SUSE-SU-2026:4627-1: important: Security update for MozillaThunderbird
SLE-SECURITY-UPDATES
null at suse.de
Mon Oct 12 20:31:48 UTC 2026
# Security update for MozillaThunderbird
Announcement ID: SUSE-SU-2026:4627-1
Release Date: 2026-10-12T14:57:42Z
Rating: important
References:
* bsc#1280371
* bsc#1282929
Cross-References:
* CVE-2026-100756
* CVE-2026-100757
* CVE-2026-100758
* CVE-2026-100759
* CVE-2026-100760
* CVE-2026-100762
* CVE-2026-100765
* CVE-2026-100766
* CVE-2026-100767
* CVE-2026-100769
* CVE-2026-100770
* CVE-2026-100771
* CVE-2026-100772
* CVE-2026-100773
* CVE-2026-100774
* CVE-2026-100775
* CVE-2026-100776
* CVE-2026-100777
* CVE-2026-100778
* CVE-2026-100779
* CVE-2026-100780
* CVE-2026-100781
* CVE-2026-100782
* CVE-2026-100783
* CVE-2026-100784
* CVE-2026-100785
* CVE-2026-100786
* CVE-2026-100787
* CVE-2026-100788
* CVE-2026-100789
* CVE-2026-100790
* CVE-2026-100791
* CVE-2026-100792
* CVE-2026-100794
* CVE-2026-100797
* CVE-2026-100798
* CVE-2026-100800
* CVE-2026-100801
* CVE-2026-100803
* CVE-2026-100806
* CVE-2026-100807
* CVE-2026-100808
* CVE-2026-100809
* CVE-2026-100811
* CVE-2026-100812
* CVE-2026-100814
* CVE-2026-100815
* CVE-2026-100816
* CVE-2026-100818
* CVE-2026-100819
* CVE-2026-100820
* CVE-2026-100821
* CVE-2026-100822
* CVE-2026-100824
* CVE-2026-100825
* CVE-2026-100826
* CVE-2026-100828
* CVE-2026-100829
* CVE-2026-100830
* CVE-2026-100831
* CVE-2026-100832
* CVE-2026-103500
* CVE-2026-92005
* CVE-2026-92006
* CVE-2026-92007
* CVE-2026-92008
* CVE-2026-92009
* CVE-2026-92010
* CVE-2026-92011
* CVE-2026-92012
* CVE-2026-92013
* CVE-2026-92015
* CVE-2026-92016
* CVE-2026-92017
* CVE-2026-92018
* CVE-2026-92019
* CVE-2026-92020
* CVE-2026-92022
* CVE-2026-92023
* CVE-2026-92024
* CVE-2026-92025
* CVE-2026-92026
* CVE-2026-92027
* CVE-2026-92028
* CVE-2026-92029
* CVE-2026-92030
* CVE-2026-92031
* CVE-2026-92032
* CVE-2026-92035
* CVE-2026-92038
* CVE-2026-92039
* CVE-2026-92041
* CVE-2026-92042
* CVE-2026-92043
* CVE-2026-92044
* CVE-2026-92045
* CVE-2026-92046
* CVE-2026-92047
* CVE-2026-92048
* CVE-2026-92049
* CVE-2026-92052
* CVE-2026-92053
* CVE-2026-92054
* CVE-2026-92055
* CVE-2026-92056
* CVE-2026-92057
* CVE-2026-92058
* CVE-2026-92059
* CVE-2026-92060
* CVE-2026-92062
* CVE-2026-92064
* CVE-2026-92065
* CVE-2026-92067
* CVE-2026-92068
* CVE-2026-92069
* CVE-2026-92070
* CVE-2026-92071
* CVE-2026-92072
* CVE-2026-92073
* CVE-2026-92074
* CVE-2026-92075
* CVE-2026-92076
* CVE-2026-92077
* CVE-2026-92078
* CVE-2026-92079
* CVE-2026-92238
* CVE-2026-92239
* CVE-2026-92240
* CVE-2026-96869
CVSS scores:
* CVE-2026-100756 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-100757 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100758 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100759 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-100760 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100762 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100765 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100766 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
* CVE-2026-100767 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100769 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100770 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100771 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-100772 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100773 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100774 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100775 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100776 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100777 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100778 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100779 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100780 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100781 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100782 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100783 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
* CVE-2026-100784 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100785 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100786 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100787 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100788 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-100789 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100790 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100791 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100792 ( NVD ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
* CVE-2026-100794 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100797 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100798 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-100800 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100801 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100803 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-100806 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
* CVE-2026-100807 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100808 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100809 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-100811 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100812 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2026-100814 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100815 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100816 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-100818 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100819 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100820 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100821 ( NVD ): 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
* CVE-2026-100822 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
* CVE-2026-100824 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100825 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100826 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2026-100828 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100829 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100830 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-100831 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100832 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92005 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-92006 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92006 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92007 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92008 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92009 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92010 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92011 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92012 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92013 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92015 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92016 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92017 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92018 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-92019 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-92020 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92022 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92023 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92024 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92025 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92026 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92027 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92028 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92029 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92030 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-92031 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
* CVE-2026-92032 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-92035 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-92038 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-92039 ( NVD ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-92041 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-92042 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92043 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92044 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2026-92045 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-92046 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92047 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92048 ( NVD ): 9.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-92049 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92052 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92053 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92054 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92055 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92056 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92057 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-92058 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92059 ( NVD ): 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-92060 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92062 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92064 ( NVD ): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-92065 ( NVD ): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-92067 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92068 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-92069 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
* CVE-2026-92070 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
* CVE-2026-92071 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-92072 ( NVD ): 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92073 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92074 ( NVD ): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-92075 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-92076 ( NVD ): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-92077 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2026-92078 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2026-92079 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-92238 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-92239 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
* CVE-2026-92240 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
* CVE-2026-96869 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected Products:
* openSUSE Leap 15.4
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
* SUSE Linux Enterprise Workstation Extension 15 SP7
* SUSE Package Hub 15 15-SP7
An update that solves 129 vulnerabilities can now be installed.
## Description:
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 153.4 (MFSA 2026-96, MFSA 2026-103, bsc#1280371,
bsc#1282929):
* CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component.
* CVE-2026-92006: Privilege escalation due to incorrect boundary conditions in
the Graphics: CanvasWebGL component.
* CVE-2026-92007: Privilege escalation due to incorrect boundary conditions in
the Graphics: CanvasWebGL component.
* CVE-2026-92008: Privilege escalation due to incorrect boundary conditions in
the Graphics: CanvasWebGL component.
* CVE-2026-92009: Privilege escalation due to incorrect boundary conditions in
the Graphics: CanvasWebGL component.
* CVE-2026-92010: Privilege escalation due to incorrect boundary conditions in
the Graphics: CanvasWebGL component.
* CVE-2026-92011: Privilege escalation due to incorrect boundary conditions in
the Graphics: CanvasWebGL component.
* CVE-2026-92012: Privilege escalation due to incorrect boundary conditions in
the Graphics: CanvasWebGL component.
* CVE-2026-92013: Privilege escalation due to incorrect boundary conditions in
the Graphics: CanvasWebGL component.
* CVE-2026-92015: Privilege escalation in the WebExtensions component.
* CVE-2026-92016: Use-after-free in the Disability Access APIs component.
* CVE-2026-92017: Privilege escalation in the DOM: Service Workers component.
* CVE-2026-92018: Sandbox escape in the DOM: Core & HTML component.
* CVE-2026-92019: Mitigation bypass in the Remote Settings Client component.
* CVE-2026-92020: Privilege escalation due to incorrect boundary conditions in
the Graphics: WebRender component.
* CVE-2026-92022: Use-after-free in the DOM: HTML Parser component.
* CVE-2026-92023: Use-after-free in the XML component.
* CVE-2026-92024: Use-after-free in the SVG component.
* CVE-2026-92025: Use-after-free in the DOM: Navigation component.
* CVE-2026-92026: Use-after-free in the Networking component.
* CVE-2026-92027: Use-after-free in the DOM: Streams component.
* CVE-2026-92028: Use-after-free in the DOM: Core & HTML component.
* CVE-2026-92029: Use-after-free in the SVG component.
* CVE-2026-92030: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop
component.
* CVE-2026-92031: Information disclosure in the Graphics: ImageLib component.
* CVE-2026-92032: Sandbox escape due to invalid pointer in the Graphics
component.
* CVE-2026-92035: Sandbox escape due to incorrect boundary conditions in the
Graphics component.
* CVE-2026-92038: Mitigation bypass in the Remote Settings Client component.
* CVE-2026-92039: Mitigation bypass in the DOM: Notifications component.
* CVE-2026-92041: Mitigation bypass in the DOM: Networking component.
* CVE-2026-92042: Race condition in the DOM: Content Processes component.
* CVE-2026-92043: Privilege escalation due to incorrect boundary conditions in
the Audio/Video component.
* CVE-2026-92044: Information disclosure in the Networking: HTTP component.
* CVE-2026-92045: Sandbox escape due to incorrect boundary conditions in the
WebRTC component.
* CVE-2026-92046: Use-after-free in the Graphics component.
* CVE-2026-92047: Privilege escalation in the Crash Reporting component.
* CVE-2026-92048: Sandbox escape due to incorrect boundary conditions in the
Widget: Win32 component.
* CVE-2026-92049: Use-after-free in the Widget: Win32 component.
* CVE-2026-92052: Privilege escalation due to uninitialized memory in the
Graphics: CanvasWebGL component.
* CVE-2026-92053: Privilege escalation in the Graphics: CanvasWebGL component.
* CVE-2026-92054: Privilege escalation in the Memory component.
* CVE-2026-92055: Privilege escalation in the DevTools component.
* CVE-2026-92056: Use-after-free in the Graphics: Text component.
* CVE-2026-92057: Mitigation bypass in the Enterprise Policies component.
* CVE-2026-92058: Use-after-free in the Graphics component.
* CVE-2026-92059: Incorrect boundary conditions in the DOM: Editor component.
* CVE-2026-92060: Use-after-free in the Internationalization component.
* CVE-2026-92062: Privilege escalation in the Session Restore component.
* CVE-2026-92064: Sandbox escape due to incorrect boundary conditions in the
Widget: Win32 component.
* CVE-2026-92065: Sandbox escape due to incorrect boundary conditions in the
Widget: Win32 component.
* CVE-2026-92067: Use-after-free in the Widget: Gtk component.
* CVE-2026-92068: Site isolation issue in the Reader Mode component.
* CVE-2026-92069: Spoofing issue in the DOM: Navigation component.
* CVE-2026-92070: Information disclosure in the Networking component.
* CVE-2026-92071: Sandbox escape due to incorrect boundary conditions in the
Widget: Win32 component.
* CVE-2026-92072: Incorrect boundary conditions in the Safe Browsing
component.
* CVE-2026-92073: Privilege escalation in the Enterprise Policies component.
* CVE-2026-92074: Mitigation bypass in the Popup Blocker component.
* CVE-2026-92075: Mitigation bypass in the Networking component.
* CVE-2026-92076: Incorrect boundary conditions in the Networking component.
* CVE-2026-92077: Denial-of-service in the SVG component.
* CVE-2026-92078: Denial-of-service in the Security component.
* CVE-2026-92079: Mitigation bypass in the Widget: Win32 component.
* CVE-2026-92238: Ambiguous parsing of mail headers.
* CVE-2026-92239: Buffer overrun in IMAP.
* CVE-2026-92240: Out-of-bounds read in IMAP response parser.
* CVE-2026-96869: Information disclosure in the Networking component.
* CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback
component.
* CVE-2026-100757: Use-after-free in the Widget component.
* CVE-2026-100758: Sandbox escape in the DOM: Navigation component.
* CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager
component.
* CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing
component.
* CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content
Processes component.
* CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component.
* CVE-2026-100766: Information disclosure in the Networking: JAR component.
* CVE-2026-100767: Use-after-free in the Networking: Cache component.
* CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component.
* CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content
Processes component.
* CVE-2026-100771: Undefined behavior in the DOM: Streams component.
* CVE-2026-100772: Use-after-free in the DOM: Core & HTML component.
* CVE-2026-100773: Use-after-free in the Storage: IndexedDB component.
* CVE-2026-100774: Use-after-free in the DOM: Core & HTML component.
* CVE-2026-100775: Sandbox escape in the Graphics component.
* CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component.
* CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component.
* CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core &
HTML component.
* CVE-2026-100779: Use-after-free in the XSLT component.
* CVE-2026-100780: Use-after-free in the DOM: Core & HTML component.
* CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the
Graphics: WebRender component.
* CVE-2026-100782: Privilege escalation due to incorrect boundary conditions
in the Graphics component.
* CVE-2026-100783: Uninitialized memory in the Audio/Video component.
* CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component.
* CVE-2026-100785: Use-after-free in the DOM: Core & HTML component.
* CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics
component.
* CVE-2026-100787: Sandbox escape in the XUL component.
* CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component.
* CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component.
* CVE-2026-100790: Use-after-free in the XSLT component.
* CVE-2026-100791: Use-after-free in the DOM: Core & HTML component.
* CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly
component.
* CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the
Internationalization component.
* CVE-2026-100797: Privilege escalation due to use-after-free in the Graphics:
WebRender component.
* CVE-2026-100798: Cryptography misuse in Storage: Quota Manager component.
* CVE-2026-100800: Sandbox escape due to use-after-free in the Disability
Access APIs component.
* CVE-2026-100801: Privilege escalation in the DLL Services component.
* CVE-2026-100803: Same-origin policy bypass in the WebExtensions component.
* CVE-2026-100806: Uninitialized memory in the Graphics: WebGPU component.
* CVE-2026-100807: Privilege escalation in the DOM: Service Workers component.
* CVE-2026-100808: Mitigation bypass in the DOM: Service Workers component.
* CVE-2026-100809: Same-origin policy bypass in the DevTools component.
* CVE-2026-100811: Sandbox escape due to use-after-free in the DOM: Core &
HTML component.
* CVE-2026-100812: Denial-of-service in the Graphics component.
* CVE-2026-100814: Incorrect boundary conditions in the JavaScript Engine: JIT
component.
* CVE-2026-100815: Use-after-free in the CSS Parsing and Computation
component.
* CVE-2026-100816: Site isolation issue in the DOM: Networking component.
* CVE-2026-100818: Sandbox escape due to use-after-free in the Widget: Gtk
component.
* CVE-2026-100819: Sandbox escape due to incorrect boundary conditions in the
XPCOM component.
* CVE-2026-100820: Privilege escalation in the Address Bar component.
* CVE-2026-100821: Site isolation issue in the Panning and Zooming component.
* CVE-2026-100822: Spoofing issue in the Networking: HTTP component.
* CVE-2026-100824: Privilege escalation in the Places component.
* CVE-2026-100825: Use-after-free in the JavaScript Engine: JIT component.
* CVE-2026-100826: Denial-of-service in the Storage: StorageManager component.
* CVE-2026-100828: Mitigation bypass in the Bookmarks & History component.
* CVE-2026-100829: Mitigation bypass in the DOM: Security component.
* CVE-2026-100830: Mitigation bypass in the DOM: Navigation component.
* CVE-2026-100831: Use-after-free in the DOM: UI Events & Focus Handling
component.
* CVE-2026-100832: Use-after-free in the Graphics: Canvas2D component.
* CVE-2026-103500: Heap buffer overflow opening large email.
Changes for MozillaThunderbird:
* changed: RNP command-line utilities are no longer included with Thunderbird
(bmo#2068130)
* changed: Thundermail built-in add-on updated to v2.0.16 (bmo#2071989)
* fixed: Ctrl+Shift+K could fail to open the Quick Filter UI (bmo#2062942)
* fixed: Nested S/MIME signed parts could fail to render (bmo#2062971)
* fixed: Thunderbird could hang when waiting for IMAP server greeting during
account setup (bmo#2028760)
* fixed: Gmail OAuth2 authentication could intermittently fail on Windows
(bmo#2063816)
* fixed: `AppUpdatePin` policy did not prevent Thunderbird from updating
beyond pinned version (bmo#1910603)
* fixed: "What's New?" linked to Release channel notes instead of ESR release
notes (bmo#2073813)
* fixed: Detached attachment links were truncated when folder path contained
`&` (bmo#2060451)
* fixed: Save All, Detach All, and Delete All failed after deleting one
attachment (bmo#2057025)
* fixed: Blank 1970-dated messages could appear from incomplete message file
copies (bmo#209501)
* fixed: Forwarded messages could display incorrect encoding (bmo#2059963)
* fixed: Manual Get Messages failed after startup until toggling offline mode
(bmo#2057431)
* fixed: Thunderbird could crash on shutdown while waiting for OAuth2 password
entry (bmo#1524247)
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.4
zypper in -t patch SUSE-2026-4627
* SUSE Linux Enterprise Workstation Extension 15 SP7
zypper in -t patch SUSE-SLE-Product-WE-15-SP7-2026-4627
* SUSE Package Hub 15 15-SP7
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-4627
## Package List:
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)
* MozillaThunderbird-debugsource-153.4.0-150400.13.6.1
* MozillaThunderbird-153.4.0-150400.13.6.1
* MozillaThunderbird-translations-common-153.4.0-150400.13.6.1
* MozillaThunderbird-debuginfo-153.4.0-150400.13.6.1
* MozillaThunderbird-translations-other-153.4.0-150400.13.6.1
* SUSE Linux Enterprise Workstation Extension 15 SP7 (x86_64)
* MozillaThunderbird-debugsource-153.4.0-150400.13.6.1
* MozillaThunderbird-153.4.0-150400.13.6.1
* MozillaThunderbird-translations-common-153.4.0-150400.13.6.1
* MozillaThunderbird-debuginfo-153.4.0-150400.13.6.1
* MozillaThunderbird-translations-other-153.4.0-150400.13.6.1
* SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x)
* MozillaThunderbird-debugsource-153.4.0-150400.13.6.1
* MozillaThunderbird-153.4.0-150400.13.6.1
* MozillaThunderbird-translations-common-153.4.0-150400.13.6.1
* MozillaThunderbird-debuginfo-153.4.0-150400.13.6.1
* MozillaThunderbird-translations-other-153.4.0-150400.13.6.1
## References:
* https://www.suse.com/security/cve/CVE-2026-100756.html
* https://www.suse.com/security/cve/CVE-2026-100757.html
* https://www.suse.com/security/cve/CVE-2026-100758.html
* https://www.suse.com/security/cve/CVE-2026-100759.html
* https://www.suse.com/security/cve/CVE-2026-100760.html
* https://www.suse.com/security/cve/CVE-2026-100762.html
* https://www.suse.com/security/cve/CVE-2026-100765.html
* https://www.suse.com/security/cve/CVE-2026-100766.html
* https://www.suse.com/security/cve/CVE-2026-100767.html
* https://www.suse.com/security/cve/CVE-2026-100769.html
* https://www.suse.com/security/cve/CVE-2026-100770.html
* https://www.suse.com/security/cve/CVE-2026-100771.html
* https://www.suse.com/security/cve/CVE-2026-100772.html
* https://www.suse.com/security/cve/CVE-2026-100773.html
* https://www.suse.com/security/cve/CVE-2026-100774.html
* https://www.suse.com/security/cve/CVE-2026-100775.html
* https://www.suse.com/security/cve/CVE-2026-100776.html
* https://www.suse.com/security/cve/CVE-2026-100777.html
* https://www.suse.com/security/cve/CVE-2026-100778.html
* https://www.suse.com/security/cve/CVE-2026-100779.html
* https://www.suse.com/security/cve/CVE-2026-100780.html
* https://www.suse.com/security/cve/CVE-2026-100781.html
* https://www.suse.com/security/cve/CVE-2026-100782.html
* https://www.suse.com/security/cve/CVE-2026-100783.html
* https://www.suse.com/security/cve/CVE-2026-100784.html
* https://www.suse.com/security/cve/CVE-2026-100785.html
* https://www.suse.com/security/cve/CVE-2026-100786.html
* https://www.suse.com/security/cve/CVE-2026-100787.html
* https://www.suse.com/security/cve/CVE-2026-100788.html
* https://www.suse.com/security/cve/CVE-2026-100789.html
* https://www.suse.com/security/cve/CVE-2026-100790.html
* https://www.suse.com/security/cve/CVE-2026-100791.html
* https://www.suse.com/security/cve/CVE-2026-100792.html
* https://www.suse.com/security/cve/CVE-2026-100794.html
* https://www.suse.com/security/cve/CVE-2026-100797.html
* https://www.suse.com/security/cve/CVE-2026-100798.html
* https://www.suse.com/security/cve/CVE-2026-100800.html
* https://www.suse.com/security/cve/CVE-2026-100801.html
* https://www.suse.com/security/cve/CVE-2026-100803.html
* https://www.suse.com/security/cve/CVE-2026-100806.html
* https://www.suse.com/security/cve/CVE-2026-100807.html
* https://www.suse.com/security/cve/CVE-2026-100808.html
* https://www.suse.com/security/cve/CVE-2026-100809.html
* https://www.suse.com/security/cve/CVE-2026-100811.html
* https://www.suse.com/security/cve/CVE-2026-100812.html
* https://www.suse.com/security/cve/CVE-2026-100814.html
* https://www.suse.com/security/cve/CVE-2026-100815.html
* https://www.suse.com/security/cve/CVE-2026-100816.html
* https://www.suse.com/security/cve/CVE-2026-100818.html
* https://www.suse.com/security/cve/CVE-2026-100819.html
* https://www.suse.com/security/cve/CVE-2026-100820.html
* https://www.suse.com/security/cve/CVE-2026-100821.html
* https://www.suse.com/security/cve/CVE-2026-100822.html
* https://www.suse.com/security/cve/CVE-2026-100824.html
* https://www.suse.com/security/cve/CVE-2026-100825.html
* https://www.suse.com/security/cve/CVE-2026-100826.html
* https://www.suse.com/security/cve/CVE-2026-100828.html
* https://www.suse.com/security/cve/CVE-2026-100829.html
* https://www.suse.com/security/cve/CVE-2026-100830.html
* https://www.suse.com/security/cve/CVE-2026-100831.html
* https://www.suse.com/security/cve/CVE-2026-100832.html
* https://www.suse.com/security/cve/CVE-2026-103500.html
* https://www.suse.com/security/cve/CVE-2026-92005.html
* https://www.suse.com/security/cve/CVE-2026-92006.html
* https://www.suse.com/security/cve/CVE-2026-92007.html
* https://www.suse.com/security/cve/CVE-2026-92008.html
* https://www.suse.com/security/cve/CVE-2026-92009.html
* https://www.suse.com/security/cve/CVE-2026-92010.html
* https://www.suse.com/security/cve/CVE-2026-92011.html
* https://www.suse.com/security/cve/CVE-2026-92012.html
* https://www.suse.com/security/cve/CVE-2026-92013.html
* https://www.suse.com/security/cve/CVE-2026-92015.html
* https://www.suse.com/security/cve/CVE-2026-92016.html
* https://www.suse.com/security/cve/CVE-2026-92017.html
* https://www.suse.com/security/cve/CVE-2026-92018.html
* https://www.suse.com/security/cve/CVE-2026-92019.html
* https://www.suse.com/security/cve/CVE-2026-92020.html
* https://www.suse.com/security/cve/CVE-2026-92022.html
* https://www.suse.com/security/cve/CVE-2026-92023.html
* https://www.suse.com/security/cve/CVE-2026-92024.html
* https://www.suse.com/security/cve/CVE-2026-92025.html
* https://www.suse.com/security/cve/CVE-2026-92026.html
* https://www.suse.com/security/cve/CVE-2026-92027.html
* https://www.suse.com/security/cve/CVE-2026-92028.html
* https://www.suse.com/security/cve/CVE-2026-92029.html
* https://www.suse.com/security/cve/CVE-2026-92030.html
* https://www.suse.com/security/cve/CVE-2026-92031.html
* https://www.suse.com/security/cve/CVE-2026-92032.html
* https://www.suse.com/security/cve/CVE-2026-92035.html
* https://www.suse.com/security/cve/CVE-2026-92038.html
* https://www.suse.com/security/cve/CVE-2026-92039.html
* https://www.suse.com/security/cve/CVE-2026-92041.html
* https://www.suse.com/security/cve/CVE-2026-92042.html
* https://www.suse.com/security/cve/CVE-2026-92043.html
* https://www.suse.com/security/cve/CVE-2026-92044.html
* https://www.suse.com/security/cve/CVE-2026-92045.html
* https://www.suse.com/security/cve/CVE-2026-92046.html
* https://www.suse.com/security/cve/CVE-2026-92047.html
* https://www.suse.com/security/cve/CVE-2026-92048.html
* https://www.suse.com/security/cve/CVE-2026-92049.html
* https://www.suse.com/security/cve/CVE-2026-92052.html
* https://www.suse.com/security/cve/CVE-2026-92053.html
* https://www.suse.com/security/cve/CVE-2026-92054.html
* https://www.suse.com/security/cve/CVE-2026-92055.html
* https://www.suse.com/security/cve/CVE-2026-92056.html
* https://www.suse.com/security/cve/CVE-2026-92057.html
* https://www.suse.com/security/cve/CVE-2026-92058.html
* https://www.suse.com/security/cve/CVE-2026-92059.html
* https://www.suse.com/security/cve/CVE-2026-92060.html
* https://www.suse.com/security/cve/CVE-2026-92062.html
* https://www.suse.com/security/cve/CVE-2026-92064.html
* https://www.suse.com/security/cve/CVE-2026-92065.html
* https://www.suse.com/security/cve/CVE-2026-92067.html
* https://www.suse.com/security/cve/CVE-2026-92068.html
* https://www.suse.com/security/cve/CVE-2026-92069.html
* https://www.suse.com/security/cve/CVE-2026-92070.html
* https://www.suse.com/security/cve/CVE-2026-92071.html
* https://www.suse.com/security/cve/CVE-2026-92072.html
* https://www.suse.com/security/cve/CVE-2026-92073.html
* https://www.suse.com/security/cve/CVE-2026-92074.html
* https://www.suse.com/security/cve/CVE-2026-92075.html
* https://www.suse.com/security/cve/CVE-2026-92076.html
* https://www.suse.com/security/cve/CVE-2026-92077.html
* https://www.suse.com/security/cve/CVE-2026-92078.html
* https://www.suse.com/security/cve/CVE-2026-92079.html
* https://www.suse.com/security/cve/CVE-2026-92238.html
* https://www.suse.com/security/cve/CVE-2026-92239.html
* https://www.suse.com/security/cve/CVE-2026-92240.html
* https://www.suse.com/security/cve/CVE-2026-96869.html
* https://bugzilla.suse.com/show_bug.cgi?id=1280371
* https://bugzilla.suse.com/show_bug.cgi?id=1282929
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20261012/4f43c49a/attachment.htm>
More information about the sle-security-updates
mailing list