rpm package

suse/MozillaThunderbird&distro=SUSE Linux Enterprise Workstation Extension 15 SP7

pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP7

Vulnerabilities (134)

CVE	Sev	CVSS	Affected versions	Fixed in	Published	Description
CVE-2025-11709	Cri	9.8	< 140.4.0-150200.8.242.1	140.4.0-150200.8.242.1	Oct 14, 2025	A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.
CVE-2025-11708	Cri	9.8	< 140.4.0-150200.8.242.1	140.4.0-150200.8.242.1	Oct 14, 2025	Use-after-free in MediaTrackGraphImpl::GetInstance(). This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.
CVE-2025-10537	Hig	8.8	< 140.3.0-150200.8.239.1	140.3.0-150200.8.239.1	Sep 16, 2025	Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerabilit
CVE-2025-10536	Med	6.2	< 140.3.0-150200.8.239.1	140.3.0-150200.8.239.1	Sep 16, 2025	Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
CVE-2025-10533	Hig	8.8	< 140.3.0-150200.8.239.1	140.3.0-150200.8.239.1	Sep 16, 2025	Integer overflow in the SVG component. This vulnerability was fixed in Firefox 143, Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
CVE-2025-10532	Med	6.5	< 140.3.0-150200.8.239.1	140.3.0-150200.8.239.1	Sep 16, 2025	Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
CVE-2025-10529	Med	6.5	< 140.3.0-150200.8.239.1	140.3.0-150200.8.239.1	Sep 16, 2025	Same-origin policy bypass in the Layout component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
CVE-2025-10528	Hig	7.3	< 140.3.0-150200.8.239.1	140.3.0-150200.8.239.1	Sep 16, 2025	Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
CVE-2025-10527	Hig	7.1	< 140.3.0-150200.8.239.1	140.3.0-150200.8.239.1	Sep 16, 2025	Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
CVE-2025-9185	Hig	8.1	< 140.2.0-150200.8.236.1	140.2.0-150200.8.236.1	Aug 19, 2025	Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these co
CVE-2025-9184	Hig	8.1	< 140.2.0-150200.8.236.1	140.2.0-150200.8.236.1	Aug 19, 2025	Memory safety bugs present in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerabilit
CVE-2025-9182	Hig	7.5	< 140.2.0-150200.8.236.1	140.2.0-150200.8.236.1	Aug 19, 2025	Denial-of-service due to out-of-memory in the Graphics: WebRender component. This vulnerability was fixed in Firefox 142, Firefox ESR 140.2, Thunderbird 142, and Thunderbird 140.2.
CVE-2025-9181	Med	6.5	< 140.2.0-150200.8.236.1	140.2.0-150200.8.236.1	Aug 19, 2025	Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.
CVE-2025-9180	Hig	8.1	< 140.2.0-150200.8.236.1	140.2.0-150200.8.236.1	Aug 19, 2025	Same-origin policy bypass in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.
CVE-2025-9179	Cri	9.8	< 140.2.0-150200.8.236.1	140.2.0-150200.8.236.1	Aug 19, 2025	An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Fi
CVE-2025-8040	Hig	8.8	< 140.1.0-150200.8.230.1	140.1.0-150200.8.230.1	Jul 22, 2025	Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerabilit
CVE-2025-8039	Hig	8.1	< 140.1.0-150200.8.230.1	140.1.0-150200.8.230.1	Jul 22, 2025	In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
CVE-2025-8038	Cri	9.8	< 140.1.0-150200.8.230.1	140.1.0-150200.8.230.1	Jul 22, 2025	Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
CVE-2025-8037	Cri	9.1	< 140.1.0-150200.8.230.1	140.1.0-150200.8.230.1	Jul 22, 2025	Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the `Secure` attribute. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbi
CVE-2025-8036	Hig	8.1	< 140.1.0-150200.8.230.1	140.1.0-150200.8.230.1	Jul 22, 2025	Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.

CVE-2025-11709CriOct 14, 2025
affected < 140.4.0-150200.8.242.1fixed 140.4.0-150200.8.242.1
A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.
CVE-2025-11708CriOct 14, 2025
affected < 140.4.0-150200.8.242.1fixed 140.4.0-150200.8.242.1
Use-after-free in MediaTrackGraphImpl::GetInstance(). This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.
CVE-2025-10537HigSep 16, 2025
affected < 140.3.0-150200.8.239.1fixed 140.3.0-150200.8.239.1
Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerabilit
CVE-2025-10536MedSep 16, 2025
affected < 140.3.0-150200.8.239.1fixed 140.3.0-150200.8.239.1
Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
CVE-2025-10533HigSep 16, 2025
affected < 140.3.0-150200.8.239.1fixed 140.3.0-150200.8.239.1
Integer overflow in the SVG component. This vulnerability was fixed in Firefox 143, Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
CVE-2025-10532MedSep 16, 2025
affected < 140.3.0-150200.8.239.1fixed 140.3.0-150200.8.239.1
Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
CVE-2025-10529MedSep 16, 2025
affected < 140.3.0-150200.8.239.1fixed 140.3.0-150200.8.239.1
Same-origin policy bypass in the Layout component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
CVE-2025-10528HigSep 16, 2025
affected < 140.3.0-150200.8.239.1fixed 140.3.0-150200.8.239.1
Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
CVE-2025-10527HigSep 16, 2025
affected < 140.3.0-150200.8.239.1fixed 140.3.0-150200.8.239.1
Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
CVE-2025-9185HigAug 19, 2025
affected < 140.2.0-150200.8.236.1fixed 140.2.0-150200.8.236.1
Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these co
CVE-2025-9184HigAug 19, 2025
affected < 140.2.0-150200.8.236.1fixed 140.2.0-150200.8.236.1
Memory safety bugs present in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerabilit
CVE-2025-9182HigAug 19, 2025
affected < 140.2.0-150200.8.236.1fixed 140.2.0-150200.8.236.1
Denial-of-service due to out-of-memory in the Graphics: WebRender component. This vulnerability was fixed in Firefox 142, Firefox ESR 140.2, Thunderbird 142, and Thunderbird 140.2.
CVE-2025-9181MedAug 19, 2025
affected < 140.2.0-150200.8.236.1fixed 140.2.0-150200.8.236.1
Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.
CVE-2025-9180HigAug 19, 2025
affected < 140.2.0-150200.8.236.1fixed 140.2.0-150200.8.236.1
Same-origin policy bypass in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.
CVE-2025-9179CriAug 19, 2025
affected < 140.2.0-150200.8.236.1fixed 140.2.0-150200.8.236.1
An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Fi
CVE-2025-8040HigJul 22, 2025
affected < 140.1.0-150200.8.230.1fixed 140.1.0-150200.8.230.1
Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerabilit
CVE-2025-8039HigJul 22, 2025
affected < 140.1.0-150200.8.230.1fixed 140.1.0-150200.8.230.1
In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
CVE-2025-8038CriJul 22, 2025
affected < 140.1.0-150200.8.230.1fixed 140.1.0-150200.8.230.1
Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
CVE-2025-8037CriJul 22, 2025
affected < 140.1.0-150200.8.230.1fixed 140.1.0-150200.8.230.1
Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the `Secure` attribute. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbi
CVE-2025-8036HigJul 22, 2025
affected < 140.1.0-150200.8.230.1fixed 140.1.0-150200.8.230.1
Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.

Page 5 of 7