{"id":"ALSA-2026:80694","summary":"Important: thunderbird security update","details":"Mozilla Thunderbird is a standalone mail and newsgroup client.  \n\nSecurity Fix(es):  \n\n  * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100832)\n  * firefox: Use-after-free in the Layout: Text and Fonts component (CVE-2026-100784)\n  * firefox: thunderbird: Privilege escalation in the DLL Services component (CVE-2026-100801)\n  * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component (CVE-2026-100794)\n  * firefox: thunderbird: Privilege escalation in the Address Bar component (CVE-2026-100820)\n  * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100777)\n  * firefox: thunderbird: Information disclosure in the Networking: JAR component (CVE-2026-100766)\n  * firefox: thunderbird: Use-after-free in the XSLT component (CVE-2026-100779)\n  * firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-100807)\n  * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-100792)\n  * firefox: Privilege escalation due to use-after-free in the Graphics: WebRender component (CVE-2026-100797)\n  * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the XPCOM component (CVE-2026-100819)\n  * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-100776)\n  * firefox: thunderbird: Use-after-free in the Widget component (CVE-2026-100757)\n  * firefox: Sandbox escape due to use-after-free in the Graphics component (CVE-2026-100786)\n  * firefox: thunderbird: Information disclosure in the Networking component (CVE-2026-96869)\n  * firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component (CVE-2026-100770)\n  * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-100769)\n  * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-100791)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component (CVE-2026-100818)\n  * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-100782)\n  * firefox: firefox: Sandbox escape via use-after-free in DOM component (CVE-2026-100811)\n  * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-100772)\n  * firefox: thunderbird: Uninitialized memory in the Storage: Quota Manager component (CVE-2026-100759)\n  * firefox: Sandbox escape due to use-after-free in the DOM: Core & HTML component (CVE-2026-100778)\n  * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-100758)\n  * firefox: thunderbird: Sandbox escape in the Graphics component (CVE-2026-100775)\n  * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-100781)\n  * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-100774)\n  * firefox: thunderbird: Same-origin policy bypass in the WebExtensions component (CVE-2026-100803)\n  * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100789)\n  * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-100785)\n  * firefox: thunderbird: Site isolation issue in the Panning and Zooming component (CVE-2026-100821)\n  * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-100788)\n  * firefox: thunderbird: Undefined behavior in the DOM: Streams component (CVE-2026-100771)\n  * firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component (CVE-2026-100762)\n  * firefox: thunderbird: Use-after-free in the XSLT component (CVE-2026-100790)\n  * firefox: thunderbird: Use-after-free in the Storage: IndexedDB component (CVE-2026-100773)\n  * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-100780)\n  * firefox: thunderbird: Use-after-free in the Networking: Cache component (CVE-2026-100767)\n  * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-100756)\n  * firefox: thunderbird: Uninitialized memory in the Audio/Video component (CVE-2026-100783)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","modified":"2026-10-26T20:12:04.082789846Z","published":"2026-10-12T00:00:00Z","related":["CVE-2026-100756","CVE-2026-100757","CVE-2026-100758","CVE-2026-100759","CVE-2026-100762","CVE-2026-100766","CVE-2026-100767","CVE-2026-100769","CVE-2026-100770","CVE-2026-100771","CVE-2026-100772","CVE-2026-100773","CVE-2026-100774","CVE-2026-100775","CVE-2026-100776","CVE-2026-100777","CVE-2026-100778","CVE-2026-100779","CVE-2026-100780","CVE-2026-100781","CVE-2026-100782","CVE-2026-100783","CVE-2026-100784","CVE-2026-100785","CVE-2026-100786","CVE-2026-100788","CVE-2026-100789","CVE-2026-100790","CVE-2026-100791","CVE-2026-100792","CVE-2026-100794","CVE-2026-100797","CVE-2026-100801","CVE-2026-100803","CVE-2026-100807","CVE-2026-100811","CVE-2026-100818","CVE-2026-100819","CVE-2026-100820","CVE-2026-100821","CVE-2026-100832","CVE-2026-96869"],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:80694"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100756"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100757"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100758"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100759"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100762"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100766"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100767"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100769"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100770"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100771"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100772"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100773"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100774"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100775"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100776"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100777"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100778"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100779"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100780"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100781"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100782"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100783"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100784"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100785"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100786"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100788"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100789"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100790"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100791"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100792"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100794"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100797"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100801"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100803"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100807"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100811"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100818"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100819"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100820"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100821"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-100832"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-96869"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2543114"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2543133"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2543142"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2543145"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2543149"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2543150"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2543154"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2543157"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2543163"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2543166"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2543182"},{"type":"ADVISORY","url":"https://errata.almalinux.org/9/ALSA-2026-80694.html"}],"affected":[{"package":{"name":"thunderbird","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/thunderbird"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.17.0-1.el9_8.alma.1"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:80694.json"}}],"schema_version":"1.9.0"}