RLSA-2026:65159

Dashboard / Vulnerabilities / RLSA-2026:65159

RLSA-2026:65159

Summary: Important: thunderbird security update

Details: Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component (CVE-2026-74934) * firefox: thunderbird: Privilege escalation in the Networking: Cookies component (CVE-2026-74953) * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74987) * firefox: thunderbird: Information disclosure in the Graphics component (CVE-2026-74948) * firefox: thunderbird: Information disclosure in the DOM: UI Events & Focus Handling component (CVE-2026-74971) * firefox: Race condition, use-after-free in the Graphics component (CVE-2026-74973) * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74990) * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-74936) * firefox: thunderbird: Site isolation issue in the WebExtensions component (CVE-2026-74960) * firefox: thunderbird: Mitigation bypass in the Storage: Cache API component (CVE-2026-74959) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-74976) * firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component (CVE-2026-74974) * firefox: thunderbird: Mitigation bypass in the Safe Browsing component (CVE-2026-74957) * firefox: Privilege escalation in the Remote Settings Client component (CVE-2026-74942) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-74939) * firefox: thunderbird: Information disclosure in the DOM: Push Subscriptions component (CVE-2026-74972) * firefox: thunderbird: Information disclosure in the Graphics: Text component (CVE-2026-74945) * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-74963) * firefox: Integer overflow in the Graphics component (CVE-2026-74964) * firefox: Site isolation issue in the Networking: Cookies component (CVE-2026-74962) * firefox: thunderbird: Privilege escalation in the DOM: Networking component (CVE-2026-74935) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References: https://errata.rockylinux.org/RLSA-2026:65159, https://bugzilla.redhat.com/show_bug.cgi?id=2517866, https://bugzilla.redhat.com/show_bug.cgi?id=2517874, https://bugzilla.redhat.com/show_bug.cgi?id=2517845, https://bugzilla.redhat.com/show_bug.cgi?id=2517859, https://bugzilla.redhat.com/show_bug.cgi?id=2517825, https://bugzilla.redhat.com/show_bug.cgi?id=2517849, https://bugzilla.redhat.com/show_bug.cgi?id=2517840, https://bugzilla.redhat.com/show_bug.cgi?id=2517831, https://bugzilla.redhat.com/show_bug.cgi?id=2517820, https://bugzilla.redhat.com/show_bug.cgi?id=2517836, https://bugzilla.redhat.com/show_bug.cgi?id=2517863, https://bugzilla.redhat.com/show_bug.cgi?id=2517872, https://bugzilla.redhat.com/show_bug.cgi?id=2517823, https://bugzilla.redhat.com/show_bug.cgi?id=2517853, https://bugzilla.redhat.com/show_bug.cgi?id=2517822, https://bugzilla.redhat.com/show_bug.cgi?id=2517870, https://bugzilla.redhat.com/show_bug.cgi?id=2517862, https://bugzilla.redhat.com/show_bug.cgi?id=2517851, https://bugzilla.redhat.com/show_bug.cgi?id=2517839, https://bugzilla.redhat.com/show_bug.cgi?id=2517860, https://bugzilla.redhat.com/show_bug.cgi?id=2517856, https://access.redhat.com/errata/RHSA-2026:65159