https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-02T11:15:30.389722+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/alsa-2026:70642 ALSA-2026:70642 — Important: thunderbird security update 2026-10-02T11:15:30.567521+00:00

Affected: AlmaLinux:9: thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365) * firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874) * firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121) * firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145) * firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119) * firefox: Use-after-free in the Audio/Video component (CVE-2026-84120) * firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124) * firefox: Use-after-free in the Audio/Video component (CVE-2026-84122) * firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143) * thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639) * thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641) * thunderbird: One byte overflow read in mail parser (CVE-2026-84640) * firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024) * firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019) * firefox: thunderbird: U…

 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1106 certfr-2026-avi-1106 — De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un atta… 2026-10-02T11:15:30.567708+00:00 certfr-2026-avi-1106 https://vulnerability.circl.lu/vuln/fkie_cve-2026-84641 fkie_cve-2026-84641 2026-10-02T11:15:30.567756+00:00

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

 https://vulnerability.circl.lu/vuln/gcve-1988-2026-0385 GCVE-1988-2026-0385 — [Bugtraq] [slackware-security] mozilla-thunderbird (SSA:2026-247-03) 2026-10-02T11:15:30.567807+00:00

Affected: Mozilla SSA:2026-247-03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] mozilla-thunderbird (SSA:2026-247-03) New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: +--------------------------+ patches/packages/mozilla-thunderbird-140.15.0esr-i686-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/thunderbird/140.15.0esr/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2026-87/ https://www.cve.org/CVERecord?id=CVE-2026-84639 https://www.cve.org/CVERecord?id=CVE-2026-84640 https://www.cve.org/CVERecord?id=CVE-2026-84641 https://www.cve.org/CVERecord?id=CVE-2026-75874 https://www.cve.org/CVERecord?id=CVE-2026-16365 https://www.cve.org/CVERecord?id=CVE-2026-84119 https://www.cve.org/CVERecord?id=CVE-2026-84120 https://www.cve.org/CVERecord?id=CVE-2026-84121 https://www.cve.org/CVERecord?id=CVE-2026-84122 https://www.cve.org/CVERecord?id=CVE-2026-84124 https://www.cve.org/CVERecord?id=CVE-2026-16371 https://www.cve.org/CVERecord?id=CVE-2026-84131 https://www.cve.org/CVERecord?id=CVE-2026-84143 https://www.cve.org/CVERecord?id=CVE-2026-84145 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackwar…

 https://vulnerability.circl.lu/vuln/ghsa-f2hg-25f8-vgfj GHSA-f2hg-25f8-vgfj 2026-10-02T11:15:30.567898+00:00

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

 https://vulnerability.circl.lu/vuln/oesa-2026-3842 OESA-2026-3842 — thunderbird security update 2026-10-02T11:15:30.567928+00:00

Affected: openEuler:24.03-LTS-SP4: thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es):

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84119)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84120)

Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84121)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84122)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84124)

Privilege escalation due to invalid pointer in the Graphics component of Mozilla Firefox. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84131)

Internally found bugs present in Firefox 154, Firefox ESR 153.1 and Firefox ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and F…

 https://vulnerability.circl.lu/vuln/opensuse-su-2026:11678-1 openSUSE-SU-2026:11678-1 — MozillaThunderbird-140.15.0-1.1 on GA media 2026-10-02T11:15:30.568004+00:00

MozillaThunderbird-140.15.0-1.1 on GA media

 https://vulnerability.circl.lu/vuln/rhsa-2026:73971 RHSA-2026:73971 — Red Hat Security Advisory: thunderbird security update 2026-10-02T11:15:30.568049+00:00

firefox: thunderbird: Privilege escalation in the DOM: Workers component firefox: thunderbird: Sandbox escape in the Remote Settings Client component firefox: Sandbox escape due to use-after-free in the DOM: Navigation component firefox: Use-after-free in the Audio/Video component firefox: Sandbox escape due to use-after-free in the DOM: Security component firefox: Use-after-free in the Audio/Video component firefox: Use-after-free in the DOM: Core & HTML component firefox: Privilege escalation due to invalid pointer in the Graphics component firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 thunderbird: Uninitialized memory in MIME parsing thunderbird: One byte overflow read in mail parser thunderbird: Information disclosure due to malicious IMAP server response firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component firefox: thun…

 https://vulnerability.circl.lu/vuln/rlsa-2026:70642 RLSA-2026:70642 — Important: thunderbird security update 2026-10-02T11:15:30.568216+00:00

Affected: Rocky Linux:9: thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)

* firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)

* firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)

* firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)

* firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)

* firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)

* firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)

* firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)

* firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)

* firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

* thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)

* thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)

* thunderbird: One byte overflow read in mail parser (CVE-2026-84640)

* firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)

* firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)

* firefox: thunderbird: Use-after-free in the…

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-84641 UBUNTU-CVE-2026-84641 2026-10-02T11:15:30.568322+00:00

Affected: Ubuntu:22.04:LTS: thunderbird, Ubuntu:24.04:LTS: thunderbird, Ubuntu:26.04:LTS: thunderbird

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.