thunderbird-153.5.1esr

[Joe Locash]

What’s Fixed:

• Failed account setup left incoming servers that blocked subsequent setup attempts

Security fixes:

• CVE-2026-113866: Account password sent unencrypted during Exchange account setup (high)
• CVE-2026-113867: Stanza injection in XMPP chat (high)
• CVE-2026-113868: Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication (high)
• CVE-2026-113470: Cryptographic issue in the Security Block-lists, Allow-lists, and other State component (high)

​https://www.mozilla.org/en-US/security/advisories/mfsa2026-115/