Opened 2 hours ago

Last modified 70 minutes ago

#24260 new enhancement

thunderbird-153.7.0esr

Reported by: Joe Locash Owned by: SecurityAdvisory
Priority: high Milestone: 98-Security
Component: BOOK Version: git
Severity: high Keywords:
Cc:

Description

What’s Fixed:

  • Opening a window could cause Thunderbird to crash
  • MP4 attachments could be truncated when forwarding messages
  • Exchange autodiscovery failed when redirected to another email address
  • Legacy IMAP tag changes were not sent to the server and reverted after refresh
  • SMTP Kerberos authentication failed on Linux with STARTTLS

Security fixes:

These are specific to thunderbird:

  • CVE-2026-126132: Attachments could be replaced with local file content when forwarding (high)
  • CVE-2026-126133: Calendar server credentials could be sent to an HTTP proxy (moderate)
  • CVE-2026-126134: Feed subscriptions could leak NTLM credentials on Windows (moderate)
  • CVE-2026-126135: SMTP and POP3 response injection when using STARTTLS (moderate)
  • CVE-2026-126136: OAuth2 access token could be sent over an unencrypted connection with Exchange accounts (moderate)

​https://www.mozilla.org/en-US/security/advisories/mfsa2026-129/

Change History (1)

comment:1 by Joe Locash, 70 minutes ago

Milestone: 13.2 → 98-Security
Owner: changed from Joe Locash to SecurityAdvisory
Status: assigned → new

Fixed at d3592b5599. Leaving open for SA.

Note: See TracTickets for help on using tickets.