hig	8.1	< 140.16.0-1.el9_8.alma.1	140.16.0-1.el9_8.alma.1	Sep 15, 2026	A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92238	Cri	9.8	< 140.16.0-1.el9_8.alma.1	140.16.0-1.el9_8.alma.1	Sep 15, 2026	A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92032	Cri	9.6	< 140.16.0-1.el9_8.alma.1	140.16.0-1.el9_8.alma.1	Sep 15, 2026	Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92031	Med	6.5	< 140.16.0-1.el9_8.alma.1	140.16.0-1.el9_8.alma.1	Sep 15, 2026	Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92030	Med	5.4	< 140.16.0-1.el9_8.alma.1	140.16.0-1.el9_8.alma.1	Sep 15, 2026	Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92029	Hig	8.8	< 140.16.0-1.el9_8.alma.1	140.16.0-1.el9_8.alma.1	Sep 15, 2026	Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92028	Hig	8.8	< 140.16.0-1.el9_8.alma.1	140.16.0-1.el9_8.alma.1	Sep 15, 2026	Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92027	Hig	8.8	< 140.16.0-1.el9_8.alma.1	140.16.0-1.el9_8.alma.1	Sep 15, 2026	Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92026	Hig	8.8	< 140.16.0-1.el9_8.alma.1	140.16.0-1.el9_8.alma.1	Sep 15, 2026	Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92025	Hig	8.8	< 140.16.0-1.el9_8.alma.1	140.16.0-1.el9_8.alma.1	Sep 15, 2026	Use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92024	Hig	8.8	< 140.16.0-1.el9_8.alma.1	140.16.0-1.el9_8.alma.1	Sep 15, 2026	Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92023	Hig	8.8	< 140.16.0-1.el9_8.alma.1	140.16.0-1.el9_8.alma.1	Sep 15, 2026	Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92022	Hig	8.8	< 140.16.0-1.el9_8.alma.1	140.16.0-1.el9_8.alma.1	Sep 15, 2026	Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92021	Hig	8.8	< 140.16.0-1.el9_8.alma.1	140.16.0-1.el9_8.alma.1	Sep 15, 2026	Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16.
CVE-2026-92020	Hig	8.8	< 140.16.0-1.el9_8.alma.1	140.16.0-1.el9_8.alma.1	Sep 15, 2026	Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92019	Hig	8.1	< 140.16.0-1.el9_8.alma.1	140.16.0-1.el9_8.alma.1	Sep 15, 2026	Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92018	Cri	9.6	< 140.16.0-1.el9_8.alma.1	140.16.0-1.el9_8.alma.1	Sep 15, 2026	Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92017	Hig	8.8	< 140.16.0-1.el9_8.alma.1	140.16.0-1.el9_8.alma.1	Sep 15, 2026	Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92016	Hig	8.8	< 140.16.0-1.el9_8.alma.1	140.16.0-1.el9_8.alma.1	Sep 15, 2026	Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

CVE-2026-92240CriSep 15, 2026
affected < 140.16.0-1.el9_8.alma.1fixed 140.16.0-1.el9_8.alma.1
A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunde
CVE-2026-92239HigSep 15, 2026
affected < 140.16.0-1.el9_8.alma.1fixed 140.16.0-1.el9_8.alma.1
A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92238CriSep 15, 2026
affected < 140.16.0-1.el9_8.alma.1fixed 140.16.0-1.el9_8.alma.1
A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92032CriSep 15, 2026
affected < 140.16.0-1.el9_8.alma.1fixed 140.16.0-1.el9_8.alma.1
Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92031MedSep 15, 2026
affected < 140.16.0-1.el9_8.alma.1fixed 140.16.0-1.el9_8.alma.1
Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92030MedSep 15, 2026
affected < 140.16.0-1.el9_8.alma.1fixed 140.16.0-1.el9_8.alma.1
Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92029HigSep 15, 2026
affected < 140.16.0-1.el9_8.alma.1fixed 140.16.0-1.el9_8.alma.1
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92028HigSep 15, 2026
affected < 140.16.0-1.el9_8.alma.1fixed 140.16.0-1.el9_8.alma.1
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92027HigSep 15, 2026
affected < 140.16.0-1.el9_8.alma.1fixed 140.16.0-1.el9_8.alma.1
Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92026HigSep 15, 2026
affected < 140.16.0-1.el9_8.alma.1fixed 140.16.0-1.el9_8.alma.1
Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92025HigSep 15, 2026
affected < 140.16.0-1.el9_8.alma.1fixed 140.16.0-1.el9_8.alma.1
Use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92024HigSep 15, 2026
affected < 140.16.0-1.el9_8.alma.1fixed 140.16.0-1.el9_8.alma.1
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92023HigSep 15, 2026
affected < 140.16.0-1.el9_8.alma.1fixed 140.16.0-1.el9_8.alma.1
Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92022HigSep 15, 2026
affected < 140.16.0-1.el9_8.alma.1fixed 140.16.0-1.el9_8.alma.1
Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92021HigSep 15, 2026
affected < 140.16.0-1.el9_8.alma.1fixed 140.16.0-1.el9_8.alma.1
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16.
CVE-2026-92020HigSep 15, 2026
affected < 140.16.0-1.el9_8.alma.1fixed 140.16.0-1.el9_8.alma.1
Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92019HigSep 15, 2026
affected < 140.16.0-1.el9_8.alma.1fixed 140.16.0-1.el9_8.alma.1
Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92018CriSep 15, 2026
affected < 140.16.0-1.el9_8.alma.1fixed 140.16.0-1.el9_8.alma.1
Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92017HigSep 15, 2026
affected < 140.16.0-1.el9_8.alma.1fixed 140.16.0-1.el9_8.alma.1
Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92016HigSep 15, 2026
affected < 140.16.0-1.el9_8.alma.1fixed 140.16.0-1.el9_8.alma.1
Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

Page 1 of 34