openSUSE-SU-2026:20391-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20391-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/openSUSE-SU-2026:20391-1
Upstream
CVE (52)
Related
CVE (52)
Published
2026-03-18T13:37:38Z
Modified
2026-03-26T17:24:13Z
Summary
Security update for MozillaThunderbird
Details

This update for MozillaThunderbird fixes the following issues:

Changes in MozillaThunderbird:

  • Mozilla Thunderbird 140.8.1 ESR

    • Add mail.openpgp.load_untested_gpgme_version to load untested GPGME version

  • Mozilla Thunderbird 140.8.0 ESR MFSA 2026-17 (boo#1258568)

    • CVE-2026-2757 (bmo#2001637) Incorrect boundary conditions in the WebRTC: Audio/Video component
    • CVE-2026-2758 (bmo#2009608) Use-after-free in the JavaScript: GC component
    • CVE-2026-2759 (bmo#2010933) Incorrect boundary conditions in the Graphics: ImageLib component
    • CVE-2026-2760 (bmo#2011062) Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
    • CVE-2026-2761 (bmo#2011063) Sandbox escape in the Graphics: WebRender component
    • CVE-2026-2762 (bmo#2011649) Integer overflow in the JavaScript: Standard Library component
    • CVE-2026-2763 (bmo#2012018) Use-after-free in the JavaScript Engine component
    • CVE-2026-2764 (bmo#2012608) JIT miscompilation, use-after-free in the JavaScript Engine: JIT component
    • CVE-2026-2765 (bmo#2013562) Use-after-free in the JavaScript Engine component
    • CVE-2026-2766 (bmo#2013583) Use-after-free in the JavaScript Engine: JIT component
    • CVE-2026-2767 (bmo#2013741) Use-after-free in the JavaScript: WebAssembly component
    • CVE-2026-2768 (bmo#2014101) Sandbox escape in the Storage: IndexedDB component
    • CVE-2026-2769 (bmo#2014550) Use-after-free in the Storage: IndexedDB component
    • CVE-2026-2770 (bmo#2014585) Use-after-free in the DOM: Bindings (WebIDL) component
    • CVE-2026-2771 (bmo#2014593) Undefined behavior in the DOM: Core & HTML component
    • CVE-2026-2772 (bmo#2014827) Use-after-free in the Audio/Video: Playback component
    • CVE-2026-2773 (bmo#2014832) Incorrect boundary conditions in the Web Audio component
    • CVE-2026-2774 (bmo#2014883) Integer overflow in the Audio/Video component
    • CVE-2026-2775 (bmo#2015199) Mitigation bypass in the DOM: HTML Parser component
    • CVE-2026-2776 (bmo#2015266) Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software
    • CVE-2026-2777 (bmo#2015305) Privilege escalation in the Messaging System component
    • CVE-2026-2778 (bmo#2016358) Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component
    • CVE-2026-2779 (bmo#1164141) Incorrect boundary conditions in the Networking: JAR component
    • CVE-2026-2780 (bmo#2007829) Privilege escalation in the Netmonitor component
    • CVE-2026-2781 (bmo#2009552) Integer overflow in the Libraries component in NSS
    • CVE-2026-2782 (bmo#2010743) Privilege escalation in the Netmonitor component
    • CVE-2026-2783 (bmo#2010943) Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component
    • CVE-2026-2784 (bmo#2012984) Mitigation bypass in the DOM: Security component
    • CVE-2026-2785 (bmo#2013549) Invalid pointer in the JavaScript Engine component
    • CVE-2026-2786 (bmo#2013612) Use-after-free in the JavaScript Engine component
    • CVE-2026-2787 (bmo#2014560) Use-after-free in the DOM: Window and Location component
    • CVE-2026-2788 (bmo#2014824) Incorrect boundary conditions in the Audio/Video: GMP component
    • CVE-2026-2789 (bmo#2015179) Use-after-free in the Graphics: ImageLib component
    • CVE-2026-2790 (bmo#2008426) Same-origin policy bypass in the Networking: JAR component
    • CVE-2026-2791 (bmo#2015220) Mitigation bypass in the Networking: Cache component
    • CVE-2026-2792 (bmo#2008912, bmo#2010050, bmo#2010275, bmo#2012331) Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148
    • CVE-2026-2793 (bmo#2015196, bmo#2016423, bmo#2016498) Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148

  • Mozilla Thunderbird 140.7.2 ESR MFSA 2026-11 (boo#1258231)

    • CVE-2026-2447 (bmo#2014390) Heap buffer overflow in libvpx

  • Mozilla Thunderbird 140.7.1 ESR MFSA 2026-08 (bsc#1257397)

    • CVE-2026-0818 (bmo#1881530) CSS-based exfiltration of the content from partially encrypted emails when allowing remote content

  • Support using system GnuPG with gpgme 2, boo#1253718

  • Mozilla Thunderbird 140.7.0 ESR MFSA 2026-05 (bsc#1256340)

    • CVE-2026-0877 (bmo#1999257) Mitigation bypass in the DOM: Security component
    • CVE-2026-0878 (bmo#2003989) Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
    • CVE-2026-0879 (bmo#2004602) Sandbox escape due to incorrect boundary conditions in the Graphics component
    • CVE-2026-0880 (bmo#2005014) Sandbox escape due to integer overflow in the Graphics component
    • CVE-2026-0882 (bmo#1924125) Use-after-free in the IPC component
    • CVE-2025-14327 (bmo#1970743) Spoofing issue in the Downloads Panel component
    • CVE-2026-0883 (bmo#1989340) Information disclosure in the Networking component
    • CVE-2026-0884 (bmo#2003588) Use-after-free in the JavaScript Engine component
    • CVE-2026-0885 (bmo#2003607) Use-after-free in the JavaScript: GC component
    • CVE-2026-0886 (bmo#2005658) Incorrect boundary conditions in the Graphics component
    • CVE-2026-0887 (bmo#2006500) Clickjacking issue, information disclosure in the PDF Viewer component
    • CVE-2026-0890 (bmo#2005081) Spoofing issue in the DOM: Copy & Paste and Drag & Drop component
    • CVE-2026-0891 (bmo#1964722, bmo#2000981, bmo#2003100, bmo#2003278) Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147
References

Affected packages

openSUSE:Leap 16.0 / MozillaThunderbird

Package

Name
MozillaThunderbird
Purl
pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
140.8.1-bp160.1.1

Ecosystem specific 

{
    "binaries": [
        {
            "MozillaThunderbird": "140.8.1-bp160.1.1",
            "MozillaThunderbird-openpgp-librnp": "140.8.1-bp160.1.1",
            "MozillaThunderbird-translations-common": "140.8.1-bp160.1.1",
            "MozillaThunderbird-translations-other": "140.8.1-bp160.1.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20391-1.json"