rpm package

almalinux/thunderbird

pkg:rpm/almalinux/thunderbird

Vulnerabilities (572)

CVE	Sev	CVSS	Affected versions	Fixed in	Published	Description
CVE-2026-8954	Hig	7.5	< 140.11.0-1.el9_8.alma.1	140.11.0-1.el9_8.alma.1	May 19, 2026	Incorrect boundary conditions, integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8953	Cri	9.6	< 140.11.0-1.el9_8.alma.1	140.11.0-1.el9_8.alma.1	May 19, 2026	Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8950	Cri	9.3	< 140.11.0-1.el9_8.alma.1	140.11.0-1.el9_8.alma.1	May 19, 2026	Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8947	Hig	7.3	< 140.11.0-1.el9_8.alma.1	140.11.0-1.el9_8.alma.1	May 19, 2026	Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8946	Hig	7.5	< 140.11.0-1.el9_8.alma.1	140.11.0-1.el9_8.alma.1	May 19, 2026	Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8401	Cri	9.8	< 140.11.0-1.el9_8.alma.1	140.11.0-1.el9_8.alma.1	May 12, 2026	Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
CVE-2026-8391	Med	5.3	< 140.11.0-1.el9_8.alma.1	140.11.0-1.el9_8.alma.1	May 12, 2026	Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
CVE-2026-8388	Med	6.5	< 140.11.0-1.el9_8.alma.1	140.11.0-1.el9_8.alma.1	May 12, 2026	Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
CVE-2026-7323	Hig	7.3	< 140.10.1-1.el10_2.alma.1	140.10.1-1.el10_2.alma.1	Apr 28, 2026	Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 15
CVE-2026-7322	Hig	7.3	< 140.10.1-1.el10_2.alma.1	140.10.1-1.el10_2.alma.1	Apr 28, 2026	Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 15
CVE-2026-7321	Cri	9.6	< 140.10.1-1.el10_2.alma.1	140.10.1-1.el10_2.alma.1	Apr 28, 2026	Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, and Thunderbird 140.10.1.
CVE-2026-7320	Hig	7.5	< 140.10.1-1.el10_2.alma.1	140.10.1-1.el10_2.alma.1	Apr 28, 2026	Information disclosure due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Firefox ESR 115.35.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.
CVE-2026-6786	Hig	7.5	< 140.10.0-1.el10_1.alma.1	140.10.0-1.el10_1.alma.1	Apr 26, 2026	Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerabilit
CVE-2026-6785	Hig	7.5	< 140.10.0-1.el10_1.alma.1	140.10.0-1.el10_1.alma.1	Apr 26, 2026	Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary cod
CVE-2026-6776	Hig	7.8	< 140.10.0-1.el10_1.alma.1	140.10.0-1.el10_1.alma.1	Apr 21, 2026	Incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
CVE-2026-6772	Hig	7.5	< 140.10.0-1.el10_1.alma.1	140.10.0-1.el10_1.alma.1	Apr 21, 2026	Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
CVE-2026-6771	Cri	9.8	< 140.10.0-1.el10_1.alma.1	140.10.0-1.el10_1.alma.1	Apr 21, 2026	Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
CVE-2026-6770	Med	6.5	< 140.10.0-1.el10_1.alma.1	140.10.0-1.el10_1.alma.1	Apr 21, 2026	Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
CVE-2026-6769	Hig	8.8	< 140.10.0-1.el10_1.alma.1	140.10.0-1.el10_1.alma.1	Apr 21, 2026	Privilege escalation in the Debugger component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
CVE-2026-6767	Med	5.3	< 140.10.0-1.el10_1.alma.1	140.10.0-1.el10_1.alma.1	Apr 21, 2026	Other issue in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVE-2026-8954HigMay 19, 2026
affected < 140.11.0-1.el9_8.alma.1fixed 140.11.0-1.el9_8.alma.1
Incorrect boundary conditions, integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8953CriMay 19, 2026
affected < 140.11.0-1.el9_8.alma.1fixed 140.11.0-1.el9_8.alma.1
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8950CriMay 19, 2026
affected < 140.11.0-1.el9_8.alma.1fixed 140.11.0-1.el9_8.alma.1
Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8947HigMay 19, 2026
affected < 140.11.0-1.el9_8.alma.1fixed 140.11.0-1.el9_8.alma.1
Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8946HigMay 19, 2026
affected < 140.11.0-1.el9_8.alma.1fixed 140.11.0-1.el9_8.alma.1
Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8401CriMay 12, 2026
affected < 140.11.0-1.el9_8.alma.1fixed 140.11.0-1.el9_8.alma.1
Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
CVE-2026-8391MedMay 12, 2026
affected < 140.11.0-1.el9_8.alma.1fixed 140.11.0-1.el9_8.alma.1
Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
CVE-2026-8388MedMay 12, 2026
affected < 140.11.0-1.el9_8.alma.1fixed 140.11.0-1.el9_8.alma.1
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
CVE-2026-7323HigApr 28, 2026
affected < 140.10.1-1.el10_2.alma.1fixed 140.10.1-1.el10_2.alma.1
Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 15
CVE-2026-7322HigApr 28, 2026
affected < 140.10.1-1.el10_2.alma.1fixed 140.10.1-1.el10_2.alma.1
Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 15
CVE-2026-7321CriApr 28, 2026
affected < 140.10.1-1.el10_2.alma.1fixed 140.10.1-1.el10_2.alma.1
Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, and Thunderbird 140.10.1.
CVE-2026-7320HigApr 28, 2026
affected < 140.10.1-1.el10_2.alma.1fixed 140.10.1-1.el10_2.alma.1
Information disclosure due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Firefox ESR 115.35.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.
CVE-2026-6786HigApr 26, 2026
affected < 140.10.0-1.el10_1.alma.1fixed 140.10.0-1.el10_1.alma.1
Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerabilit
CVE-2026-6785HigApr 26, 2026
affected < 140.10.0-1.el10_1.alma.1fixed 140.10.0-1.el10_1.alma.1
Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary cod
CVE-2026-6776HigApr 21, 2026
affected < 140.10.0-1.el10_1.alma.1fixed 140.10.0-1.el10_1.alma.1
Incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
CVE-2026-6772HigApr 21, 2026
affected < 140.10.0-1.el10_1.alma.1fixed 140.10.0-1.el10_1.alma.1
Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
CVE-2026-6771CriApr 21, 2026
affected < 140.10.0-1.el10_1.alma.1fixed 140.10.0-1.el10_1.alma.1
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
CVE-2026-6770MedApr 21, 2026
affected < 140.10.0-1.el10_1.alma.1fixed 140.10.0-1.el10_1.alma.1
Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
CVE-2026-6769HigApr 21, 2026
affected < 140.10.0-1.el10_1.alma.1fixed 140.10.0-1.el10_1.alma.1
Privilege escalation in the Debugger component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
CVE-2026-6767MedApr 21, 2026
affected < 140.10.0-1.el10_1.alma.1fixed 140.10.0-1.el10_1.alma.1
Other issue in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Page 3 of 29