Read the docs
Red Hat Security Advisory

RHSA-2026:39706

thunderbird security update

Released 2026-07-15 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 29 records

TI-2026-10570 CVE-2026-12297 · GHSA-vhm6-gp6v-q659

Memory corruption in Mozilla Firefox

Priority MEDIUM 43

Sandbox escape due to incorrect boundary conditions in the Networking component.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00393 Published 2026-06-16 Partial fix · 115.37, 140.12 +1 CWE-119
TI-2026-10569 CVE-2026-12296 · GHSA-2xx6-2jh9-8wmx

Protection mechanism failure in Mozilla Firefox

Priority MEDIUM 43

Sandbox escape in the Security: Process Sandboxing component.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00393 Published 2026-06-16 Partial fix · 140.12, 152 CWE-693
TI-2026-10568 CVE-2026-12295 · GHSA-pc23-5ppw-9j7m

Protection mechanism failure in Mozilla Firefox

Priority MEDIUM 43

Sandbox escape in the DOM: Navigation component.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00393 Published 2026-06-16 Partial fix · 115.37, 140.12 +1 CWE-693
TI-2026-10567 CVE-2026-12294 · GHSA-j3ch-r4qx-fpvf

Protection mechanism failure in Mozilla Firefox

Priority MEDIUM 43

Sandbox escape in the DOM: Workers component.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00363 Published 2026-06-16 Partial fix · 115.37, 140.12 +1 CWE-693
TI-2026-10588 CVE-2026-12315 · GHSA-9j9w-q224-vc26

Protection mechanism failure in Mozilla Firefox

Priority MEDIUM 41

Mitigation bypass in the DOM: Security component.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00251 Published 2026-06-16 Partial fix · 140.12, 152 CWE-693
TI-2026-10577 CVE-2026-12304 · GHSA-j8xr-5v62-3rx4

Origin validation error in Mozilla Firefox

Priority MEDIUM 40

Same-origin policy bypass in the Networking: Cookies component.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00189 Published 2026-06-16 Partial fix · 140.12, 152 CWE-346
TI-2026-10564 CVE-2026-12291 · GHSA-cvpf-j74m-qjrj

Use after free in Mozilla Firefox

Priority MEDIUM 40

Use-after-free in the Networking: HTTP component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00382 Published 2026-06-16 Partial fix · 115.37, 140.12 +1 CWE-416
TI-2026-10562 CVE-2026-12289 · GHSA-pp33-f8rg-g2pq

Improper privilege management in Mozilla Firefox

Priority MEDIUM 40

Privilege escalation in the Graphics: WebRender component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00395 Published 2026-06-16 Partial fix · 115.37, 140.12 +1 CWE-269
TI-2026-10578 CVE-2026-12305 · GHSA-2x28-ghj8-5fhc

Memory corruption in Mozilla Firefox

Priority LOW 39

Memory safety bug fixed in Thunderbird 152.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00374 Published 2026-06-16 Partial fix · 140.12, 152 CWE-119
TI-2026-10601 CVE-2026-12328 · GHSA-gff2-447q-xjx8

Buffer overflow in Mozilla Firefox

Priority LOW 38

Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00476 Published 2026-06-16 Partial fix · 115.37, 140.12 +1 CWE-120
TI-2026-10587 CVE-2026-12314 · GHSA-hmg6-wppr-3h56

Memory corruption in Mozilla Firefox

Priority LOW 38

Memory safety bug fixed in Thunderbird 152.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00252 Published 2026-06-16 Partial fix · 140.12, 152 CWE-119
TI-2026-10585 CVE-2026-12312 · GHSA-xq4r-rq82-x9jj

Memory corruption in Mozilla Firefox

Priority LOW 38

Memory safety bug fixed in Thunderbird 152.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00252 Published 2026-06-16 Partial fix · 140.12, 152 CWE-119
TI-2026-10583 CVE-2026-12310 · GHSA-9652-j9gr-w3mm

Memory corruption in Mozilla Firefox

Priority LOW 38

Memory safety bug fixed in Thunderbird 152.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00252 Published 2026-06-16 Partial fix · 140.12, 152 CWE-119
TI-2026-10565 CVE-2026-12292 · GHSA-22r2-gj47-5f7c

Memory corruption in Mozilla Firefox

Priority LOW 38

Incorrect boundary conditions in the Web Audio component.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00493 Published 2026-06-16 Partial fix · 140.12, 152 CWE-119
TI-2026-10563 CVE-2026-12290 · GHSA-g3gr-6w94-3656

Memory corruption in Mozilla Firefox

Priority LOW 37

Memory safety bug fixed in Thunderbird 152.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00397 Published 2026-06-16 Partial fix · 115.37, 140.12 +1 CWE-119
TI-2026-10582 CVE-2026-12309 · GHSA-jxv3-hqj6-9g5c

Memory corruption in Mozilla Firefox

Priority LOW 34

Memory safety bug fixed in Thunderbird 152.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00235 Published 2026-06-16 Partial fix · 140.12, 152 CWE-119
TI-2026-10575 CVE-2026-12302 · GHSA-hfh9-qj8m-jffj

Protection mechanism failure in Mozilla Firefox

Priority LOW 34

Mitigation bypass in the DOM: Security component.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00248 Published 2026-06-16 Partial fix · 115.37, 140.12 +1 CWE-693
TI-2026-10602 CVE-2026-12329 · GHSA-2g6w-7hp8-fv93

Memory corruption in Mozilla Firefox

Priority LOW 30

Memory safety bug fixed in Thunderbird ESR 140.12.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00313 Published 2026-06-16 Partial fix · 140.12 CWE-119
TI-2026-10581 CVE-2026-12308 · GHSA-q9cv-r3xr-8wvv

Memory corruption in Mozilla Firefox

Priority LOW 30

Memory safety bug fixed in Thunderbird 152.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00261 Published 2026-06-16 Partial fix · 140.12, 152 CWE-119
TI-2026-10580 CVE-2026-12307 · GHSA-m2jv-hf34-6g5m

Memory corruption in Mozilla Firefox

Priority LOW 30

Memory safety bug fixed in Thunderbird 152.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00261 Published 2026-06-16 Partial fix · 140.12, 152 CWE-119
TI-2026-10579 CVE-2026-12306 · GHSA-p2g2-3x6h-6239

Memory corruption in Mozilla Firefox

Priority LOW 30

Memory safety bug fixed in Thunderbird 152.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00261 Published 2026-06-16 Partial fix · 140.12, 152 CWE-119
TI-2026-10603 CVE-2026-12330 · GHSA-jrcp-wwfg-qhjg

Memory corruption in Mozilla Firefox

Priority LOW 24

Incorrect boundary conditions in the Internationalization component.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00164 Published 2026-06-16 Partial fix · 115.37, 140.12 CWE-119
TI-2026-10572 CVE-2026-12299 · GHSA-4885-5pch-3x6m

Type confusion in Mozilla Firefox

Priority LOW 24

JIT miscompilation in the DOM: Core & HTML component.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00306 Published 2026-06-16 Partial fix · 115.37, 140.12 +1 CWE-843
TI-2026-10571 CVE-2026-12298 · GHSA-pp6j-x3qr-cjgj

Out-of-bounds read in Mozilla Firefox

Priority LOW 24

Memory safety bug fixed in Thunderbird 152.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00306 Published 2026-06-16 Partial fix · 140.12, 152 CWE-125
TI-2026-10586 CVE-2026-12313 · GHSA-h8rm-48w7-7wp9

Improper privilege management in Mozilla Firefox

Priority LOW 21

Information disclosure, sandbox escape in the Security: Process Sandboxing component.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00175 Published 2026-06-16 Partial fix · 140.12, 152 CWE-269
TI-2026-10584 CVE-2026-12311 · GHSA-3pp7-m8f5-89gx

Information disclosure in Mozilla Firefox

Priority LOW 21

Information disclosure, sandbox escape in the Security: Process Sandboxing component.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00185 Published 2026-06-16 Partial fix · 140.12, 152 CWE-200