CVE-2024-4367-PoC

CVE-2024-4367 & CVE-2024-34342: Arbitrary JavaScript execution in PDF.js A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. If pdf.js is...

CVE-2025-1015

CVE-2025-1015: The Thunderbird Address Book contains unsanitized URI fields that could be exploited by attackers. By creating an address book with malicious links, an attacker may trick another user into importing the compromised address book. If the user clicks on the unsanitized link within...

CVE-2024-4367-Analysis

CVE-2024-4367: Arbitrary JavaScript Execution in PDF.js Overview CVE-2024-4367 is a critical vulnerability in the PDF.js library that allows arbitrary JavaScript execution in a user's browser, leading to Cross-Site Scripting XSS attacks. This affects Firefox Example: python3 poc.py "alert1" Demo...

[SECURITY] [DSA 6585-1] thunderbird security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6585-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 25, 2026 https://www.debian.org/security/faq -...

RLSA-2026:76764 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-92035 firefox: thunderbird: Use-after-free in the Graphics:...

thunderbird security update

An update is available for thunderbird. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Thunderbird is a standalone mail and newsgroup client. Security...

firefox security update

An update is available for firefox. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Firefox is an open-source web browser, designed for standards...

RLSA-2026:80674 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component CVE-2026-100832 firefox: Use-after-free in the Layout: Text and Fonts component CVE-2026-100784 firefox: thunderbird: Privilege escalation in the...

RLSA-2026:76761 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-92035 firefox: thunderbird: Use-after-free in the Graphics:...

RLSA-2026:80694 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component CVE-2026-100832 firefox: Use-after-free in the Layout: Text and Fonts component CVE-2026-100784 firefox: thunderbird: Privilege escalation in the...

thunderbird security update

An update is available for thunderbird. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Thunderbird is a standalone mail and newsgroup client. Security...

firefox security update

An update is available for firefox. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Firefox is an open-source web browser, designed for standards...

RLSA-2026:76850 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-92035 firefox: thunderbird: Use-after-free in the Graphics:...

firefox security update

An update is available for firefox. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Firefox is an open-source web browser, designed for standards...

Rocky Linux 10.2 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2026_76764)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202676764 advisory. firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-92035 firefox: thunderbird: Use-after-free...

Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2026_76850)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202676850 advisory. firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-92035 firefox: thunderbird: Use-after-free in...

Rocky Linux 9 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource / firefox-x11 Multiple Vulnerabilities (crlsa-2026_76761)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202676761 advisory. firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-92035 firefox: thunderbird: Use-after-free in...

Rocky Linux 9 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2026_80694)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202680694 advisory. firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component CVE-2026-100832 firefox: Use-after-free in the Layout: Text and Fonts component...

Rocky Linux 10.2 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2026_80674)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202680674 advisory. firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component CVE-2026-100832 firefox: Use-after-free in the Layout: Text and Fonts componen...

CLSA-2026-1792779937 thunderbird: Fix of 56 CVEs

update to 153.5.0 ESR MFSA 2026-103 for 153.4, MFSA 2026-110 for 153.5 - drop CVE-2026-100779-CVE-2026-100785.patch and CVE-2026-100781.patch, their fixes are part of 153.5.0 - stop packaging rnp-cli and rnpkeys: upstream no longer installs them bug 2068130; librnp.so is still shipped -...