ALSA-2026:6342 — Important: thunderbird security update

Summary

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701)
* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4721)
* firefox: thunderbird: Privilege escalation in the Netmonitor component (CVE-2026-4717)
* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-4688)
* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4706)
* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4695)
* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4689)
* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-4698)
* firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component (CVE-2026-4716)
* firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component (CVE-2026-4684)
* firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4705)
* firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component (CVE-2026-4715)
* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4685)
* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4714)
* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-4709)
* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4710)
* firefox: thunderbird: Information disclosure in the Widget: Cocoa component (CVE-2026-4712)
* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4697)
* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4713)
* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4690)
* firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-4711)
* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4686)
* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4708)
* firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-4691)
* firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-4699)
* firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-4696)
* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-4693)
* firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4718)
* firefox: thunderbird: JIT miscompilation in the JavaScript Engine component (CVE-2026-4702)
* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Text component (CVE-2026-4719)
* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics component (CVE-2026-4694)
* firefox: thunderbird: Sandbox escape in the Responsive Design Mode component (CVE-2026-4692)
* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4720)
* firefox: thunderbird: Mitigation bypass in the Networking: HTTP component (CVE-2026-4700)
* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4707)
* firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component (CVE-2026-4704)
* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component (CVE-2026-4687)
* thunderbird: Out of bounds read in IMAP parsing (CVE-2026-4371)
* thunderbird: Spoofing issue in Thunderbird (CVE-2026-3889)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

Release	Package	Fixed in
AlmaLinux · 10	thunderbird	140.9.0-1.el10_1.alma.1

Vulnerabilities 39

Critical 10.0

CVE-2026-4689

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-4691

Use-after-free in the CSS Parsing and Computation component

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-4696

Use-after-free in the Layout: Text and Fonts component

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-4700

Mitigation bypass in the Networking: HTTP component

Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-4701

Use-after-free in the JavaScript Engine component

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-4702

JIT miscompilation in the JavaScript Engine component

JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-4705

Undefined behavior in the WebRTC: Signaling component

Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-4710

Incorrect boundary conditions in the Audio/Video component

Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-4711

Use-after-free in the Widget: Cocoa component

Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-4717

Privilege escalation in the Netmonitor component

Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-4720

Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

Memory safety bugs present in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary co…

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-4721

Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited…

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.6

CVE-2026-4687

Sandbox escape due to incorrect boundary conditions in the Telemetry component

Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.6

CVE-2026-4688

Sandbox escape due to use-after-free in the Disability Access APIs component

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.6

CVE-2026-4690

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.6

CVE-2026-4692 Public exploit

Sandbox escape in the Responsive Design Mode component

Sandbox escape in the Responsive Design Mode component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.1

CVE-2026-4715

Uninitialized memory in the Graphics: Canvas2D component

Uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.1

CVE-2026-4716

Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component

Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 8.8

CVE-2026-4698

JIT miscompilation in the JavaScript Engine: JIT component

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 8.1

CVE-2026-4718

Undefined behavior in the WebRTC: Signaling component

Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4684

Race condition, use-after-free in the Graphics: WebRender component

Race condition, use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4685

Incorrect boundary conditions in the Graphics: Canvas2D component

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4686

Incorrect boundary conditions in the Graphics: Canvas2D component

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4693

Incorrect boundary conditions in the Audio/Video: Playback component

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4694

Incorrect boundary conditions, integer overflow in the Graphics component

Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4695

Incorrect boundary conditions in the Audio/Video: Web Codecs component

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4697

Incorrect boundary conditions in the Audio/Video: Web Codecs component

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4699

Incorrect boundary conditions in the Layout: Text and Fonts component

Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4704

Denial-of-service in the WebRTC: Signaling component

Denial-of-service in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4706

Incorrect boundary conditions in the Graphics: Canvas2D component

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4707

Incorrect boundary conditions in the Graphics: Canvas2D component

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4708

Incorrect boundary conditions in the Graphics component

Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4709

Incorrect boundary conditions in the Audio/Video: GMP component

Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4712

Information disclosure in the Widget: Cocoa component

Information disclosure in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4713

Incorrect boundary conditions in the Graphics component

Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4714

Incorrect boundary conditions in the Audio/Video component

Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.5

CVE-2026-4719

Incorrect boundary conditions in the Graphics: Text component

Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
High 7.4

CVE-2026-4371

Out of bounds read in IMAP parsing

A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker could cause the parser to malfunction, potentially …

Mozilla Thunderbird thunderbird mozjs38 Debian Ubuntu

Mar 24, 2026
Medium 6.5

CVE-2026-3889

Spoofing issue in Thunderbird

Spoofing issue in Thunderbird. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.

Mozilla Thunderbird thunderbird mozjs38 Debian Ubuntu

Mar 24, 2026

References

report
https://access.redhat.com/security/cve/CVE-2026-3889
report
https://access.redhat.com/security/cve/CVE-2026-4371
report
https://access.redhat.com/security/cve/CVE-2026-4684
report
https://access.redhat.com/security/cve/CVE-2026-4685
report
https://access.redhat.com/security/cve/CVE-2026-4686
report
https://access.redhat.com/security/cve/CVE-2026-4687
report
https://access.redhat.com/security/cve/CVE-2026-4688
report
https://access.redhat.com/security/cve/CVE-2026-4689
report
https://access.redhat.com/security/cve/CVE-2026-4690
report
https://access.redhat.com/security/cve/CVE-2026-4691
report
https://access.redhat.com/security/cve/CVE-2026-4692
report
https://access.redhat.com/security/cve/CVE-2026-4693
report
https://access.redhat.com/security/cve/CVE-2026-4694
report
https://access.redhat.com/security/cve/CVE-2026-4695
report
https://access.redhat.com/security/cve/CVE-2026-4696
report
https://access.redhat.com/security/cve/CVE-2026-4697
report
https://access.redhat.com/security/cve/CVE-2026-4698
report
https://access.redhat.com/security/cve/CVE-2026-4699
report
https://access.redhat.com/security/cve/CVE-2026-4700
report
https://access.redhat.com/security/cve/CVE-2026-4701
report
https://access.redhat.com/security/cve/CVE-2026-4702
report
https://access.redhat.com/security/cve/CVE-2026-4704
report
https://access.redhat.com/security/cve/CVE-2026-4705
report
https://access.redhat.com/security/cve/CVE-2026-4706
report
https://access.redhat.com/security/cve/CVE-2026-4707
report
https://access.redhat.com/security/cve/CVE-2026-4708
report
https://access.redhat.com/security/cve/CVE-2026-4709
report
https://access.redhat.com/security/cve/CVE-2026-4710
report
https://access.redhat.com/security/cve/CVE-2026-4711
report
https://access.redhat.com/security/cve/CVE-2026-4712
report
https://access.redhat.com/security/cve/CVE-2026-4713
report
https://access.redhat.com/security/cve/CVE-2026-4714
report
https://access.redhat.com/security/cve/CVE-2026-4715
report
https://access.redhat.com/security/cve/CVE-2026-4716
report
https://access.redhat.com/security/cve/CVE-2026-4717
report
https://access.redhat.com/security/cve/CVE-2026-4718
report
https://access.redhat.com/security/cve/CVE-2026-4719
report
https://access.redhat.com/security/cve/CVE-2026-4720
report
https://access.redhat.com/security/cve/CVE-2026-4721