Opened 3 weeks ago

Closed 3 weeks ago

#24151 closed enhancement (fixed)

thunderbird-153.5.1esr

Reported by: Joe Locash Owned by: SecurityAdvisory
Priority: high Milestone: 98-Security
Component: BOOK Version: git
Severity: high Keywords:
Cc:

Description

What’s Fixed:

  • Failed account setup left incoming servers that blocked subsequent setup attempts

Security fixes:

  • CVE-2026-113866: Account password sent unencrypted during Exchange account setup (high)
  • CVE-2026-113867: Stanza injection in XMPP chat (high)
  • CVE-2026-113868: Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication (high)
  • CVE-2026-113470: Cryptographic issue in the Security Block-lists, Allow-lists, and other State component (high)

​https://www.mozilla.org/en-US/security/advisories/mfsa2026-115/

Change History (2)

comment:1 by Joe Locash, 3 weeks ago

Milestone: 13.2 → 98-Security
Owner: changed from Joe Locash to SecurityAdvisory
Status: assigned → new

Fixed at 32a33498ae. Leaving open for SA.

comment:2 by Bruce Dubbs, 3 weeks ago

Resolution: → fixed
Status: new → closed

Advisory sa-13.1-069 has been issued.

Note: See TracTickets for help on using tickets.