Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 17

• Critical 10.0
  CVE-2026-0881

  Sandbox escape in the Messaging System component

  Sandbox escape in the Messaging System component. This vulnerability was fixed in Firefox 147 and Thunderbird 147.

  Mozilla Firefox Thunderbird firefox Browsers Wolfi
  Jan 13, 2026
• Critical 9.8
  CVE-2026-0879

  Sandbox escape due to incorrect boundary conditions in the Graphics component

  Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026
• Critical 9.8
  CVE-2026-0884

  Use-after-free in the JavaScript Engine component

  Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026
• Critical 9.8
  CVE-2026-0892

  Memory safety bugs fixed in Firefox 147 and Thunderbird 147

  Memory safety bugs present in Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefo…

  Mozilla Firefox Thunderbird mozjs38 Browsers Ubuntu Wolfi
  Jan 13, 2026
• High 8.8
  CVE-2026-0880

  Sandbox escape due to integer overflow in the Graphics component

  Sandbox escape due to integer overflow in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026
• High 8.8
  CVE-2026-0882

  Use-after-free in the IPC component

  Use-after-free in the IPC component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026
• High 8.1
  CVE-2026-0877

  Mitigation bypass in the DOM: Security component

  Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026
• High 8.1
  CVE-2026-0891

  Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147

  Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary co…

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026
• High 8.0
  CVE-2026-0878

  Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component

  Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026
• High 7.5
  CVE-2025-14327

  Spoofing issue in the Downloads Panel component

  Spoofing issue in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025
• High 7.5
  CVE-2026-0889

  Denial-of-service in the DOM: Service Workers component

  Denial-of-service in the DOM: Service Workers component. This vulnerability was fixed in Firefox 147 and Thunderbird 147.

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  Jan 13, 2026
• Medium 6.5
  CVE-2026-0885

  Use-after-free in the JavaScript: GC component

  Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026
• Medium 5.4
  CVE-2026-0890

  Spoofing issue in the DOM: Copy & Paste and Drag & Drop component

  Spoofing issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026
• Medium 5.3
  CVE-2026-0883

  Information disclosure in the Networking component

  Information disclosure in the Networking component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026
• Medium 5.3
  CVE-2026-0886

  Incorrect boundary conditions in the Graphics component

  Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026
• Medium 5.3
  CVE-2026-0888

  Information disclosure in the XML component

  Information disclosure in the XML component. This vulnerability was fixed in Firefox 147 and Thunderbird 147.

  Mozilla Firefox Thunderbird firefox Browsers Wolfi
  Jan 13, 2026
• Medium 4.3
  CVE-2026-0887

  Clickjacking issue, information disclosure in the PDF Viewer component

  Clickjacking issue, information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026

Revision history

1. 2026-11-05 #22

   Neue Updates von Oracle Linux aufgenommen

2. 2026-09-21 #21

   Neue Updates von Oracle Linux aufgenommen

3. 2026-06-30 #20

   Neue Updates von Oracle Linux aufgenommen

4. 2026-06-15 #19

   Neue Updates von Oracle Linux aufgenommen

5. 2026-06-11 #18

   Neue Updates von Oracle Linux aufgenommen

6. 2026-06-10 #17

   Neue Updates von Oracle Linux aufgenommen

7. 2026-02-18 #16

   Neue Updates von Amazon und Oracle Linux aufgenommen

8. 2026-02-09 #15

   Neue Updates von Oracle Linux aufgenommen

9. 2026-02-08 #14

   Neue Updates von Rocky Enterprise Software Foundation und Red Hat aufgenommen

10. 2026-02-04 #13

    Neue Updates von Red Hat aufgenommen

11. 2026-02-02 #12

    Neue Updates von Ubuntu aufgenommen

12. 2026-01-28 #11

    Neue Updates von Red Hat aufgenommen

13. 2026-01-27 #10

    Neue Updates von Red Hat aufgenommen

14. 2026-01-26 #9

    Neue Updates von Red Hat aufgenommen

15. 2026-01-22 #8

    Neue Updates von SUSE aufgenommen

16. 2026-01-21 #7

    Neue Updates von Red Hat und Oracle Linux aufgenommen

17. 2026-01-20 #6

    Neue Updates von SUSE aufgenommen

18. 2026-01-19 #5

    Neue Updates von Debian und SUSE aufgenommen

19. 2026-01-18 #4

    Neue Updates von Debian und Oracle Linux aufgenommen

20. 2026-01-15 #3

    Neue Updates von Debian und openSUSE aufgenommen

21. 2026-01-14 #2

    Neue Updates von openSUSE, Red Hat, European Union Vulnerability Database und SUSE aufgenommen

22. 2026-01-13 #1

    Initiale Fassung

References

• Mozilla Foundation Security Advisory MFSA 2026-01 vom 2026-01-13
  https://www.mozilla.org/en-US/security/advisories/mfsa2026-01/
• Mozilla Foundation Security Advisory MFSA 2026-02 vom 2026-01-13
  https://www.mozilla.org/en-US/security/advisories/mfsa2026-02/
• Mozilla Foundation Security Advisory MFSA 2026-03 vom 2026-01-13
  https://www.mozilla.org/en-US/security/advisories/mfsa2026-03/
• openSUSE Security Update OPENSUSE-SU-2026:10037-1 vom 2026-01-14
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MWE7GIFYIBLX76K6B34TZZ67PXOQMQY6/
• Red Hat Security Advisory RHSA-2026:0667 vom 2026-01-15
  https://access.redhat.com/errata/RHSA-2026:0667
• SUSE Security Update SUSE-SU-2026:0122-1 vom 2026-01-14
  https://lists.suse.com/pipermail/sle-security-updates/2026-January/023741.html
• Mozilla Security Advisory MFSA2026-04 vom 2026-01-15
  https://www.mozilla.org/en-US/security/advisories/mfsa2026-04/
• Mozilla Security Advisory MFSA2026-05 vom 2026-01-15
  https://www.mozilla.org/en-US/security/advisories/mfsa2026-05/
• Red Hat Security Advisory RHSA-2026:0694 vom 2026-01-15
  https://access.redhat.com/errata/RHSA-2026:0694
• Debian Security Advisory DLA-4439 vom 2026-01-15
  https://lists.debian.org/debian-lts-announce/2026/01/msg00010.html
• Debian Security Advisory DSA-6101 vom 2026-01-15
  https://lists.debian.org/debian-security-announce/2026/msg00009.html
• openSUSE Security Update OPENSUSE-SU-2026:10046-1 vom 2026-01-15
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2E4U6WVD3HP25MAGYON4BCRAFHCTX3SC/
• Rocky Linux Security Advisory RLSA-2026:0667 vom 2026-01-16
  https://errata.build.resf.org/RLSA-2026:0667
• Rocky Linux Security Advisory RLSA-2026:0694 vom 2026-01-16
  https://errata.build.resf.org/RLSA-2026:0694
• Debian Security Advisory DSA-6103 vom 2026-01-17
  https://lists.debian.org/debian-security-announce/2026/msg00011.html
• Oracle Linux Security Advisory ELSA-2026-0694 vom 2026-01-16
  https://linux.oracle.com/errata/ELSA-2026-0694.html
• Oracle Linux Security Advisory ELSA-2026-0667 vom 2026-01-16
  https://linux.oracle.com/errata/ELSA-2026-0667.html
• Debian Security Advisory DLA-4442 vom 2026-01-19
  https://lists.debian.org/debian-lts-announce/2026/01/msg00013.html
• SUSE Security Update SUSE-SU-2026:0153-1 vom 2026-01-19
  https://lists.suse.com/pipermail/sle-security-updates/2026-January/023791.html
• SUSE Security Update SUSE-SU-2026:20086-1 vom 2026-01-20
  https://lists.suse.com/pipermail/sle-security-updates/2026-January/023813.html
• Red Hat Security Advisory RHSA-2026:0924 vom 2026-01-21
  https://access.redhat.com/errata/RHSA-2026:0924
• Oracle Linux Security Advisory ELSA-2026-0924 vom 2026-01-21
  https://linux.oracle.com/errata/ELSA-2026-0924.html
• Rocky Linux Security Advisory RLSA-2026:0924 vom 2026-01-22
  https://errata.build.resf.org/RLSA-2026:0924
• SUSE Security Update SUSE-SU-2026:0260-1 vom 2026-01-23
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VOTCXXVYDWXM7Y4N2D6ZBPDRGOEE7KPT/
• Red Hat Security Advisory RHSA-2026:1320 vom 2026-01-27
  https://access.redhat.com/errata/RHSA-2026:1320
• Red Hat Security Advisory RHSA-2026:1462 vom 2026-01-28
  https://access.redhat.com/errata/RHSA-2026:1462
• Red Hat Security Advisory RHSA-2026:1471 vom 2026-01-28
  https://access.redhat.com/errata/RHSA-2026:1471
• Red Hat Security Advisory RHSA-2026:1413 vom 2026-01-27
  https://access.redhat.com/errata/RHSA-2026:1413
• Red Hat Security Advisory RHSA-2026:1414 vom 2026-01-27
  https://access.redhat.com/errata/RHSA-2026:1414
• Red Hat Security Advisory RHSA-2026:1415 vom 2026-01-27
  https://access.redhat.com/errata/RHSA-2026:1415
• Red Hat Security Advisory RHSA-2026:1461 vom 2026-01-28
  https://access.redhat.com/errata/RHSA-2026:1461
• Red Hat Security Advisory RHSA-2026:1487 vom 2026-01-28
  https://access.redhat.com/errata/RHSA-2026:1487
• Ubuntu Security Notice USN-7991-1 vom 2026-02-03
  https://ubuntu.com/security/notices/USN-7991-1
• Red Hat Security Advisory RHSA-2026:2043 vom 2026-02-05
  https://access.redhat.com/errata/RHSA-2026:2043
• Red Hat Security Advisory RHSA-2026:2047 vom 2026-02-05
  https://access.redhat.com/errata/RHSA-2026:2047
• Red Hat Security Advisory RHSA-2026:2041 vom 2026-02-05
  https://access.redhat.com/errata/RHSA-2026:2041
• Red Hat Security Advisory RHSA-2026:2044 vom 2026-02-05
  https://access.redhat.com/errata/RHSA-2026:2044
• Red Hat Security Advisory RHSA-2026:2074 vom 2026-02-05
  https://access.redhat.com/errata/RHSA-2026:2074
• Red Hat Security Advisory RHSA-2026:2073 vom 2026-02-05
  https://access.redhat.com/errata/RHSA-2026:2073
• Red Hat Security Advisory RHSA-2026:2070 vom 2026-02-05
  https://access.redhat.com/errata/RHSA-2026:2070
• Red Hat Security Advisory RHSA-2026:2069 vom 2026-02-05
  https://access.redhat.com/errata/RHSA-2026:2069
• Rocky Linux Security Advisory RLSA-2026:2220 vom 2026-02-09
  https://errata.build.resf.org/RLSA-2026:2220
• Red Hat Security Advisory RHSA-2026:2231 vom 2026-02-09
  https://access.redhat.com/errata/RHSA-2026:2231
• Red Hat Security Advisory RHSA-2026:2220 vom 2026-02-09
  https://access.redhat.com/errata/RHSA-2026:2220
• Red Hat Security Advisory RHSA-2026:2271 vom 2026-02-09
  https://access.redhat.com/errata/RHSA-2026:2271
• Red Hat Security Advisory RHSA-2026:2286 vom 2026-02-09
  https://access.redhat.com/errata/RHSA-2026:2286
• Oracle Linux Security Advisory ELSA-2026-2286 vom 2026-02-10
  http://linux.oracle.com/errata/ELSA-2026-2286.html
• Oracle Linux Security Advisory ELSA-2026-2271 vom 2026-02-10
  http://linux.oracle.com/errata/ELSA-2026-2271.html
• Oracle Linux Security Advisory ELSA-2026-2220 vom 2026-02-10
  https://linux.oracle.com/errata/ELSA-2026-2220.html
• Amazon Linux Security Advisory ALAS2FIREFOX-2026-050 vom 2026-02-19
  https://alas.aws.amazon.com/AL2/ALAS2FIREFOX-2026-050.html
• Amazon Linux Security Advisory ALAS2-2026-3167 vom 2026-02-19
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3167.html
• Oracle Linux Security Advisory ELSA-2026-2231 vom 2026-02-19
  https://linux.oracle.com/errata/ELSA-2026-2231.html
• Oracle Linux Security Advisory ELSA-2026-26551 vom 2026-06-30
  https://linux.oracle.com/errata/ELSA-2026-26551.html
• Oracle Linux Security Advisory ELSA-2026-24983 vom 2026-06-30
  https://linux.oracle.com/errata/ELSA-2026-24983.html
• Oracle Linux Security Advisory ELSA-2026-3984 vom 2026-06-11
  https://linux.oracle.com/errata/ELSA-2026-3984.html
• Oracle Linux Security Advisory ELSA-2026-8427 vom 2026-06-11
  https://linux.oracle.com/errata/ELSA-2026-8427.html
• Oracle Linux Security Advisory ELSA-2026-13977 vom 2026-06-11
  https://linux.oracle.com/errata/ELSA-2026-13977.html
• Oracle Linux Security Advisory ELSA-2026-22708 vom 2026-06-15
  https://linux.oracle.com/errata/ELSA-2026-22708.html
• Oracle Linux Security Advisory ELSA-2026-19704 vom 2026-06-16
  https://linux.oracle.com/errata/ELSA-2026-19704.html
• Oracle Linux Security Advisory ELSA-2026-54248 vom 2026-09-22
  https://linux.oracle.com/errata/ELSA-2026-54248.html
• Oracle Linux Security Advisory ELSA-2026-65442 vom 2026-11-05
  https://linux.oracle.com/errata/ELSA-2026-65442-0.html