{"id":"SUSE-SU-2026:1741-1","summary":"Security update for MozillaThunderbird","details":"This update for MozillaThunderbird fixes the following issues\n\nUpdated to Mozilla Thunderbird 140.10.1:\n\nMFSA 2026-34 (bsc#1262230):\n\n- CVE-2026-6746: Use-after-free in the DOM: Core & HTML component.\n- CVE-2026-6747: Use-after-free in the WebRTC component.\n- CVE-2026-6748: Uninitialized memory in the Audio/Video: Web Codecs component.\n- CVE-2026-6749: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component.\n- CVE-2026-6750: Privilege escalation in the Graphics: WebRender component.\n- CVE-2026-6751: Uninitialized memory in the Audio/Video: Web Codecs component.\n- CVE-2026-6752: Incorrect boundary conditions in the WebRTC component.\n- CVE-2026-6753: Incorrect boundary conditions in the WebRTC component.\n- CVE-2026-6754: Use-after-free in the JavaScript Engine component.\n- CVE-2026-6757: Invalid pointer in the JavaScript: WebAssembly component.\n- CVE-2026-6759: Use-after-free in the Widget: Cocoa component.\n- CVE-2026-6761: Privilege escalation in the Networking component.\n- CVE-2026-6762: Spoofing issue in the DOM: Core & HTML component.\n- CVE-2026-6763: Mitigation bypass in the File Handling component.\n- CVE-2026-6764: Incorrect boundary conditions in the DOM: Device Interfaces component.\n- CVE-2026-6765: Information disclosure in the Form Autofill component.\n- CVE-2026-6766: Incorrect boundary conditions in the Libraries component in NSS.\n- CVE-2026-6767: Other issue in the Libraries component in NSS.\n- CVE-2026-6769: Privilege escalation in the Debugger component.\n- CVE-2026-6770: Other issue in the Storage: IndexedDB component.\n- CVE-2026-6771: Mitigation bypass in the DOM: Security component.\n- CVE-2026-6772: Incorrect boundary conditions in the Libraries component in NSS.\n- CVE-2026-6776: Incorrect boundary conditions in the WebRTC: Networking component.\n- CVE-2026-6785: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150\n  and Thunderbird 150.\n- CVE-2026-6786: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird\n  150.\n\n\nMFSA 2026-39 (bsc#1263110):\n\n- CVE-2026-7320: Information disclosure due to incorrect boundary conditions in the Audio/Video component.\n- CVE-2026-7321: Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component.\n- CVE-2026-7322: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1.\n- CVE-2026-7323: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1.\n\nOther updates and bugfixes:\n\n- Fixed: Newly translated strings were not available in Thunderbird.\n\n","modified":"2026-05-08T08:15:28.567124Z","published":"2026-05-07T07:01:06Z","related":["CVE-2026-6746","CVE-2026-6747","CVE-2026-6748","CVE-2026-6749","CVE-2026-6750","CVE-2026-6751","CVE-2026-6752","CVE-2026-6753","CVE-2026-6754","CVE-2026-6757","CVE-2026-6759","CVE-2026-6761","CVE-2026-6762","CVE-2026-6763","CVE-2026-6764","CVE-2026-6765","CVE-2026-6766","CVE-2026-6767","CVE-2026-6769","CVE-2026-6770","CVE-2026-6771","CVE-2026-6772","CVE-2026-6776","CVE-2026-6785","CVE-2026-6786","CVE-2026-7320","CVE-2026-7321","CVE-2026-7322","CVE-2026-7323"],"upstream":["CVE-2026-6746","CVE-2026-6747","CVE-2026-6748","CVE-2026-6749","CVE-2026-6750","CVE-2026-6751","CVE-2026-6752","CVE-2026-6753","CVE-2026-6754","CVE-2026-6757","CVE-2026-6759","CVE-2026-6761","CVE-2026-6762","CVE-2026-6763","CVE-2026-6764","CVE-2026-6765","CVE-2026-6766","CVE-2026-6767","CVE-2026-6769","CVE-2026-6770","CVE-2026-6771","CVE-2026-6772","CVE-2026-6776","CVE-2026-6785","CVE-2026-6786","CVE-2026-7320","CVE-2026-7321","CVE-2026-7322","CVE-2026-7323"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261741-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1262230"},{"type":"REPORT","url":"https://bugzilla.suse.com/1263110"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6746"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6747"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6748"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6749"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6750"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6751"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6752"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6753"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6754"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6757"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6759"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6761"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6762"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6763"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6764"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6765"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6766"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6767"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6769"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6770"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6771"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6772"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6776"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6785"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6786"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-7320"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-7321"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-7322"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-7323"}],"schema_version":"1.7.5"}