Red Hat Security Advisory

RHSA-2026:65766

thunderbird security update

Released 2026-09-09 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v.9.2) thunderbird-140.14.0-1.el9_2

Fixes 23 records

TI-2026-52645 CVE-2026-74943 · GHSA-cx5v-35ww-82cj

Use after free in Mozilla Firefox

MEDIUM 51

Use-after-free in the Graphics: ImageLib component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00961 Published 2026-08-18 Partial fix · 115.39, 140.14 +2 CWE-416

TI-2026-52692 CVE-2026-74990 · GHSA-x3gf-4r72-x3gv

Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154

MEDIUM 50

Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00534 Published 2026-08-18 Partial fix · 115.39, 140.14 +2 CWE-119

TI-2026-52689 CVE-2026-74987 · GHSA-w34f-74jx-hvjc

Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154

MEDIUM 49

Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00523 Published 2026-08-18 Partial fix · 140.14, 153.1 +1 CWE-119

TI-2026-52646 CVE-2026-74944 · GHSA-77j9-v7c9-544q

Use after free in Mozilla Firefox

MEDIUM 49

Use-after-free in the DOM: Core & HTML component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00403 Published 2026-08-18 Partial fix · 140.14, 153.1 +1 CWE-416

TI-2026-52642 CVE-2026-74940 · GHSA-x9jf-q439-hfmv

Use after free in Mozilla Firefox

MEDIUM 49

Use-after-free in the Graphics: Text component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00412 Published 2026-08-18 Partial fix · 115.39, 140.14 +2 CWE-416

TI-2026-52661 CVE-2026-74959 · GHSA-hq5h-hpvx-rq86

Protection mechanism failure in Mozilla Firefox

MEDIUM 47

Mitigation bypass in the Storage: Cache API component.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00342 Published 2026-08-18 Partial fix · 140.14, 153.1 +1 CWE-693

TI-2026-52667 CVE-2026-74965 · GHSA-c224-pmx6-qhpm

Improper privilege management in Mozilla Firefox

MEDIUM 40

Privilege escalation in the Shell Integration component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00303 Published 2026-08-18 Partial fix · 140.14, 153.1 +1 CWE-269

TI-2026-52651 CVE-2026-74949 · GHSA-cjxq-c7rj-x436

Use after free in Mozilla Firefox

MEDIUM 40

Use-after-free in the Graphics: Canvas2D component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00318 Published 2026-08-18 Partial fix · 140.14, 153.1 +1 CWE-416

TI-2026-52648 CVE-2026-74946 · GHSA-9x2q-3qm9-cw76

Memory corruption in Mozilla Firefox

MEDIUM 40

Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00334 Published 2026-08-18 Partial fix · 115.39, 140.14 +2 CWE-119

TI-2026-52644 CVE-2026-74942 · GHSA-f6x3-5q9f-gph4

Improper privilege management in Mozilla Firefox

MEDIUM 40

Privilege escalation in the Remote Settings Client component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00304 Published 2026-08-18 Partial fix · 115.39, 140.14 +2 CWE-269

TI-2026-52641 CVE-2026-74939 · GHSA-mcwh-jxcv-xq9h

Improper privilege management in Mozilla Firefox

MEDIUM 40

Privilege escalation in the DOM: Navigation component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00304 Published 2026-08-18 Partial fix · 115.39, 140.14 +2 CWE-269

TI-2026-52637 CVE-2026-74935 · GHSA-8r77-hpjc-9jv5

Improper privilege management in Mozilla Firefox

MEDIUM 40

Privilege escalation in the DOM: Networking component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0031 Published 2026-08-18 Partial fix · 115.39, 140.14 +2 CWE-269

TI-2026-52659 CVE-2026-74957 · GHSA-w4xm-w4c4-5fhg

Protection mechanism failure in Mozilla Firefox

LOW 37

Mitigation bypass in the Safe Browsing component.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.003 Published 2026-08-18 Partial fix · 140.14, 153.1 +1 CWE-693

TI-2026-52664 CVE-2026-74962 · GHSA-56mf-8c53-7864

Origin validation error in Mozilla Firefox

LOW 36

Site isolation issue in the Networking: Cookies component.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00164 Published 2026-08-18 Partial fix · 140.14, 153.1 +1 CWE-346

TI-2026-52662 CVE-2026-74960 · GHSA-5r7x-fg3w-vcg2

Improper access control in Mozilla Firefox

LOW 36

Site isolation issue in the WebExtensions component.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00164 Published 2026-08-18 Partial fix · 140.14, 153.1 +1 CWE-284

TI-2026-52636 CVE-2026-74934 · GHSA-fwhj-g32m-x3vf

Information disclosure in Mozilla Firefox

LOW 34

Site isolation issue in the Graphics: CanvasWebGL component.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00158 Published 2026-08-18 Partial fix · 115.39, 140.14 +2 CWE-200

TI-2026-52647 CVE-2026-74945 · GHSA-5p4q-w2w4-c9jw

Information disclosure in Mozilla Firefox

LOW 30

Information disclosure in the Graphics: Text component.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0071 Published 2026-08-18 Partial fix · 115.39, 140.14 +2 CWE-200

TI-2026-52678 CVE-2026-74976 · GHSA-8j76-jchm-gqf4

Type confusion in Mozilla Firefox

LOW 29

JIT miscompilation in the JavaScript Engine: JIT component.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0032 Published 2026-08-18 Partial fix · 140.14, 153.1 +1 CWE-843

TI-2026-52676 CVE-2026-74974 · GHSA-xppv-6m94-c745

Origin validation error in Mozilla Firefox

LOW 23

Same-origin policy bypass in the Graphics: ImageLib component.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00135 Published 2026-08-18 Partial fix · 115.39, 140.14 +2 CWE-346

TI-2026-52665 CVE-2026-74963 · GHSA-8r32-h7pp-v9x9

Origin validation error in Mozilla Firefox

LOW 23

Same-origin policy bypass in the Networking: Cookies component.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00124 Published 2026-08-18 Partial fix · 140.14, 153.1 +1 CWE-346

TI-2026-52674 CVE-2026-74972 · GHSA-jq83-8mj9-4343

Information disclosure in Mozilla Firefox

LOW 20

Information disclosure in the DOM: Push Subscriptions component.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00261 Published 2026-08-18 Partial fix · 140.14, 153.1 +1 CWE-200

TI-2026-52673 CVE-2026-74971 · GHSA-67f4-mqxj-f332

Information disclosure in Mozilla Firefox

LOW 20

Information disclosure in the DOM: UI Events & Focus Handling component.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00324 Published 2026-08-18 Partial fix · 140.14, 153.1 +1 CWE-200

TI-2026-52675 CVE-2026-74973 · GHSA-cw58-8m9v-83jv

Race condition in Mozilla Firefox

LOW 19

Race condition, use-after-free in the Graphics component.

CVSS 3.1MEDIUM 4.2 Network No auth User interaction EPSS 0.00175 Published 2026-08-18 Partial fix · 115.39, 140.14 +2 CWE-362