Skip to content
OpenAdvisories
High RLSA-2026:33445 29 CVEs

Important: thunderbird security update

Published Jul 4, 2026 · Updated Jul 4, 2026

Ecosystem: Rocky Linux

Summary

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Sandbox escape in the DOM: Workers component (CVE-2026-12294)

* firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12313)

* firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12311)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12290)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12327)

* firefox: thunderbird: JIT miscompilation in the DOM: Core & HTML component (CVE-2026-12299)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12329)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12312)

* firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12302)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12328)

* firefox: thunderbird: Incorrect boundary conditions in the Internationalization component (CVE-2026-12330)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12314)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12309)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12310)

* firefox: thunderbird: Denial-of-service in the Graphics: ImageLib component (CVE-2026-12325)

* firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-12295)

* firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-12289)

* firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12315)

* firefox: thunderbird: Sandbox escape in the Security: Process Sandboxing component (CVE-2026-12296)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12306)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12307)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-12297)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12305)

* firefox: thunderbird: Incorrect boundary conditions in the Web Audio component (CVE-2026-12292)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12308)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-12324)

* firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-12304)

* firefox: thunderbird: Use-after-free in the Networking: HTTP component (CVE-2026-12291)

* firefox: thunderbird: Memory safety bug fixed in Firefox ESR 140.12 (CVE-2026-12298)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 8 thunderbird 0:140.12.0-1.el8_10

Vulnerabilities 29

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489207
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489208
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489209
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489210
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489211
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489212
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489214
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489215
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489217
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489218
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489220
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489221
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489223
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489224
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489225
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489226
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489229
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489231
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489232
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489233
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489234
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489235
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489236
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489237
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489239
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489240
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489243
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489244
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489248