Opened 6 months ago

Closed 6 months ago

#23033 closed enhancement (fixed)

thunderbird-140.9.0esr

Reported by: Joe Locash Owned by: zeckma
Priority: high Milestone: 13.1
Component: BOOK Version: git
Severity: medium Keywords:
Cc:

Description

Release notes not available yet.

Change History (7)

comment:1 by Douglas R. Reno, 6 months ago

Priority: normal → high

This has the same CVEs as Firefox (38!). Promoting to High to go alongside Firefox.

comment:2 by zeckma, 6 months ago

Owner: changed from blfs-book to zeckma
Status: new → assigned

comment:3 by Douglas R. Reno, 6 months ago

Status: assigned → new

comment:4 by zeckma, 6 months ago

Status: new → assigned

comment:5 by zeckma, 6 months ago

Fixed at f03980b909d789c7a71896ecc3b230d37b5bf01e. Leaving open for SA.

comment:6 by Douglas R. Reno, 6 months ago

This release has two additional CVEs on top of the others from Firefox.

  • CVE-2026-4684: Race condition, use-after-free in the Graphics: WebRender component (High)
  • CVE-2026-4685: Incorrect boundary conditions in the Graphics: Canvas2D component (High)
  • CVE-2026-4686: Incorrect boundary conditions in the Graphics: Canvas2D component (High)
  • CVE-2026-4687: Sandbox escape due to incorrect boundary conditions in the Telemetry component (High)
  • CVE-2026-4688: Sandbox escape due to use-after-free in the Disability Access APIs component (High)
  • CVE-2026-4689: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (High)
  • CVE-2026-4690: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (High)
  • CVE-2026-4691: Use-after-free in the CSS Parsing and Computation component (High)
  • CVE-2026-4692: Sandbox escape in the Responsive Design Mode component (High)
  • CVE-2026-4693: Incorrect boundary conditions in the Audio/Video: Playback component (High)
  • CVE-2026-4694: Incorrect boundary conditions, integer overflow in the Graphics component (High)
  • CVE-2026-4695: Incorrect boundary conditions in the Audio/Video: Web Codecs component (High)
  • CVE-2026-4696: Use-after-free in the Layout: Text and Fonts component (High)
  • CVE-2026-4697: Incorrect boundary conditions in the Audio/Video: Web Codecs component (High)
  • CVE-2026-4698: JIT miscompilation in the JavaScript Engine: JIT component (High)
  • CVE-2026-4699: Incorrect boundary conditions in the Layout: Text and Fonts component (High)
  • CVE-2026-4700: Mitigation bypass in the Networking: HTTP component (Medium)
  • CVE-2026-4701: Use-after-free in the JavaScript Engine component (Medium)
  • CVE-2026-4702: JIT miscompilation in the JavaScript Engine component (Medium)
  • CVE-2026-4704: Denial-of-service in the WebRTC: Signaling component (Medium)
  • CVE-2026-4705: Undefined behavior in the WebRTC: Signaling component (Medium)
  • CVE-2026-4706: Incorrect boundary conditions in the Graphics: Canvas2D component (Medium)
  • CVE-2026-4707: Incorrect boundary conditions in the Graphics: Canvas2D component (Medium)
  • CVE-2026-4708: Incorrect boundary conditions in the Graphics component (Medium)
  • CVE-2026-4709: Incorrect boundary conditions in the Audio/Video: GMP component (High)
  • CVE-2026-4710: Incorrect boundary conditions in the Audio/Video component (Medium)
  • CVE-2026-4711: Use-after-free in the Widget: Cocoa component (Medium)
  • CVE-2026-4712: Information disclosure in the Widget: Cocoa component (Medium)
  • CVE-2026-4713: Incorrect boundary conditions in the Graphics component (Medium)
  • CVE-2026-4714: Incorrect boundary conditions in the Audio/Video component (Medium)
  • CVE-2026-4715: Uninitialized memory in the Graphics: Canvas2D component (Medium)
  • CVE-2026-4716: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component (Medium)
  • CVE-2026-4717: Privilege escalation in the Netmonitor component (Medium)
  • CVE-2025-59375: Denial-of-service in the XML component (Low)
  • CVE-2026-4718: Undefined behavior in the WebRTC: Signaling component (Low)
  • CVE-2026-4719: Incorrect boundary conditions in the Graphics: Text component (Low)
  • CVE-2026-4720: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (High)
  • CVE-2026-4721: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (High)

Additional CVEs:

  • CVE-2026-3889: Spoofing issue in Thunderbird (Low)
  • CVE-2026-4371: Out of bounds read in IMAP parsing (High). Unlike the others, this has a description: 
A malicious mail server could send malformed strings with negative lengths, causing the 
parser to read memory outside the buffer. If a mail server or connection to a mail 
server were compromised, an attacker could cause the parser to malfunction, potentially 
crashing Thunderbird or leaking sensitive data.

comment:7 by Douglas R. Reno, 6 months ago

Resolution: → fixed
Status: assigned → closed

SA-13.0-029 issued

Note: See TracTickets for help on using tickets.