Skip to content
OpenAdvisories
High WID-SEC-2026-4064 8 CVEs

Mozilla Produkte (Thunderbird, Firefox ESR und Firefox): Mehrere Schwachstellen

Published Oct 20, 2026 · Updated Nov 12, 2026 · Revision 12 · de

Vendor: amazon Vendor: Broadcom Vendor: Debian Vendor: IGEL Vendor: Mozilla Vendor: Oracle Vendor: SUSE Product: Fabric OS Product: Firefox Product: Firefox ESR Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: openSUSE Product: OS Product: Thunderbird Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Mozilla Thunderbird, Mozilla Firefox ESR und Mozilla Firefox ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen und um Daten zu manipulieren.

Product

Thunderbird ist ein Open Source E-Mail Client.
Firefox ist ein Open Source Web Browser.
ESR ist die Variante mit verlängertem Support.
Firefox ist ein Open Source Web Browser.

Vulnerabilities 8

  • Critical 9.8
    CVE-2026-113399

    Incorrect boundary conditions in the SVG component

    Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu
  • Critical 9.1
    CVE-2026-113867

    Stanza injection in XMPP chat

    Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanza…

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  • Medium 6.5
    CVE-2026-113401

    Denial-of-service in the PDF Viewer component

    Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu
  • Medium 5.9
    CVE-2026-113866

    Account password sent unencrypted during Exchange account setup

    When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain …

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  • Medium 5.4
    CVE-2026-113400

    Uninitialized memory in the Audio/Video: cubeb component

    Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu
  • Medium 5.4
    CVE-2026-113470

    Cryptographic issue in the Security Block-lists, Allow-lists, and other State component

    Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised c…

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 5.4
    CVE-2026-113869

    Use-after-free in S/MIME decryption during a security device password prompt

    When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it wa…

    Mozilla Thunderbird thunderbird Ubuntu
  • Medium 5.3
    CVE-2026-113868

    Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication

    When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, di…

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu

Revision history

  1. #12

    Neue Updates von IGEL aufgenommen

  2. #11

    Neue Updates von openSUSE, Oracle Linux und SUSE aufgenommen

  3. #10

    Neue Updates von openSUSE aufgenommen

  4. #9

    Neue Updates von openSUSE aufgenommen

  5. #8

    Neue Updates von Amazon aufgenommen

  6. #7

    Neue Updates von SUSE aufgenommen

  7. #6

    Neue Updates von SUSE aufgenommen

  8. #5

    Neue Updates von Debian aufgenommen

  9. #4

    Neue Updates von Amazon aufgenommen

  10. #3

    Neue Updates von Oracle Linux aufgenommen

  11. #2

    Neue Updates von Debian, Oracle Linux und Mozilla aufgenommen

  12. #1

    Initiale Fassung

References