Security update for MozillaThunderbird
| Announcement ID: | SUSE-SU-2026:0880-1 |
|---|---|
| Release Date: | 2026-03-12T10:18:38Z |
| Rating: | important |
| References: | |
| Cross-References: |
|
| CVSS scores: |
|
| Affected Products: |
|
An update that solves 37 vulnerabilities can now be installed.
Description:
This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird 140.8 MFSA 2026-17 (bsc#1258568):
- CVE-2026-2757: Incorrect boundary conditions in the WebRTC: Audio/Video component
- CVE-2026-2758: Use-after-free in the JavaScript: GC component
- CVE-2026-2759: Incorrect boundary conditions in the Graphics: ImageLib component
- CVE-2026-2760: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
- CVE-2026-2761: Sandbox escape in the Graphics: WebRender component
- CVE-2026-2762: Integer overflow in the JavaScript: Standard Library component
- CVE-2026-2763: Use-after-free in the JavaScript Engine component
- CVE-2026-2764: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component
- CVE-2026-2765: Use-after-free in the JavaScript Engine component
- CVE-2026-2766: Use-after-free in the JavaScript Engine: JIT component
- CVE-2026-2767: Use-after-free in the JavaScript: WebAssembly component
- CVE-2026-2768: Sandbox escape in the Storage: IndexedDB component
- CVE-2026-2769: Use-after-free in the Storage: IndexedDB component
- CVE-2026-2770: Use-after-free in the DOM: Bindings (WebIDL) component
- CVE-2026-2771: Undefined behavior in the DOM: Core & HTML component
- CVE-2026-2772: Use-after-free in the Audio/Video: Playback component
- CVE-2026-2773: Incorrect boundary conditions in the Web Audio component
- CVE-2026-2774: Integer overflow in the Audio/Video component
- CVE-2026-2775: Mitigation bypass in the DOM: HTML Parser component
- CVE-2026-2776: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software
- CVE-2026-2777: Privilege escalation in the Messaging System component
- CVE-2026-2778: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component
- CVE-2026-2779: Incorrect boundary conditions in the Networking: JAR component
- CVE-2026-2780: Privilege escalation in the Netmonitor component
- CVE-2026-2781: Integer overflow in the Libraries component in NSS
- CVE-2026-2782: Privilege escalation in the Netmonitor component
- CVE-2026-2783: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component
- CVE-2026-2784: Mitigation bypass in the DOM: Security component
- CVE-2026-2785: Invalid pointer in the JavaScript Engine component
- CVE-2026-2786: Use-after-free in the JavaScript Engine component
- CVE-2026-2787: Use-after-free in the DOM: Window and Location component
- CVE-2026-2788: Incorrect boundary conditions in the Audio/Video: GMP component
- CVE-2026-2789: Use-after-free in the Graphics: ImageLib component
- CVE-2026-2790: Same-origin policy bypass in the Networking: JAR component
- CVE-2026-2791: Mitigation bypass in the Networking: Cache component
- CVE-2026-2792: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148
- CVE-2026-2793: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise Workstation Extension 15 SP7
zypper in -t patch SUSE-SLE-Product-WE-15-SP7-2026-880=1 -
openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2026-880=1 -
SUSE Package Hub 15 15-SP7
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-880=1
Package List:
-
SUSE Linux Enterprise Workstation Extension 15 SP7 (x86_64)
- MozillaThunderbird-debugsource-140.8.0-150200.8.260.1
- MozillaThunderbird-translations-other-140.8.0-150200.8.260.1
- MozillaThunderbird-debuginfo-140.8.0-150200.8.260.1
- MozillaThunderbird-translations-common-140.8.0-150200.8.260.1
- MozillaThunderbird-140.8.0-150200.8.260.1
-
openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
- MozillaThunderbird-debugsource-140.8.0-150200.8.260.1
- MozillaThunderbird-translations-other-140.8.0-150200.8.260.1
- MozillaThunderbird-debuginfo-140.8.0-150200.8.260.1
- MozillaThunderbird-translations-common-140.8.0-150200.8.260.1
- MozillaThunderbird-140.8.0-150200.8.260.1
-
SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x)
- MozillaThunderbird-debugsource-140.8.0-150200.8.260.1
- MozillaThunderbird-translations-other-140.8.0-150200.8.260.1
- MozillaThunderbird-debuginfo-140.8.0-150200.8.260.1
- MozillaThunderbird-translations-common-140.8.0-150200.8.260.1
- MozillaThunderbird-140.8.0-150200.8.260.1
References:
- https://www.suse.com/security/cve/CVE-2026-2757.html
- https://www.suse.com/security/cve/CVE-2026-2758.html
- https://www.suse.com/security/cve/CVE-2026-2759.html
- https://www.suse.com/security/cve/CVE-2026-2760.html
- https://www.suse.com/security/cve/CVE-2026-2761.html
- https://www.suse.com/security/cve/CVE-2026-2762.html
- https://www.suse.com/security/cve/CVE-2026-2763.html
- https://www.suse.com/security/cve/CVE-2026-2764.html
- https://www.suse.com/security/cve/CVE-2026-2765.html
- https://www.suse.com/security/cve/CVE-2026-2766.html
- https://www.suse.com/security/cve/CVE-2026-2767.html
- https://www.suse.com/security/cve/CVE-2026-2768.html
- https://www.suse.com/security/cve/CVE-2026-2769.html
- https://www.suse.com/security/cve/CVE-2026-2770.html
- https://www.suse.com/security/cve/CVE-2026-2771.html
- https://www.suse.com/security/cve/CVE-2026-2772.html
- https://www.suse.com/security/cve/CVE-2026-2773.html
- https://www.suse.com/security/cve/CVE-2026-2774.html
- https://www.suse.com/security/cve/CVE-2026-2775.html
- https://www.suse.com/security/cve/CVE-2026-2776.html
- https://www.suse.com/security/cve/CVE-2026-2777.html
- https://www.suse.com/security/cve/CVE-2026-2778.html
- https://www.suse.com/security/cve/CVE-2026-2779.html
- https://www.suse.com/security/cve/CVE-2026-2780.html
- https://www.suse.com/security/cve/CVE-2026-2781.html
- https://www.suse.com/security/cve/CVE-2026-2782.html
- https://www.suse.com/security/cve/CVE-2026-2783.html
- https://www.suse.com/security/cve/CVE-2026-2784.html
- https://www.suse.com/security/cve/CVE-2026-2785.html
- https://www.suse.com/security/cve/CVE-2026-2786.html
- https://www.suse.com/security/cve/CVE-2026-2787.html
- https://www.suse.com/security/cve/CVE-2026-2788.html
- https://www.suse.com/security/cve/CVE-2026-2789.html
- https://www.suse.com/security/cve/CVE-2026-2790.html
- https://www.suse.com/security/cve/CVE-2026-2791.html
- https://www.suse.com/security/cve/CVE-2026-2792.html
- https://www.suse.com/security/cve/CVE-2026-2793.html
- https://bugzilla.suse.com/show_bug.cgi?id=1258568