{"id":"CVE-2026-113869","aliases":["EUVD-2026-105296","GHSA-2xmq-c4ch-m4cp","MGASA-2026-0583","UBUNTU-CVE-2026-113869","openSUSE-SU-2026:12339-1"],"status":"published","title":"Use-after-free in S/MIME decryption during a security device password prompt","description":"When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.6.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0033,"percentile":0.26531,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-416"],"published":"2026-10-20T19:14:55Z","modified":"2026-11-10T05:45:03Z","affected":[{"source":"osv","ecosystem":"Mageia:10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-1.mga10"}]}],"bundled":154},{"source":"osv","ecosystem":"Mageia:10","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-1.mga10"}]}],"bundled":154},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1","1:91.11.0+build2-0ubuntu0.22.04.1","1:102.2.2+build1-0ubuntu0.22.04.1","1:102.4.2+build2-0ubuntu0.22.04.1","1:102.7.1+build2-0ubuntu0.22.04.1","1:102.8.0+build2-0ubuntu0.22.04.1","1:102.9.0+build1-0ubuntu0.22.04.1","1:102.10.0+build2-0ubuntu0.22.04.1","1:102.11.0+build1-0ubuntu0.22.04.1","1:102.13.0+build1-0ubuntu0.22.04.1","1:102.15.0+build1-0ubuntu0.22.04.1","1:102.15.1+build1-0ubuntu0.22.04.1","1:115.3.1+build1-0ubuntu0.22.04.2","1:115.4.1+build1-0ubuntu0.22.04.1","1:115.5.0+build1-0ubuntu0.22.04.1","1:115.6.0+build2-0ubuntu0.22.04.1","1:115.8.1+build1-0ubuntu0.22.04.1","1:115.9.0+build1-0ubuntu0.22.04.1","1:115.10.1+build1-0ubuntu0.22.04.1","1:115.11.0+build2-0ubuntu0.22.04.1","1:115.12.0+build3-0ubuntu0.22.04.1","1:115.13.0+build5-0ubuntu0.22.04.1","1:115.15.0+build1-0ubuntu0.22.04.1","1:115.16.0+build2-0ubuntu0.22.04.1","1:115.18.0+build1-0ubuntu0.22.04.1","1:128.12.0+build1-0ubuntu0.22.04.1","1:140.7.1+build1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:115.3.1+build1-0ubuntu1","1:115.4.1+build1-0ubuntu1","1:115.4.3+build1-0ubuntu1","1:115.5.0+build1-0ubuntu1","1:115.5.1+build1-0ubuntu1","1:115.5.2+build2-0ubuntu1","1:115.6.0+build1-0ubuntu1","1:115.6.0+build2-0ubuntu1","1:115.6.1+build1-0ubuntu1","1:115.8.0+build1-0ubuntu1","1:115.8.1+build1+snap2","1:115.8.1+build1+snap3","2:1snap1-0ubuntu1","2:1snap1-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu3","2:1snap1-0ubuntu4","2:1snap1-0ubuntu5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-1.1"}]}],"bundled":153}],"products":[{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2075530"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-114/"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-122/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113869"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-114"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-122"},{"url":"https://github.com/advisories/GHSA-2xmq-c4ch-m4cp"},{"url":"https://advisories.mageia.org/MGASA-2026-0583.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36593","tags":["report"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/153.6.0esr/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-122/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-113869","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-113869","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-114/#CVE-2026-113869","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-113869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118175","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-118180","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-113869","title":"Use-after-free in S/MIME decryption during a security device password prompt","description":"When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.6.","status":"published","published":"2026-10-20T19:14:55.862Z","modified":"2026-10-27T18:30:32.292Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T13:44:29.519518Z"}],"euvd":[{"id":"EUVD-2026-105296","description":"When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.6.","status":"published","published":"2026-10-20T19:14:55Z","modified":"2026-10-27T18:30:32Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:59:22.397015Z"}],"ghsa":[{"id":"GHSA-2xmq-c4ch-m4cp","title":"When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary...","description":"When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1.","status":"published","published":"2026-10-20T21:31:02Z","modified":"2026-10-27T21:34:31Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:14:31.259641Z"}],"nvd":[{"id":"CVE-2026-113869","description":"When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.6.","status":"published","published":"2026-10-20T20:17:19.86Z","modified":"2026-10-27T19:17:10.433Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:13:01.161484Z"}],"osv":[{"id":"UBUNTU-CVE-2026-113869","description":"When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.6.","status":"published","published":"2026-10-20T20:17:00Z","modified":"2026-10-28T20:17:44.965159632Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:59.591851Z"},{"id":"MGASA-2026-0583","title":"Updated thunderbird package fixes security vulnerabilities","description":"Displaying a message could load an attacker-chosen URL through an\nOpenPGP key attachment. (CVE-2026-118174)\nContent of other messages could be included when replying to a crafted\nmessage. (CVE-2026-118175)\nBypass of remote UNC path restriction in mailbox: URLs.\n(CVE-2026-118176)\nCalendar discovery accepted local file and remote network share\nlocations. (CVE-2026-118177)\nRSS feed could redirect its subscription to a local file or network\nshare. (CVE-2026-118178)\nRequest forgery via news: links. (CVE-2026-118179)\nMatrix homeserver could redirect the chat session to a local file or\nnetwork share. (CVE-2026-118180)\nInteger overflow in libmime buffer growth could lead to heap corruption.\n(CVE-2026-110247)\nUse-after-free in S/MIME decryption during a security device password\nprompt. (CVE-2026-113869)\nSame-origin policy bypass in the DOM: Navigation component.\n(CVE-2026-117860)\nSandbox escape in the DOM: Navigation component. (CVE-2026-117861)\nPrivilege escalation due to incorrect boundary conditions in the\nNetworking component. (CVE-2026-117862)\nInformation disclosure due to uninitialized memory in the Audio/Video\ncomponent. (CVE-2026-117863)\nSandbox escape in the Form Manager component. (CVE-2026-117864)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117865)\nPrivilege escalation due to use-after-free in the Graphics: Canvas2D\ncomponent. (CVE-2026-117866)\nUse-after-free in the Layout component. (CVE-2026-117867)\nSandbox escape in the DOM: Networking component. (CVE-2026-117868)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117869)\nUse-after-free in the JavaScript Engine component. (CVE-2026-117870)\nInvalid pointer in the Graphics component. (CVE-2026-117871)\nUse-after-free in the JavaScript: Standard Library component.\n(CVE-2026-117872)\nIncorrect boundary conditions in the Audio/Video: Playback component.\n(CVE-2026-117873)\nUse-after-free in the Internationalization component. (CVE-2026-117874)\nUse-after-free in the Layout: Scrolling and Overflow component.\n(CVE-2026-117875)\nUse-after-free in the Layout: Text and Fonts component.\n(CVE-2026-117876)\nUse-after-free in the Layout: Text and Fonts component.\n(CVE-2026-117877)\nOther issue, use-after-free in the Storage: IndexedDB component.\n(CVE-2026-117878)\nIncorrect boundary conditions in the Layout: Tables component.\n(CVE-2026-117879)\nUse-after-free in the XML component. (CVE-2026-117880)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117881)\nUse-after-free in the Layout component. (CVE-2026-117882)\nUse-after-free in the DOM: HTML Parser component. (CVE-2026-117883)\nUse-after-free in the Networking component. (CVE-2026-117884)\nUse-after-free in the Layout: Grid component. (CVE-2026-117885)\nIncorrect boundary conditions in the Graphics: Text component.\n(CVE-2026-117886)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117887)\nUninitialized memory in the Graphics: Canvas2D component.\n(CVE-2026-117888)\nIncorrect boundary conditions in the JavaScript Engine component.\n(CVE-2026-117889)\nJIT miscompilation in the JavaScript Engine: JIT component.\n(CVE-2026-117890)\nUse-after-free in the JavaScript Engine: JIT component.\n(CVE-2026-117891)\nPrivilege escalation due to use-after-free in the WebRTC: Networking\ncomponent. (CVE-2026-117892)\nIncorrect boundary conditions in the Security: PSM component.\n(CVE-2026-117893)\nIncorrect boundary conditions in the WebRTC: Signaling component.\n(CVE-2026-117894)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117895)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117896)\nIncorrect boundary conditions in the Layout: Tables component.\n(CVE-2026-117897)\nUse-after-free in the JavaScript Engine: JIT component.\n(CVE-2026-117898)\nUse-after-free in the Networking: HTTP component. (CVE-2026-117899)\nUse-after-free in the DOM: Editor component. (CVE-2026-117900)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117901)\nUse-after-free in the Layout: Text and Fonts component.\n(CVE-2026-117902)\nUse-after-free in the Audio/Video component. (CVE-2026-117903)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117904)\nUse-after-free in the Audio/Video: Playback component. (CVE-2026-117905)\nUse-after-free in the CSS Parsing and Computation component.\n(CVE-2026-117906)\nUse-after-free in the Networking component. (CVE-2026-117907)\nUse-after-free in the Graphics: ImageLib component. (CVE-2026-117908)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117909)\nInvalid pointer in the JavaScript Engine component. (CVE-2026-117910)\nUse-after-free in the Audio/Video: Playback component. (CVE-2026-117911)\nSame-origin policy bypass in the CSS Parsing and Computation component.\n(CVE-2026-117912)\nUse-after-free in the SVG component. (CVE-2026-117913)\nUse-after-free in the SVG component. (CVE-2026-117914)\nIncorrect boundary conditions in the Layout: Block and Inline component.\n(CVE-2026-117915)\nUse-after-free in the XSLT component. (CVE-2026-117916)\nInvalid pointer in the Graphics: WebRender component. (CVE-2026-117917)\nUse-after-free in the Graphics: Canvas2D component. (CVE-2026-117918)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117919)\nUse-after-free in the DOM: HTML Parser component. (CVE-2026-117920)\nUse-after-free in the CSS Parsing and Computation component.\n(CVE-2026-117921)\nUse-after-free in the Networking: WebSockets component.\n(CVE-2026-117922)\nUse-after-free in the Audio/Video component. (CVE-2026-117923)\nUse-after-free in the XSLT component. (CVE-2026-117924)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117925)\nIncorrect boundary conditions in the SVG component. (CVE-2026-117926)\nUse-after-free in the SVG component. (CVE-2026-117927)\nSame-origin policy bypass in the CSS Parsing and Computation component.\n(CVE-2026-117928)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117929)\nUse-after-free in the DOM: Bindings (WebIDL) component.\n(CVE-2026-117930)\nUse-after-free in the DOM: Events component. (CVE-2026-117931)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117932)\nFrame poisoning in the CSS Parsing and Computation component.\n(CVE-2026-117933)\nUse-after-free in the Layout component. (CVE-2026-117934)\nUse-after-free in the DOM: Bindings (WebIDL) component.\n(CVE-2026-117935)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117936)\nInvalid pointer in the JavaScript Engine component. (CVE-2026-117937)\nUse-after-free in the Layout component. (CVE-2026-117938)\nUse-after-free in the XML component. (CVE-2026-117939)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117940)\nUse-after-free in the DOM: CSS Object Model component. (CVE-2026-117941)\nIncorrect boundary conditions in the JavaScript Engine: JIT component.\n(CVE-2026-117942)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117943)\nUse-after-free in the Layout component. (CVE-2026-117944)\nIncorrect boundary conditions in the XML component. (CVE-2026-117945)\nIncorrect boundary conditions in the JavaScript Engine component.\n(CVE-2026-117946)\nUse-after-free in the XML component. (CVE-2026-117947)\nUse-after-free in the SVG component. (CVE-2026-117948)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117949)\nIncorrect boundary conditions in the DOM: Core \u0026 HTML component.\n(CVE-2026-117950)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117951)\nUninitialized memory in the Networking component. (CVE-2026-117952)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117953)\nUse-after-free in the Layout: Positioned component. (CVE-2026-117954)\nJIT miscompilation in the JavaScript: WebAssembly component.\n(CVE-2026-117955)\nPrivilege escalation in the DLL Services component. (CVE-2026-100801)\nInvalid pointer in the Nimbus Desktop Client component.\n(CVE-2026-117956)\nCryptographic issue in the WebRTC: Networking component.\n(CVE-2026-117957)\nSite isolation issue in the Networking: HTTP component.\n(CVE-2026-117958)\nSite isolation issue in the DOM: Service Workers component.\n(CVE-2026-117959)\nSpoofing issue in the DOM: Core \u0026 HTML component. (CVE-2026-117960)\nIncorrect boundary conditions in the Layout: Text and Fonts component.\n(CVE-2026-117961)\nSandbox escape due to incorrect boundary conditions in the Storage:\nQuota Manager component. (CVE-2026-117962)\nIncorrect boundary conditions in the DOM: Service Workers component.\n(CVE-2026-117963)\nUse-after-free in the Panning and Zooming component. (CVE-2026-117964)\nSame-origin policy bypass in the Address Bar component.\n(CVE-2026-117965)\nSite isolation issue in the Networking: HTTP component.\n(CVE-2026-117966)\nMitigation bypass in the DOM: Security component. (CVE-2026-117967)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-117968)\nInvalid pointer in the JavaScript Engine: JIT component.\n(CVE-2026-117969)\nRace condition in the Disability Access APIs component.\n(CVE-2026-117970)\nSandbox escape due to use-after-free in the Print Preview component.\n(CVE-2026-117971)\nUse-after-free in the Graphics component. (CVE-2026-117972)\nUse-after-free in the Networking: DNS component. (CVE-2026-117973)\nUse-after-free in the XML component. (CVE-2026-117974)\nSandbox escape due to invalid pointer in the Graphics: WebRender\ncomponent. (CVE-2026-117975)\nSite isolation issue in the DOM: Navigation component. (CVE-2026-117976)\nOther issue in the Console component. (CVE-2026-117977)\nIncorrect boundary conditions in the Graphics component.\n(CVE-2026-117978)\nIncorrect boundary conditions in the Graphics: WebRender component.\n(CVE-2026-117979)\nUse-after-free in the Graphics component. (CVE-2026-117980)\nPrivilege escalation in the Toolkit component. (CVE-2026-117981)\nInvalid pointer in the JavaScript Engine: JIT component.\n(CVE-2026-117982)\nUse-after-free in the Graphics component. (CVE-2026-117983)\nIncorrect boundary conditions in the Layout: Scrolling and Overflow\ncomponent. (CVE-2026-117984)\nSandbox escape due to use-after-free in the Graphics component.\n(CVE-2026-117985)\nUse-after-free in the Graphics component. (CVE-2026-117986)\nUse-after-free in the Graphics component. (CVE-2026-117987)\nSandbox escape due to incorrect boundary conditions in the Graphics:\nCanvasWebGL component. (CVE-2026-117988)\nUse-after-free in the Graphics component. (CVE-2026-117989)\nSandbox escape due to incorrect boundary conditions in the Graphics:\nWebRender component. (CVE-2026-117990)\nIncorrect boundary conditions in the Layout: Text and Fonts component.\n(CVE-2026-117991)\nInformation disclosure in the CSS Parsing and Computation component.\n(CVE-2026-117992)\nInteger overflow in the Graphics: Text component. (CVE-2026-117993)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117994)\nPrivilege escalation in the DOM: UI Events \u0026 Focus Handling component.\n(CVE-2026-117995)\nIncorrect boundary conditions in the WebRTC component. (CVE-2026-117996)\nSandbox escape due to use-after-free in the Widget component.\n(CVE-2026-117997)\nMitigation bypass in the DOM: Push Subscriptions component.\n(CVE-2026-117998)\nRace condition in the IPC component. (CVE-2026-117999)\nInformation disclosure in the Networking: HTTP component.\n(CVE-2026-118000)\nInformation disclosure due to race condition in the Networking\ncomponent. (CVE-2026-118002)\nInformation disclosure in the Networking: DNS component.\n(CVE-2026-118003)\nIncorrect boundary conditions in the CSS Transitions and Animations\ncomponent. (CVE-2026-118004)\n","status":"published","published":"2026-11-09T16:32:57Z","modified":"2026-11-10T05:45:03.377121818Z","updated_at":"2026-11-10T05:53:01.608209Z"},{"id":"openSUSE-SU-2026:12339-1","title":"MozillaThunderbird-153.6.0-1.1 on GA media","description":"These are all security issues fixed in the MozillaThunderbird-153.6.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-31T18:00:07.691910442Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}