Red Hat Security AdvisoryRHSA-2026:0025
thunderbird security update
Released 2026-01-05 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 10) thunderbird-140.6.0-1.el10_1
Fixes 10 records
Priority MEDIUM 50
JIT miscompilation in the JavaScript Engine: JIT component.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00565 · Published 2025-12-09 · Partial fix · 115.31, 140.6 +1 CWE-94
Priority MEDIUM 50
Use-after-free in the WebRTC: Signaling component.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00596 · Published 2025-12-09 · Partial fix · 140.6, 146 CWE-416
Priority MEDIUM 49
JIT miscompilation in the JavaScript Engine: JIT component.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00506 · Published 2025-12-09 · Partial fix · 140.6, 146 CWE-119
Priority MEDIUM 40
Privilege escalation in the Netmonitor component.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00402 · Published 2025-12-09 · Partial fix · 140.6, 146
Priority MEDIUM 40
Privilege escalation in the Netmonitor component.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00402 · Published 2025-12-09 · Partial fix · 140.6, 146
Priority MEDIUM 40
Privilege escalation in the DOM: Notifications component.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00415 · Published 2025-12-09 · Partial fix · 115.31, 140.6 +1
Priority LOW 38
Memory safety bugs present in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145 and Thunderbird 145.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00442 · Published 2025-12-09 · Partial fix · 140.6, 146 CWE-119
Priority LOW 38
JIT miscompilation in the JavaScript Engine: JIT component.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.00342 · Published 2025-12-09 · Partial fix · 140.6, 146 CWE-843
Priority LOW 37
Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
CVSS 3.1HIGH 8.0· Network · No auth · User interaction · EPSS 0.00339 · Published 2025-12-09 · Partial fix · 115.31, 140.6 +1 CWE-754
Priority LOW 34
Same-origin policy bypass in the Request Handling component.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00187 · Published 2025-12-09 · Partial fix · 115.31, 140.6 +1 CWE-346