Security Vulnerabilities fixed in Thunderbird 140.13 — Mozilla

The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. We are aware that exploit code for...

TencentOS Server 3: thunderbird (TSSA-2026:0639)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0639 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Vulnerability of the Graphics component: Canvas2D in Mozilla Firefox, Firefox ESR, and the email client Thunderbird, which allows attackers to disclose protected information

The vulnerability of the Canvas2D component in Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to the use of an uninitialized resource. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information remotely...

Vulnerability of the Audio/Video component: Web codecs in Mozilla Firefox, Firefox ESR, and the email client Thunderbird, allowing attackers to execute arbitrary code.

The vulnerability of the Audio/Video component: Mozilla Firefox, Firefox ESR, and the email client Thunderbird’s web codecs are vulnerable due to initialization errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Oracle Linux 10 : thunderbird (ELSA-2026-30846)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-30846 advisory. 140.12.0-1.0.1 - Add Oracle prefs 140.12.0-1 - Update to 140.12.0 ESR 140.11.0-1 - Update to 140.11.0 ESR 140.10.1-1 - Update to 140.10.1 ESR Tenable...

The vulnerability in the WebRTC component of Mozilla Firefox, Firefox ESR, and the Thunderbird email client allows a hacker to induce a service failure.

The vulnerability of the WebRTC component in Mozilla Firefox, Firefox ESR, and the email client Thunderbird lies in the possibility of using memory after it is freed. Exploiting this vulnerability could allow a malicious actor to cause service interruptions remotely...

Amazon Linux 2023 : firefox (ALAS2023-2026-1928)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1928 advisory. Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12...

thunderbird security update

140.12.0-1.0.1 - Add Oracle prefs 140.12.0-1 - Update to 140.12.0 ESR 140.11.0-1 - Update to 140.11.0 ESR 140.10.1-1 - Update to 140.10.1 ESR...

The vulnerability of the JavaScript Engine component in Mozilla Firefox, Firefox ESR, and the email client Thunderbird allows a hacker to execute arbitrary code.

The vulnerability of the JavaScript Engine component in Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Vulnerability of the DOM component: Core and HTML browsers such as Mozilla Firefox, Firefox ESR, and the email client Thunderbird, allowing attackers to induce a service failure.

The vulnerability of the DOM component: The Core and HTML browsers of Mozilla Firefox, Firefox ESR, and the email client Thunderbird are vulnerable because they allow memory to be used after it is released. Exploiting this vulnerability could enable a malicious actor to cause service interruption...

RHSA-2026:39706 Red Hat Security Advisory: thunderbird security update

Bulletin has no description...

RHSA-2026:39428 Red Hat Security Advisory: thunderbird security update

Bulletin has no description...

RHSA-2026:39142 Red Hat Security Advisory: thunderbird security update

Bulletin has no description...

firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Networking component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the Networking component...

firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bug fixed in Thunderbird ESR 140.12...

firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bug fixed in Thunderbird ESR 140.12...

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bug fixed in Thunderbird ESR 140.12...

firefox: thunderbird: Mitigation bypass in the DOM: Security component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: Security component...

firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bug fixed in Thunderbird ESR 140.12...