thunderbird-140.5.0esr

[zeckma]

New minor version. Assuming most security fixes will be in this release as in firefox-140.5.0esr.

[zeckma]

Changes

---

Normal changes

• Fixed: Could not drag and drop ICS file to Today Pane
• Fixed: With Thunderbird closed, clicking a mailto: link to send signed message failed
• Fixed: Upgrade from 128.x->140.x broke authentication for @att.net using Yahoo backend

---

Security Fixes

• Rating: High
• Total: 9; High: 2; Moderate: 6; Low: 1

• CVE-2025-13012 (High): Race condition in the Graphics component
• CVE-2025-13016 (High): Incorrect boundary conditions in the JavaScript: WebAssembly component
• CVE-2025-13017 (Moderate): Same-origin policy bypass in the DOM: Notifications component
• CVE-2025-13018 (Moderate): Mitigation bypass in the DOM: Security component
• CVE-2025-13019 (Moderate): Same-origin policy bypass in the DOM: Workers component
• CVE-2025-13013 (Moderate): Mitigation bypass in the DOM: Core & HTML component
• CVE-2025-13020 (Moderate): Use-after-free in the WebRTC: Audio/Video component
• CVE-2025-13014 (Moderate): Use-after-free in the Audio/Video component
• CVE-2025-13015 (Low): Spoofing issue in Thunderbird

[zeckma]

Fixed at 80225d677452d59f31755d466771334ddc28d6dd. Leaving open for SA issuing, I'll handle it.

[zeckma]

SA-12.4-044 filed.

[Bruce Dubbs]

Milestone renamed