id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
20587	thunderbird-128.4.0esr	Joe Locash	Douglas R. Reno	"**What's New**
  - Export Thunderbird account settings to Thunderbird Mobile via QRCode

**What's Fixed**
  - Unable to send an unencrypted response to an OpenPGP encrypted message
  - Thunderbird update did not update language pack version until another restart

**Security Fixes**
 - CVE-2024-10458: Permission leak via embed or object elements (high)
 - CVE-2024-10459: Use-after-free in layout with accessibility (high)
 - CVE-2024-10460: Confusing display of origin for external protocol handler prompt (moderate)
 - CVE-2024-10461: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response (moderate)
 - CVE-2024-10462: Origin of permission prompt could be spoofed by long URL (moderate)
 - CVE-2024-10463: Cross origin video frame leak (moderate)
 - CVE-2024-10464: History interface could have been used to cause a Denial of Service condition in the browser (low)
 - CVE-2024-10465: Clipboard ""paste"" button persisted across tabs (low)
 - CVE-2024-10466: DOM push subscription message could hang Firefox (low)
 - CVE-2024-10467: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4 (moderate)"	enhancement	closed	elevated	12.3	BOOK	git	high	fixed