Astra Linux – Vulnerability in Firefox and Thunderbird

When resolving a symbolic link such as file:///proc/self/fd/1, an error message may be generated if the symbolic link resolves to a string containing uninitialized memory in the buffer. This bug only affects Thunderbird on Unix-based operating systems Android, Linux, MacOS. Windows is unaffected...

Astra Linux – Vulnerability in Firefox

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, and Expat

A issue was discovered in libexpat before version 2.6.4. There is a crash within the XMLResumeParser function, as XMLStopParser can stop/suspend a parser that has not been started...

Astra Linux – Vulnerability in Thunderbird, Firefox

A poorly handled security check during the creation of a WebSocket in a WebWorker caused the Content Security Policy’s connect-src header to be ignored. This could lead to connections being made to restricted origins from within WebWorkers. This vulnerability affects Firefox 109, Firefox ESR 102....

Astra Linux – Vulnerability in Firefox and Thunderbird

Cross-compartment wrappers used to wrap a scripted proxy might have caused objects from other compartments to be stored in the main compartment, resulting in a “use-after-free” vulnerability. This vulnerability affects Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13...

Astra Linux – Vulnerability in Firefox and Thunderbird

Race condition in the Graphics component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird 140.5...

Astra Linux – Vulnerability in Firefox and Thunderbird

An attacker could have placed a datalist element to obscure the address bar. This vulnerability affects Firefox 113, Firefox ESR 102.11, and Thunderbird 102.11...

Astra Linux – Vulnerability in Firefox

A memory safety bug has been fixed in Firefox 152. This vulnerability was addressed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12...

Astra Linux – Vulnerability in Thunderbird

Thunderbird ignored the configuration that required STARTTLS security for SMTP connections. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication...

Astra Linux – Vulnerability in Firefox and Thunderbird

When a user clicks on an FTP URL containing encoded newline characters %0A and %0D, these newline characters are interpreted as such, allowing arbitrary commands to be sent to the FTP server. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...

CVE-2024-4367-PoC

CVE-2024-4367 & CVE-2024-34342: Arbitrary JavaScript execution in PDF.js A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. If pdf.js is...

CVE-2024-4367-Analysis

CVE-2024-4367: Arbitrary JavaScript Execution in PDF.js Overview CVE-2024-4367 is a critical vulnerability in the PDF.js library that allows arbitrary JavaScript execution in a user's browser, leading to Cross-Site Scripting XSS attacks. This affects Firefox Example: python3 poc.py "alert1" Demo...

MiracleLinux 8 : thunderbird-140.14.0-1.el8_10.ML.1 (AXSA:2026-1814:20)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1814:20 advisory. firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component CVE-2026-74934 firefox: thunderbird: Privilege escalation in the...

Updated thunderbird packages fix security vulnerabilities

Uninitialized memory in MIME parsing. CVE-2026-84639 One byte overflow read in mail parser. CVE-2026-84640 Information disclosure due to malicious IMAP server response. CVE-2026-84641 Calendar invitation attachments could launch local executables. CVE-2026-84637 Allowed UNC hostnames for...

MGASA-2026-0388 Updated thunderbird packages fix security vulnerabilities

Uninitialized memory in MIME parsing. CVE-2026-84639 One byte overflow read in mail parser. CVE-2026-84640 Information disclosure due to malicious IMAP server response. CVE-2026-84641 Calendar invitation attachments could launch local executables. CVE-2026-84637 Allowed UNC hostnames for...

RLSA-2026:65159 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component CVE-2026-74934 firefox: thunderbird: Privilege escalation in the Networking: Cookies component CVE-2026-74953 firefox: thunderbird:...

thunderbird security update

An update is available for thunderbird. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Thunderbird is a standalone mail and newsgroup client. Security...

thunderbird security update

An update is available for thunderbird. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Thunderbird is a standalone mail and newsgroup client. Security...

firefox: thunderbird: Privilege escalation in the DOM: Navigation component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Navigation component...

firefox: thunderbird: Site isolation issue in the WebExtensions component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the WebExtensions component...