Mozilla Thunderbird: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Medium 6.5
  CVE-2026-57963

  Chat UI manipulation by injection

  An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Jul 1, 2026
• Medium 5.3
  CVE-2026-57962

  Denial-of-service via malicious LDAP address-book server

  A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplied data into the Thunderbird LDAP client until it crashes due to memory exhaustion. This vulnerabilit…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Jul 1, 2026

Revision history

1. 2026-08-17 #4

   Neue Updates von Amazon aufgenommen

2. 2026-08-09 #3

   Neue Updates von Debian aufgenommen

3. 2026-07-02 #2

   Neue Updates von openSUSE aufgenommen

4. 2026-07-01 #1

   Initiale Fassung

References

• Mozilla Security Advisory mfsa2026-63 vom 2026-07-01
  https://www.mozilla.org/en-US/security/advisories/mfsa2026-63/
• Mozilla Security Advisory mfsa2026-64 vom 2026-07-01
  https://www.mozilla.org/en-US/security/advisories/mfsa2026-64/
• openSUSE Security Update OPENSUSE-SU-2026:11164-1 vom 2026-07-02
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SHZUN5R75TWJHDEFXFND35TTL5MUUFSO/
• Debian Security Advisory DSA-6418 vom 2026-08-08
  https://security-tracker.debian.org/tracker/DSA-6418-1
• Debian Security Advisory DLA-4727 vom 2026-08-10
  https://lists.debian.org/debian-lts-announce/2026/08/msg00017.html
• Amazon Linux Security Advisory ALAS2-2026-3868 vom 2026-08-18
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3868.html