{"id":"SUSE-SU-2026:4627-1","summary":"Security update for MozillaThunderbird","details":"This update for MozillaThunderbird fixes the following issues:\n\nUpdate to Mozilla Thunderbird 153.4 (MFSA 2026-96, MFSA 2026-103, bsc#1280371, bsc#1282929):\n\n- CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component.\n- CVE-2026-92006: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.\n- CVE-2026-92007: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.\n- CVE-2026-92008: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.\n- CVE-2026-92009: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.\n- CVE-2026-92010: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.\n- CVE-2026-92011: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.\n- CVE-2026-92012: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.\n- CVE-2026-92013: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.\n- CVE-2026-92015: Privilege escalation in the WebExtensions component.\n- CVE-2026-92016: Use-after-free in the Disability Access APIs component.\n- CVE-2026-92017: Privilege escalation in the DOM: Service Workers component.\n- CVE-2026-92018: Sandbox escape in the DOM: Core & HTML component.\n- CVE-2026-92019: Mitigation bypass in the Remote Settings Client component.\n- CVE-2026-92020: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component.\n- CVE-2026-92022: Use-after-free in the DOM: HTML Parser component.\n- CVE-2026-92023: Use-after-free in the XML component.\n- CVE-2026-92024: Use-after-free in the SVG component.\n- CVE-2026-92025: Use-after-free in the DOM: Navigation component.\n- CVE-2026-92026: Use-after-free in the Networking component.\n- CVE-2026-92027: Use-after-free in the DOM: Streams component.\n- CVE-2026-92028: Use-after-free in the DOM: Core & HTML component.\n- CVE-2026-92029: Use-after-free in the SVG component.\n- CVE-2026-92030: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component.\n- CVE-2026-92031: Information disclosure in the Graphics: ImageLib component.\n- CVE-2026-92032: Sandbox escape due to invalid pointer in the Graphics component.\n- CVE-2026-92035: Sandbox escape due to incorrect boundary conditions in the Graphics component.\n- CVE-2026-92038: Mitigation bypass in the Remote Settings Client component.\n- CVE-2026-92039: Mitigation bypass in the DOM: Notifications component.\n- CVE-2026-92041: Mitigation bypass in the DOM: Networking component.\n- CVE-2026-92042: Race condition in the DOM: Content Processes component.\n- CVE-2026-92043: Privilege escalation due to incorrect boundary conditions in the Audio/Video component.\n- CVE-2026-92044: Information disclosure in the Networking: HTTP component.\n- CVE-2026-92045: Sandbox escape due to incorrect boundary conditions in the WebRTC component.\n- CVE-2026-92046: Use-after-free in the Graphics component.\n- CVE-2026-92047: Privilege escalation in the Crash Reporting component.\n- CVE-2026-92048: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.\n- CVE-2026-92049: Use-after-free in the Widget: Win32 component.\n- CVE-2026-92052: Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component.\n- CVE-2026-92053: Privilege escalation in the Graphics: CanvasWebGL component.\n- CVE-2026-92054: Privilege escalation in the Memory component.\n- CVE-2026-92055: Privilege escalation in the DevTools component.\n- CVE-2026-92056: Use-after-free in the Graphics: Text component.\n- CVE-2026-92057: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-92058: Use-after-free in the Graphics component.\n- CVE-2026-92059: Incorrect boundary conditions in the DOM: Editor component.\n- CVE-2026-92060: Use-after-free in the Internationalization component.\n- CVE-2026-92062: Privilege escalation in the Session Restore component.\n- CVE-2026-92064: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.\n- CVE-2026-92065: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.\n- CVE-2026-92067: Use-after-free in the Widget: Gtk component.\n- CVE-2026-92068: Site isolation issue in the Reader Mode component.\n- CVE-2026-92069: Spoofing issue in the DOM: Navigation component.\n- CVE-2026-92070: Information disclosure in the Networking component.\n- CVE-2026-92071: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.\n- CVE-2026-92072: Incorrect boundary conditions in the Safe Browsing component.\n- CVE-2026-92073: Privilege escalation in the Enterprise Policies component.\n- CVE-2026-92074: Mitigation bypass in the Popup Blocker component.\n- CVE-2026-92075: Mitigation bypass in the Networking component.\n- CVE-2026-92076: Incorrect boundary conditions in the Networking component.\n- CVE-2026-92077: Denial-of-service in the SVG component.\n- CVE-2026-92078: Denial-of-service in the Security component.\n- CVE-2026-92079: Mitigation bypass in the Widget: Win32 component.\n- CVE-2026-92238: Ambiguous parsing of mail headers.\n- CVE-2026-92239: Buffer overrun in IMAP.\n- CVE-2026-92240: Out-of-bounds read in IMAP response parser.\n- CVE-2026-96869: Information disclosure in the Networking component.\n- CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback component.\n- CVE-2026-100757: Use-after-free in the Widget component.\n- CVE-2026-100758: Sandbox escape in the DOM: Navigation component.\n- CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager component.\n- CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing component.\n- CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content Processes component.\n- CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component.\n- CVE-2026-100766: Information disclosure in the Networking: JAR component.\n- CVE-2026-100767: Use-after-free in the Networking: Cache component.\n- CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component.\n- CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content Processes component.\n- CVE-2026-100771: Undefined behavior in the DOM: Streams component.\n- CVE-2026-100772: Use-after-free in the DOM: Core & HTML component.\n- CVE-2026-100773: Use-after-free in the Storage: IndexedDB component.\n- CVE-2026-100774: Use-after-free in the DOM: Core & HTML component.\n- CVE-2026-100775: Sandbox escape in the Graphics component.\n- CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component.\n- CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core & HTML component.\n- CVE-2026-100779: Use-after-free in the XSLT component.\n- CVE-2026-100780: Use-after-free in the DOM: Core & HTML component.\n- CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component.\n- CVE-2026-100782: Privilege escalation due to incorrect boundary conditions in the Graphics component.\n- CVE-2026-100783: Uninitialized memory in the Audio/Video component.\n- CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component.\n- CVE-2026-100785: Use-after-free in the DOM: Core & HTML component.\n- CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics component.\n- CVE-2026-100787: Sandbox escape in the XUL component.\n- CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component.\n- CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-100790: Use-after-free in the XSLT component.\n- CVE-2026-100791: Use-after-free in the DOM: Core & HTML component.\n- CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly component.\n- CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the Internationalization component.\n- CVE-2026-100797: Privilege escalation due to use-after-free in the Graphics: WebRender component.\n- CVE-2026-100798: Cryptography misuse in Storage: Quota Manager component.\n- CVE-2026-100800: Sandbox escape due to use-after-free in the Disability Access APIs component.\n- CVE-2026-100801: Privilege escalation in the DLL Services component.\n- CVE-2026-100803: Same-origin policy bypass in the WebExtensions component.\n- CVE-2026-100806: Uninitialized memory in the Graphics: WebGPU component.\n- CVE-2026-100807: Privilege escalation in the DOM: Service Workers component.\n- CVE-2026-100808: Mitigation bypass in the DOM: Service Workers component.\n- CVE-2026-100809: Same-origin policy bypass in the DevTools component.\n- CVE-2026-100811: Sandbox escape due to use-after-free in the DOM: Core & HTML component.\n- CVE-2026-100812: Denial-of-service in the Graphics component.\n- CVE-2026-100814: Incorrect boundary conditions in the JavaScript Engine: JIT component.\n- CVE-2026-100815: Use-after-free in the CSS Parsing and Computation component.\n- CVE-2026-100816: Site isolation issue in the DOM: Networking component.\n- CVE-2026-100818: Sandbox escape due to use-after-free in the Widget: Gtk component.\n- CVE-2026-100819: Sandbox escape due to incorrect boundary conditions in the XPCOM component.\n- CVE-2026-100820: Privilege escalation in the Address Bar component.\n- CVE-2026-100821: Site isolation issue in the Panning and Zooming component.\n- CVE-2026-100822: Spoofing issue in the Networking: HTTP component.\n- CVE-2026-100824: Privilege escalation in the Places component.\n- CVE-2026-100825: Use-after-free in the JavaScript Engine: JIT component.\n- CVE-2026-100826: Denial-of-service in the Storage: StorageManager component.\n- CVE-2026-100828: Mitigation bypass in the Bookmarks & History component.\n- CVE-2026-100829: Mitigation bypass in the DOM: Security component.\n- CVE-2026-100830: Mitigation bypass in the DOM: Navigation component.\n- CVE-2026-100831: Use-after-free in the DOM: UI Events & Focus Handling component.\n- CVE-2026-100832: Use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-103500: Heap buffer overflow opening large email.\n\nChanges for MozillaThunderbird:\n\n * changed: RNP command-line utilities are no longer included\n with Thunderbird (bmo#2068130)\n * changed: Thundermail built-in add-on updated to v2.0.16\n (bmo#2071989)\n * fixed: Ctrl+Shift+K could fail to open the Quick Filter UI\n (bmo#2062942)\n * fixed: Nested S/MIME signed parts could fail to render\n (bmo#2062971)\n * fixed: Thunderbird could hang when waiting for IMAP server\n greeting during account setup (bmo#2028760)\n * fixed: Gmail OAuth2 authentication could intermittently fail\n on Windows (bmo#2063816)\n * fixed: `AppUpdatePin` policy did not prevent Thunderbird from\n updating beyond pinned version (bmo#1910603)\n * fixed: 'What's New?' linked to Release channel notes instead\n of ESR release notes (bmo#2073813)\n * fixed: Detached attachment links were truncated when folder\n path contained `&` (bmo#2060451)\n * fixed: Save All, Detach All, and Delete All failed after\n deleting one attachment (bmo#2057025)\n * fixed: Blank 1970-dated messages could appear from incomplete\n message file copies (bmo#209501)\n * fixed: Forwarded messages could display incorrect encoding\n (bmo#2059963)\n * fixed: Manual Get Messages failed after startup until\n toggling offline mode (bmo#2057431)\n * fixed: Thunderbird could crash on shutdown while waiting for\n OAuth2 password entry (bmo#1524247)\n","modified":"2026-10-13T10:30:05.948962102Z","published":"2026-10-12T14:57:41Z","related":["CVE-2026-100756","CVE-2026-100757","CVE-2026-100758","CVE-2026-100759","CVE-2026-100760","CVE-2026-100762","CVE-2026-100765","CVE-2026-100766","CVE-2026-100767","CVE-2026-100769","CVE-2026-100770","CVE-2026-100771","CVE-2026-100772","CVE-2026-100773","CVE-2026-100774","CVE-2026-100775","CVE-2026-100776","CVE-2026-100777","CVE-2026-100778","CVE-2026-100779","CVE-2026-100780","CVE-2026-100781","CVE-2026-100782","CVE-2026-100783","CVE-2026-100784","CVE-2026-100785","CVE-2026-100786","CVE-2026-100787","CVE-2026-100788","CVE-2026-100789","CVE-2026-100790","CVE-2026-100791","CVE-2026-100792","CVE-2026-100794","CVE-2026-100797","CVE-2026-100798","CVE-2026-100800","CVE-2026-100801","CVE-2026-100803","CVE-2026-100806","CVE-2026-100807","CVE-2026-100808","CVE-2026-100809","CVE-2026-100811","CVE-2026-100812","CVE-2026-100814","CVE-2026-100815","CVE-2026-100816","CVE-2026-100818","CVE-2026-100819","CVE-2026-100820","CVE-2026-100821","CVE-2026-100822","CVE-2026-100824","CVE-2026-100825","CVE-2026-100826","CVE-2026-100828","CVE-2026-100829","CVE-2026-100830","CVE-2026-100831","CVE-2026-100832","CVE-2026-103500","CVE-2026-92005","CVE-2026-92006","CVE-2026-92007","CVE-2026-92008","CVE-2026-92009","CVE-2026-92010","CVE-2026-92011","CVE-2026-92012","CVE-2026-92013","CVE-2026-92015","CVE-2026-92016","CVE-2026-92017","CVE-2026-92018","CVE-2026-92019","CVE-2026-92020","CVE-2026-92022","CVE-2026-92023","CVE-2026-92024","CVE-2026-92025","CVE-2026-92026","CVE-2026-92027","CVE-2026-92028","CVE-2026-92029","CVE-2026-92030","CVE-2026-92031","CVE-2026-92032","CVE-2026-92035","CVE-2026-92038","CVE-2026-92039","CVE-2026-92041","CVE-2026-92042","CVE-2026-92043","CVE-2026-92044","CVE-2026-92045","CVE-2026-92046","CVE-2026-92047","CVE-2026-92048","CVE-2026-92049","CVE-2026-92052","CVE-2026-92053","CVE-2026-92054","CVE-2026-92055","CVE-2026-92056","CVE-2026-92057","CVE-2026-92058","CVE-2026-92059","CVE-2026-92060","CVE-2026-92062","CVE-2026-92064","CVE-2026-92065","CVE-2026-92067","CVE-2026-92068","CVE-2026-92069","CVE-2026-92070","CVE-2026-92071","CVE-2026-92072","CVE-2026-92073","CVE-2026-92074","CVE-2026-92075","CVE-2026-92076","CVE-2026-92077","CVE-2026-92078","CVE-2026-92079","CVE-2026-92238","CVE-2026-92239","CVE-2026-92240","CVE-2026-96869"],"upstream":["CVE-2026-100756","CVE-2026-100757","CVE-2026-100758","CVE-2026-100759","CVE-2026-100760","CVE-2026-100762","CVE-2026-100765","CVE-2026-100766","CVE-2026-100767","CVE-2026-100769","CVE-2026-100770","CVE-2026-100771","CVE-2026-100772","CVE-2026-100773","CVE-2026-100774","CVE-2026-100775","CVE-2026-100776","CVE-2026-100777","CVE-2026-100778","CVE-2026-100779","CVE-2026-100780","CVE-2026-100781","CVE-2026-100782","CVE-2026-100783","CVE-2026-100784","CVE-2026-100785","CVE-2026-100786","CVE-2026-100787","CVE-2026-100788","CVE-2026-100789","CVE-2026-100790","CVE-2026-100791","CVE-2026-100792","CVE-2026-100794","CVE-2026-100797","CVE-2026-100798","CVE-2026-100800","CVE-2026-100801","CVE-2026-100803","CVE-2026-100806","CVE-2026-100807","CVE-2026-100808","CVE-2026-100809","CVE-2026-100811","CVE-2026-100812","CVE-2026-100814","CVE-2026-100815","CVE-2026-100816","CVE-2026-100818","CVE-2026-100819","CVE-2026-100820","CVE-2026-100821","CVE-2026-100822","CVE-2026-100824","CVE-2026-100825","CVE-2026-100826","CVE-2026-100828","CVE-2026-100829","CVE-2026-100830","CVE-2026-100831","CVE-2026-100832","CVE-2026-103500","CVE-2026-92005","CVE-2026-92006","CVE-2026-92007","CVE-2026-92008","CVE-2026-92009","CVE-2026-92010","CVE-2026-92011","CVE-2026-92012","CVE-2026-92013","CVE-2026-92015","CVE-2026-92016","CVE-2026-92017","CVE-2026-92018","CVE-2026-92019","CVE-2026-92020","CVE-2026-92022","CVE-2026-92023","CVE-2026-92024","CVE-2026-92025","CVE-2026-92026","CVE-2026-92027","CVE-2026-92028","CVE-2026-92029","CVE-2026-92030","CVE-2026-92031","CVE-2026-92032","CVE-2026-92035","CVE-2026-92038","CVE-2026-92039","CVE-2026-92041","CVE-2026-92042","CVE-2026-92043","CVE-2026-92044","CVE-2026-92045","CVE-2026-92046","CVE-2026-92047","CVE-2026-92048","CVE-2026-92049","CVE-2026-92052","CVE-2026-92053","CVE-2026-92054","CVE-2026-92055","CVE-2026-92056","CVE-2026-92057","CVE-2026-92058","CVE-2026-92059","CVE-2026-92060","CVE-2026-92062","CVE-2026-92064","CVE-2026-92065","CVE-2026-92067","CVE-2026-92068","CVE-2026-92069","CVE-2026-92070","CVE-2026-92071","CVE-2026-92072","CVE-2026-92073","CVE-2026-92074","CVE-2026-92075","CVE-2026-92076","CVE-2026-92077","CVE-2026-92078","CVE-2026-92079","CVE-2026-92238","CVE-2026-92239","CVE-2026-92240","CVE-2026-96869"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264627-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1280371"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282929"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100756"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100757"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100758"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100759"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100760"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100762"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100765"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100766"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100767"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100769"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100770"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100771"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100772"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100773"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100774"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100775"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100776"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100777"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100778"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100779"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100780"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100781"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100782"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100783"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100784"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100785"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100786"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100787"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100788"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100789"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100790"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100791"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100792"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100794"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100797"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100798"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100800"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100801"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100803"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100806"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100807"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100808"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100809"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100811"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100812"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100814"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100815"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100816"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100818"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100819"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100820"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100821"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100822"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100824"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100825"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100826"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100828"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100829"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100830"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100831"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-100832"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-103500"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92005"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92006"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92007"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92008"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92009"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92010"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92011"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92012"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92013"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92015"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92016"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92017"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92018"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92019"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92020"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92022"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92023"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92024"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92025"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92026"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92027"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92028"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92029"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92030"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92031"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92032"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92035"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92038"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92039"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92041"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92042"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92043"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92044"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92045"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92046"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92047"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92048"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92049"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92052"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92053"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92054"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92055"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92056"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92057"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92058"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92059"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92060"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92062"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92064"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92065"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92067"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92068"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92069"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92070"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92071"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92072"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92073"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92074"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92075"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92076"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92077"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92078"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92079"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92238"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92239"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92240"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-96869"}],"affected":[{"package":{"name":"MozillaThunderbird","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","purl":"pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.4.0-150400.13.6.1"}]}],"ecosystem_specific":{"binaries":[{"MozillaThunderbird-translations-other":"153.4.0-150400.13.6.1","MozillaThunderbird":"153.4.0-150400.13.6.1","MozillaThunderbird-translations-common":"153.4.0-150400.13.6.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4627-1.json"}},{"package":{"name":"MozillaThunderbird","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","purl":"pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.4.0-150400.13.6.1"}]}],"ecosystem_specific":{"binaries":[{"MozillaThunderbird-translations-other":"153.4.0-150400.13.6.1","MozillaThunderbird":"153.4.0-150400.13.6.1","MozillaThunderbird-translations-common":"153.4.0-150400.13.6.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4627-1.json"}}],"schema_version":"1.9.0"}