{"id":"CLSA-2026-1787115646","summary":"thunderbird: Fix of 48 CVEs","details":"- update to 153.0.1 ESR (MFSA 2026-71)\n- drop six patches made obsolete by 153: P02 firefox-gcc-build (fixed upstream),\n  P15 build-system-nss + P16 build-tb-system-nss (both patch\n  third_party/rust/neqo-crypto, a directory 153 no longer has), P19\n  build-min-lexical, P52 exceptionHandled-for-IO-error-processhandler and P111\n  av1-else-condition-add (all upstreamed)\n- Source404 nss-3.126.0-1.el9.src.rpm is a locally rebranded Fedora artifact\n  (md5 1fc9b7b02f848fc99e06d5a8680ea5a3), rebuilt from Fedora rawhide dist-git\n  commit 43cbb021d9886d5abc3d4cb546d022929b9bb1dc (2026-07-29) whose own NVR is\n  nss-3.126.0-1; there is no public nss-3.126.0-1.el9, so the .el9 disttag\n  reflects the build target, not an upstream vendor NVR. The EL9-vs-Fedora patch\n  disposition (Alma c9 carries 29 downstream patches, Fedora 3.126 carries 14) is\n  tracked as a follow-up; NSS stays private to thunderbird either way\n- P103 mozilla-bmo1504834-part1 loses its gfx/2d/Types.h hunk: that hunk rewrote an\n  `#if MOZ_LITTLE_ENDIAN()/#elif MOZ_BIG_ENDIAN()` block which 153 replaced with\n  `A8R8G8B8_UINT32 = std::endian::native == std::endian::little ? B8G8R8A8 : A8R8G8B8`,\n  so it had nothing left to apply; on little-endian that ternary yields B8G8R8A8,\n  which is what the hunk forced. The surviving DrawTargetSkia.cpp\n  `kARGBAlphaOffset = 0` is a pre-existing Fedora-inherited override that does NOT\n  match the upstream little-endian value there (that ternary yields 3), but it sits\n  inside `#ifdef DEBUG` (gfx/2d/DrawTargetSkia.cpp:154-257) alongside\n  VerifyRGBXFormat/VerifyRGBXCorners, so it is compiled out of release builds\n  entirely and has no release impact on any arch\n- update bundled cbindgen to 0.29.4; Gecko 153 requires \u003e= 0.29.4 and the\n  previous bundle provided 0.27.0\n- update bundled NSS to 3.126.0 (with NSPR 4.39); Gecko 153 requires nss \u003e= 3.125\n  and no RHEL/AlmaLinux stream ships one (9.8 still has 3.112). Rebased on the\n  Fedora nss packaging, which tracks 3.126 with a patch set that applies cleanly;\n  the RHEL 3.112 patch set does not survive the jump. NSS stays private to\n  thunderbird under /usr/lib64/thunderbird/bundled as before -- the platform NSS is\n  untouched. Note Source403 (EL8 path) still carries 3.112.\n- fix the unsorted openssl-backend SOURCES list in comm/third_party/rnp/moz.build;\n  mozbuild requires SOURCES to be appended in sorted order and upstream only\n  exercises the botan backend, so the bug is invisible to them\n- CVE-2026-16364: Incorrect boundary conditions in the Audio/Video: Playback\n  component\n- CVE-2026-16365: Privilege escalation in the DOM: Workers component\n- CVE-2026-16366: Privilege escalation in the DOM: Navigation component\n- CVE-2026-16367: Sandbox escape due to invalid pointer in the Disability\n  Access APIs component\n- CVE-2026-16370: Mitigation bypass in the DOM: Networking component\n- CVE-2026-16372: Privilege escalation in the DOM: Content Processes component\n- CVE-2026-16376: Denial-of-service in the Graphics: WebGPU component\n- CVE-2026-16378: Other issue in the DOM: Copy & Paste and Drag & Drop\n  component\n- CVE-2026-16380: Mitigation bypass in the Networking component\n- CVE-2026-16382: Mitigation bypass in the DOM: Service Workers component\n- CVE-2026-16384: Information disclosure due to uninitialized memory in the\n  Graphics: WebGPU component\n- CVE-2026-16385: Information disclosure due to uninitialized memory in the\n  Graphics: WebGPU component\n- CVE-2026-16386: Information disclosure due to uninitialized memory in the\n  Graphics: WebGPU component\n- CVE-2026-16388: Sandbox escape in the DOM: Networking component\n- CVE-2026-16389: Incorrect boundary conditions, integer overflow in the\n  Libraries component in NSS\n- CVE-2026-16392: JIT miscompilation in the JavaScript Engine: JIT component\n- CVE-2026-16393: Incorrect boundary conditions in the Graphics: WebGPU\n  component\n- CVE-2026-16394: Mitigation bypass in the DOM: Security component\n- CVE-2026-16395: Integer overflow in the Audio/Video component\n- CVE-2026-16398: Site isolation issue in the Graphics component\n- CVE-2026-16399: Site isolation issue in the DOM: Navigation component\n- CVE-2026-16400: Information disclosure in the DOM: Security component\n- CVE-2026-16401: Privilege escalation in the Data Loss Prevention component\n- CVE-2026-16402: Integer overflow in the Graphics: ImageLib component\n- CVE-2026-16403: Spoofing issue in the Address Bar component\n- CVE-2026-16406: Mitigation bypass in the Networking component\n- CVE-2026-16407: Mitigation bypass in the DOM: Service Workers component\n- CVE-2026-16408: Integer overflow in the Audio/Video: Playback component\n- CVE-2026-16409: Invalid pointer in the Security: PSM component\n- CVE-2026-16410: JIT miscompilation in the JavaScript Engine: JIT component\n- CVE-2026-16411: Memory safety bugs fixed in Thunderbird 153","modified":"2026-10-26T09:30:32.327759862Z","published":"2026-08-20T10:20:38Z","upstream":["CVE-2026-16364","CVE-2026-16365","CVE-2026-16366","CVE-2026-16367","CVE-2026-16370","CVE-2026-16372","CVE-2026-16376","CVE-2026-16378","CVE-2026-16380","CVE-2026-16382","CVE-2026-16384","CVE-2026-16385","CVE-2026-16386","CVE-2026-16388","CVE-2026-16389","CVE-2026-16392","CVE-2026-16393","CVE-2026-16394","CVE-2026-16395","CVE-2026-16398","CVE-2026-16399","CVE-2026-16400","CVE-2026-16401","CVE-2026-16402","CVE-2026-16403","CVE-2026-16406","CVE-2026-16407","CVE-2026-16408","CVE-2026-16409","CVE-2026-16410","CVE-2026-16411"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1787115646.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10530"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10531"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4082"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4086"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4089"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4092"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5272"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8043"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8044"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0881"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0892"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12300"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12301"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12316"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12326"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16364"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16365"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16366"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16370"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16372"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16376"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16378"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16380"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16382"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16384"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16385"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16386"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16388"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16389"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16399"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16400"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16401"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16402"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16403"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16407"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16409"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16410"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2798"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2801"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2802"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2804"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4726"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4728"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6755"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6758"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6760"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6768"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6783"}],"affected":[{"package":{"name":"thunderbird","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/thunderbird?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.0.1-1.el9_2.alma.1.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1787115646.json"}}],"schema_version":"1.9.0"}