Opened 3 weeks ago

Closed 3 weeks ago

#24037 closed enhancement (fixed)

thunderbird-153.4.0esr

Reported by: Joe Locash Owned by: SecurityAdvisory
Priority: elevated Milestone: 98-Security
Component: BOOK Version: git
Severity: high Keywords:
Cc:

Description

What’s Changed

  • RNP command-line utilities are no longer included with Thunderbird
  • Thundermail built-in add-on updated to v2.0.16

What’s Fixed

  • Ctrl+Shift+K could fail to open the Quick Filter UI
  • Nested S/MIME signed parts could fail to render
  • Thunderbird could hang when waiting for IMAP server greeting during account setup
  • Gmail OAuth2 authentication could intermittently fail on Windows
  • AppUpdatePin policy did not prevent Thunderbird from updating beyond pinned version
  • "What's New?" linked to Release channel notes instead of ESR release notes

Security fixes:

Security advisory not published yet

Change History (3)

comment:1 by Joe Locash, 3 weeks ago

Fixed at 8568e06933. Leaving open pending upstream security advisory.

comment:2 by Joe Locash, 3 weeks ago

Milestone: 13.2 → 98-Security
Owner: changed from Joe Locash to SecurityAdvisory
Status: assigned → new

Security fixes:

  • CVE-2026-103500: Heap buffer overflow opening large email (low)
  • CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback component (high)
  • CVE-2026-100757: Use-after-free in the Widget component (high)
  • CVE-2026-100758: Sandbox escape in the DOM: Navigation component (high)
  • CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager component (high)
  • CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing component (high)
  • CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content Processes component (high)
  • CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component (high)
  • CVE-2026-100766: Information disclosure in the Networking: JAR component (high)
  • CVE-2026-100767: Use-after-free in the Networking: Cache component (high)
  • CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component (high)
  • CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content Processes component (high)
  • CVE-2026-100771: Undefined behavior in the DOM: Streams component (high)
  • CVE-2026-100772: Use-after-free in the DOM: Core & HTML component (high)
  • CVE-2026-100773: Use-after-free in the Storage: IndexedDB component (high)
  • CVE-2026-100774: Use-after-free in the DOM: Core & HTML component (high)
  • CVE-2026-100775: Sandbox escape in the Graphics component (high)
  • CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component (high)
  • CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component (high)
  • CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core & HTML component (high)
  • CVE-2026-100779: Use-after-free in the XSLT component (high)
  • CVE-2026-100780: Use-after-free in the DOM: Core & HTML component (high)
  • CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (high)
  • CVE-2026-100782: Privilege escalation due to incorrect boundary conditions in the Graphics component (high)
  • CVE-2026-100783: Uninitialized memory in the Audio/Video component (high)
  • CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component (high)
  • CVE-2026-100785: Use-after-free in the DOM: Core & HTML component (high)
  • CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics component (high)
  • CVE-2026-100787: Sandbox escape in the XUL component (high)
  • CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component (high)
  • CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component (high)
  • CVE-2026-100790: Use-after-free in the XSLT component (high)
  • CVE-2026-100791: Use-after-free in the DOM: Core & HTML component (high)
  • CVE-2026-100832: Use-after-free in the Graphics: Canvas2D component (high)
  • CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly component (high)
  • CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the Internationalization component (moderate)
  • CVE-2026-96869: Information disclosure in the Networking component (moderate)
  • CVE-2026-100797: Privilege escalation due to use-after-free in the Graphics: WebRender component (moderate)
  • CVE-2026-100798: Cryptography misuse in Storage: Quota Manager component (moderate)
  • CVE-2026-100800: Sandbox escape due to use-after-free in the Disability Access APIs component (moderate)
  • CVE-2026-100801: Privilege escalation in the DLL Services component (moderate)
  • CVE-2026-100803: Same-origin policy bypass in the WebExtensions component (moderate)
  • CVE-2026-100806: Uninitialized memory in the Graphics: WebGPU component (moderate)
  • CVE-2026-100807: Privilege escalation in the DOM: Service Workers component (moderate)
  • CVE-2026-100808: Mitigation bypass in the DOM: Service Workers component (moderate)
  • CVE-2026-100809: Same-origin policy bypass in the DevTools component (moderate)
  • CVE-2026-100811: Sandbox escape due to use-after-free in the DOM: Core & HTML component (moderate)
  • CVE-2026-100812: Denial-of-service in the Graphics component (moderate)
  • CVE-2026-100814: Incorrect boundary conditions in the JavaScript Engine: JIT component (moderate)
  • CVE-2026-100815: Use-after-free in the CSS Parsing and Computation component (moderate)
  • CVE-2026-100816: Site isolation issue in the DOM: Networking component (moderate)
  • CVE-2026-100818: Sandbox escape due to use-after-free in the Widget: Gtk component (moderate)
  • CVE-2026-100819: Sandbox escape due to incorrect boundary conditions in the XPCOM component (moderate)
  • CVE-2026-100820: Privilege escalation in the Address Bar component (moderate)
  • CVE-2026-100821: Site isolation issue in the Panning and Zooming component (moderate)
  • CVE-2026-100822: Spoofing issue in the Networking: HTTP component (low)
  • CVE-2026-100824: Privilege escalation in the Places component (low)
  • CVE-2026-100825: Use-after-free in the JavaScript Engine: JIT component (low)
  • CVE-2026-100826: Denial-of-service in the Storage: StorageManager component (low)
  • CVE-2026-100828: Mitigation bypass in the Bookmarks & History component (low)
  • CVE-2026-100829: Mitigation bypass in the DOM: Security component (low)
  • CVE-2026-100830: Mitigation bypass in the DOM: Navigation component (low)
  • CVE-2026-100831: Use-after-free in the DOM: UI Events & Focus Handling component (low)

​https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/

comment:3 by Bruce Dubbs, 3 weeks ago

Resolution: → fixed
Status: new → closed

Advisory sa-13.1-051 has been issued.

Note: See TracTickets for help on using tickets.