Skip to content
OpenAdvisories
High ALAS2-2026-3952 9 CVEs

Important: thunderbird security update (Amazon Linux 2)

Published Sep 28, 2026 · Updated Sep 28, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-92240: A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156 and Thunderbird 140.16. CVE-2026-92239: A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. CVE-2026-92238: A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. CVE-2026-92021: Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16. CVE-2026-92017: Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. CVE-2026-92014: Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 115.41, Firefox ESR 140.16, and Thunderbird 140.16. CVE-2026-84641: A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. CVE-2026-84640: A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. CVE-2026-84639: Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2 thunderbird 0:140.16.0-1.amzn2.0.1

Vulnerabilities 9

  • Critical 9.8
    CVE-2026-92238

    Ambiguous parsing of mail headers

    A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

    Mozilla Thunderbird thunderbird mozjs38 Debian Ubuntu
  • Critical 9.1
    CVE-2026-84639

    Uninitialized memory in MIME parsing

    Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  • Critical 9.1
    CVE-2026-92240

    Out-of-bounds read in IMAP response parser

    A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Th…

    Mozilla Thunderbird thunderbird mozjs38 Debian Ubuntu
  • High 8.8
    CVE-2026-92014

    Privilege escalation due to incorrect boundary conditions in the Graphics component

    Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 115.41, Firefox ESR 140.16, and Thunderbird 140.16.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-92017

    Privilege escalation in the DOM: Service Workers component

    Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.8
    CVE-2026-92021

    Use-after-free in the JavaScript Engine: JIT component

    Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 8.1
    CVE-2026-92239

    Buffer overrun in IMAP

    A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

    Mozilla Thunderbird thunderbird mozjs38 Debian Ubuntu
  • High 7.5
    CVE-2026-84640

    One byte overflow read in mail parser

    A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  • High 7.5
    CVE-2026-84641

    Information disclosure due to malicious IMAP server response

    A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-84639.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-84640.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-84641.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-92014.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-92017.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-92021.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-92238.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-92239.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-92240.html