SUSE-SU-2026:4736-1: important: Security update for MozillaThunderbird
SLE-SECURITY-UPDATES
null at suse.de
Mon Oct 19 20:32:12 UTC 2026
# Security update for MozillaThunderbird
Announcement ID: SUSE-SU-2026:4736-1
Release Date: 2026-10-19T12:57:04Z
Rating: important
References:
* bsc#1259712
* bsc#1259727
* bsc#1259730
* bsc#1262263
* bsc#1264713
* bsc#1275108
* bsc#1275605
* bsc#1275736
* bsc#1282347
* bsc#1284493
Cross-References:
* CVE-2026-109704
* CVE-2026-109705
* CVE-2026-109706
* CVE-2026-109707
* CVE-2026-109708
* CVE-2026-109709
* CVE-2026-109710
* CVE-2026-109711
* CVE-2026-109712
* CVE-2026-109713
* CVE-2026-109715
* CVE-2026-109716
* CVE-2026-109717
* CVE-2026-109718
* CVE-2026-109719
* CVE-2026-109720
* CVE-2026-109721
* CVE-2026-109722
* CVE-2026-109723
* CVE-2026-109724
* CVE-2026-109725
* CVE-2026-109726
* CVE-2026-109727
* CVE-2026-109728
* CVE-2026-109729
* CVE-2026-109730
* CVE-2026-109731
* CVE-2026-109732
* CVE-2026-109733
* CVE-2026-109734
* CVE-2026-109736
* CVE-2026-109737
* CVE-2026-109738
* CVE-2026-109740
* CVE-2026-109741
* CVE-2026-109742
* CVE-2026-109743
* CVE-2026-109744
* CVE-2026-109745
* CVE-2026-109751
* CVE-2026-109752
* CVE-2026-109753
* CVE-2026-109754
* CVE-2026-109756
* CVE-2026-109757
* CVE-2026-109759
* CVE-2026-109760
* CVE-2026-109762
* CVE-2026-109763
* CVE-2026-109764
* CVE-2026-109765
* CVE-2026-109766
* CVE-2026-109767
* CVE-2026-109770
* CVE-2026-109775
* CVE-2026-109776
* CVE-2026-109777
* CVE-2026-109778
* CVE-2026-109781
* CVE-2026-109782
* CVE-2026-109783
* CVE-2026-110249
* CVE-2026-32776
* CVE-2026-32777
* CVE-2026-32778
* CVE-2026-41080
* CVE-2026-45186
* CVE-2026-50219
* CVE-2026-56131
* CVE-2026-56132
* CVE-2026-56403
* CVE-2026-56404
* CVE-2026-56405
* CVE-2026-56406
* CVE-2026-56407
* CVE-2026-56408
* CVE-2026-56409
* CVE-2026-56410
* CVE-2026-56411
* CVE-2026-56412
* CVE-2026-66046
* CVE-2026-72522
* CVE-2026-76641
* CVE-2026-76956
* CVE-2026-76957
* CVE-2026-93990
CVSS scores:
* CVE-2026-109704 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-109705 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-109706 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-109707 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-109708 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-109709 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-109710 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-109711 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-109712 ( NVD ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
* CVE-2026-109713 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-109715 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-109716 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-109717 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-109718 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-109719 ( NVD ): 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-109720 ( NVD ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
* CVE-2026-109721 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-109722 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-109723 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-109724 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-109725 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-109726 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-109727 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-109728 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-109729 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-109730 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-109731 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-109732 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-109733 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-109734 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-109736 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-109737 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-109738 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-109740 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-109741 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-109742 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
* CVE-2026-109743 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-109744 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-109745 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-109751 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
* CVE-2026-109752 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-109753 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-109754 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-109756 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-109757 ( NVD ): 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-109759 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-109760 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-109765 ( NVD ): 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-109766 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-109767 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
* CVE-2026-109775 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2026-109776 ( NVD ): 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-109777 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
* CVE-2026-109778 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-109781 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2026-32776 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-32776 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-32776 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-32776 ( NVD ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-32777 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-32777 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-32777 ( NVD ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-32777 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-32778 ( SUSE ): 8.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-32778 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-32778 ( NVD ): 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-32778 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-41080 ( SUSE ): 2.0
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-41080 ( SUSE ): 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
* CVE-2026-41080 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2026-41080 ( NVD ): 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-45186 ( SUSE ): 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-45186 ( NVD ): 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-45186 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-45186 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-50219 ( SUSE ): 4.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-50219 ( NVD ): 4.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-50219 ( NVD ): 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-56131 ( SUSE ): 4.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-56131 ( NVD ): 4.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-56132 ( SUSE ): 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-56132 ( NVD ): 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-56132 ( NVD ): 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-56403 ( SUSE ): 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-56403 ( NVD ): 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-56403 ( NVD ): 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-56404 ( SUSE ): 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-56404 ( NVD ): 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-56404 ( NVD ): 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-56405 ( SUSE ): 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-56405 ( NVD ): 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-56405 ( NVD ): 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-56406 ( SUSE ): 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-56406 ( NVD ): 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-56407 ( SUSE ): 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-56407 ( NVD ): 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-56408 ( SUSE ): 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-56408 ( NVD ): 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-56409 ( SUSE ): 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-56409 ( NVD ): 6.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
* CVE-2026-56410 ( SUSE ): 6.3 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
* CVE-2026-56410 ( NVD ): 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-56411 ( SUSE ): 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-56411 ( NVD ): 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
* CVE-2026-56412 ( SUSE ): 4.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-56412 ( NVD ): 4.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-56412 ( NVD ): 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-66046 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-66046 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-66046 ( NVD ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-66046 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-72522 ( SUSE ): 8.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-72522 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-72522 ( NVD ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-76641 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-76641 ( NVD ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-76641 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-76956 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-76956 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-76956 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-76957 ( SUSE ): 4.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-76957 ( NVD ): 4.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-76957 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-93990 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-93990 ( NVD ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-93990 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products:
* openSUSE Leap 15.4
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
* SUSE Linux Enterprise Workstation Extension 15 SP7
* SUSE Package Hub 15 15-SP7
An update that solves 86 vulnerabilities can now be installed.
## Description:
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 153.5 (MFSA 2026-110, bsc#1284493):
* CVE-2026-109704: Privilege escalation in the Application Update component.
* CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect
boundary conditions, use-after-free in the Networking component.
* CVE-2026-109706: Use-after-free in the Storage: IndexedDB component.
* CVE-2026-109707: Sandbox escape due to use-after-free in the Networking
component.
* CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the
Networking component.
* CVE-2026-109709: Information disclosure, privilege escalation in the
Security: Process Sandboxing component.
* CVE-2026-109710: Use-after-free in the Graphics: Text component.
* CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component.
* CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics
component.
* CVE-2026-109713: Use-after-free in the Crash Reporting component.
* CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine
component.
* CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine
component.
* CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component.
* CVE-2026-109718: Use-after-free in the XML component.
* CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL
component.
* CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly
component.
* CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT
component.
* CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component.
* CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component.
* CVE-2026-109724: Use-after-free in the DOM: Core & HTML component.
* CVE-2026-109725: Use-after-free in the DOM: Core & HTML component.
* CVE-2026-109726: Use-after-free in the SVG component.
* CVE-2026-109727: Use-after-free in the Audio/Video component.
* CVE-2026-109728: Use-after-free in the DOM: Animation component.
* CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component.
* CVE-2026-109730: Integer overflow in the Graphics component.
* CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D
component.
* CVE-2026-109732: Use-after-free in the DOM: Streams component.
* CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component.
* CVE-2026-109734: Mitigation bypass in the DOM: Security component.
* CVE-2026-109736: Frame poisoning in the Layout component.
* CVE-2026-109737: Mitigation bypass in the Enterprise Policies component.
* CVE-2026-109738: Use-after-free in the Audio/Video: Playback component.
* CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the
Widget: Win32 component.
* CVE-2026-109741: Use-after-free in the Storage: Bucket File System
component.
* CVE-2026-109742: Information disclosure in the PDF Viewer component.
* CVE-2026-109743: Privilege escalation in the Panning and Zooming component.
* CVE-2026-109744: Other issue in the DOM: File component.
* CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web
Serial component.
* CVE-2026-109751: Information disclosure in the Networking component.
* CVE-2026-109752: Use-after-free in the DOM: Workers component.
* CVE-2026-109753: Incorrect boundary conditions in the Layout component.
* CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component.
* CVE-2026-109756: Privilege escalation in the DOM: Navigation component.
* CVE-2026-109757: Sandbox escape due to race condition in the Networking
component.
* CVE-2026-109759: Site isolation issue in the Networking component.
* CVE-2026-109760: Mitigation bypass in the Networking: HTTP component.
* CVE-2026-109762: Incorrect boundary conditions in the SVG component.
* CVE-2026-109763: Mitigation bypass in the File Handling component.
* CVE-2026-109764: Mitigation bypass in the Enterprise Policies component.
* CVE-2026-109765: Race condition, use-after-free in the Graphics: Text
component.
* CVE-2026-109766: Mitigation bypass in the Enterprise Policies component.
* CVE-2026-109767: Information disclosure in the Networking component.
* CVE-2026-109770: Spoofing issue in the DOM: Web Serial component.
* CVE-2026-109775: Denial-of-service in the WebRTC component.
* CVE-2026-109776: Race condition in the XPCOM component.
* CVE-2026-109777: Information disclosure in the Storage: IndexedDB component.
* CVE-2026-109778: Privilege escalation in the WebExtensions component.
* CVE-2026-109781: Denial-of-service in the Printing: Output component.
* CVE-2026-109782: Mitigation bypass in the File Handling component.
* CVE-2026-109783: Mitigation bypass in the File Handling component.
* CVE-2026-110249: Denial-of-service in the Exchange email component.
libexpat updated:
* CVE-2026-50219: libexpat: Use-after-free vulnerability due to lack of
handler call depth tracking in libexpat could lead to information
disclosure, integrity loss, or denial of service (bsc#1275108).
* CVE-2026-56131: libexpat: Use-after-free vulnerability due to a lack of
handler call depth tracking for XML_ResumeParser in libexpat could lead to
denial of service (bsc#1275108).
* CVE-2026-56132: libexpat: Heap buffer overflow in doProlog due to mishandled
array reallocation in libexpat could lead to denial of service or memory
corruption (bsc#1275108).
* CVE-2026-56403: libexpat: Integer overflow vulnerability in the storeAtts
attribute parsing function in libexpat could lead to memory corruption
(bsc#1275108).
* CVE-2026-56404: libexpat: Integer overflow vulnerability in the addBinding
routine of libexpat could lead to memory corruption and potential security
risks (bsc#1275108).
* CVE-2026-56405: libexpat: Integer overflow vulnerability in libexpat could
lead to memory corruption or denial of service (bsc#1275108).
* CVE-2026-56406: libexpat: Integer overflow vulnerability in libexpat could
lead to memory corruption or denial of service (bsc#1275108).
* CVE-2026-56407: libexpat: Integer overflow vulnerability in libexpat could
lead to memory corruption or denial of service (bsc#1275108).
* CVE-2026-56408: libexpat: Integer overflow vulnerability in the copyString
function in libexpat could lead to memory corruption (bsc#1275108).
* CVE-2026-56409: libexpat: Integer overflow vulnerability in libexpat could
lead to memory corruption or denial of service (bsc#1275108).
* CVE-2026-56410: libexpat: Integer overflow vulnerability in the xmlwf
utility of libexpat could lead to denial of service (bsc#1275108).
* CVE-2026-56411: libexpat: Integer overflow vulnerability in libexpat could
lead to memory corruption or denial of service (bsc#1275108).
* CVE-2026-56412: libexpat: Use-after-free vulnerability due to a lack of
handler call depth tracking in libexpat could lead to denial of service or
memory corruption (bsc#1275108).
* CVE-2026-66046: libexpat: denial of service vulnerability caused by
quadratic algorithmic complexity in the storeAtts() function in xmlparse.c
(bsc#1275736).
* CVE-2026-72522: libexpat: Out-of-bounds read and resultant infinite loop in
the Unicode processing functions in libexpat allowed attackers to cause
denial of service (bsc#1275605).
* CVE-2026-76641: libexpat: Out-of-bounds read vulnerability caused by a
struct size mismatch in libexpat allowed attackers to trigger memory
corruption or a crash (bsc#1275736).
* CVE-2026-76956: libexpat: Insufficient entropy caused by misinterpretation
of getentropy's return code in libexpat allowed attackers to cause a denial
of service via hash flooding attacks (bsc#1275736).
* CVE-2026-76957: libexpat: Use-after-free vulnerability due to lack of
handler call depth tracking with custom encoding callbacks in libexpat could
lead to memory corruption (bsc#1275736).
* CVE-2026-93990: libexpat: Improper handling of lone high surrogates in
UTF-16 encoded XML in libexpat allowed attackers to pass unpaired surrogates
or silently replace input characters (bsc#1282347).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.4
zypper in -t patch SUSE-2026-4736
* SUSE Linux Enterprise Workstation Extension 15 SP7
zypper in -t patch SUSE-SLE-Product-WE-15-SP7-2026-4736
* SUSE Package Hub 15 15-SP7
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-4736
## Package List:
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)
* MozillaThunderbird-translations-other-153.5.0-150400.13.9.1
* MozillaThunderbird-translations-common-153.5.0-150400.13.9.1
* MozillaThunderbird-153.5.0-150400.13.9.1
* MozillaThunderbird-debugsource-153.5.0-150400.13.9.1
* MozillaThunderbird-debuginfo-153.5.0-150400.13.9.1
* SUSE Linux Enterprise Workstation Extension 15 SP7 (x86_64)
* MozillaThunderbird-translations-other-153.5.0-150400.13.9.1
* MozillaThunderbird-translations-common-153.5.0-150400.13.9.1
* MozillaThunderbird-153.5.0-150400.13.9.1
* MozillaThunderbird-debugsource-153.5.0-150400.13.9.1
* MozillaThunderbird-debuginfo-153.5.0-150400.13.9.1
* SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x)
* MozillaThunderbird-translations-other-153.5.0-150400.13.9.1
* MozillaThunderbird-translations-common-153.5.0-150400.13.9.1
* MozillaThunderbird-153.5.0-150400.13.9.1
* MozillaThunderbird-debugsource-153.5.0-150400.13.9.1
* MozillaThunderbird-debuginfo-153.5.0-150400.13.9.1
## References:
* https://www.suse.com/security/cve/CVE-2026-109704.html
* https://www.suse.com/security/cve/CVE-2026-109705.html
* https://www.suse.com/security/cve/CVE-2026-109706.html
* https://www.suse.com/security/cve/CVE-2026-109707.html
* https://www.suse.com/security/cve/CVE-2026-109708.html
* https://www.suse.com/security/cve/CVE-2026-109709.html
* https://www.suse.com/security/cve/CVE-2026-109710.html
* https://www.suse.com/security/cve/CVE-2026-109711.html
* https://www.suse.com/security/cve/CVE-2026-109712.html
* https://www.suse.com/security/cve/CVE-2026-109713.html
* https://www.suse.com/security/cve/CVE-2026-109715.html
* https://www.suse.com/security/cve/CVE-2026-109716.html
* https://www.suse.com/security/cve/CVE-2026-109717.html
* https://www.suse.com/security/cve/CVE-2026-109718.html
* https://www.suse.com/security/cve/CVE-2026-109719.html
* https://www.suse.com/security/cve/CVE-2026-109720.html
* https://www.suse.com/security/cve/CVE-2026-109721.html
* https://www.suse.com/security/cve/CVE-2026-109722.html
* https://www.suse.com/security/cve/CVE-2026-109723.html
* https://www.suse.com/security/cve/CVE-2026-109724.html
* https://www.suse.com/security/cve/CVE-2026-109725.html
* https://www.suse.com/security/cve/CVE-2026-109726.html
* https://www.suse.com/security/cve/CVE-2026-109727.html
* https://www.suse.com/security/cve/CVE-2026-109728.html
* https://www.suse.com/security/cve/CVE-2026-109729.html
* https://www.suse.com/security/cve/CVE-2026-109730.html
* https://www.suse.com/security/cve/CVE-2026-109731.html
* https://www.suse.com/security/cve/CVE-2026-109732.html
* https://www.suse.com/security/cve/CVE-2026-109733.html
* https://www.suse.com/security/cve/CVE-2026-109734.html
* https://www.suse.com/security/cve/CVE-2026-109736.html
* https://www.suse.com/security/cve/CVE-2026-109737.html
* https://www.suse.com/security/cve/CVE-2026-109738.html
* https://www.suse.com/security/cve/CVE-2026-109740.html
* https://www.suse.com/security/cve/CVE-2026-109741.html
* https://www.suse.com/security/cve/CVE-2026-109742.html
* https://www.suse.com/security/cve/CVE-2026-109743.html
* https://www.suse.com/security/cve/CVE-2026-109744.html
* https://www.suse.com/security/cve/CVE-2026-109745.html
* https://www.suse.com/security/cve/CVE-2026-109751.html
* https://www.suse.com/security/cve/CVE-2026-109752.html
* https://www.suse.com/security/cve/CVE-2026-109753.html
* https://www.suse.com/security/cve/CVE-2026-109754.html
* https://www.suse.com/security/cve/CVE-2026-109756.html
* https://www.suse.com/security/cve/CVE-2026-109757.html
* https://www.suse.com/security/cve/CVE-2026-109759.html
* https://www.suse.com/security/cve/CVE-2026-109760.html
* https://www.suse.com/security/cve/CVE-2026-109762.html
* https://www.suse.com/security/cve/CVE-2026-109763.html
* https://www.suse.com/security/cve/CVE-2026-109764.html
* https://www.suse.com/security/cve/CVE-2026-109765.html
* https://www.suse.com/security/cve/CVE-2026-109766.html
* https://www.suse.com/security/cve/CVE-2026-109767.html
* https://www.suse.com/security/cve/CVE-2026-109770.html
* https://www.suse.com/security/cve/CVE-2026-109775.html
* https://www.suse.com/security/cve/CVE-2026-109776.html
* https://www.suse.com/security/cve/CVE-2026-109777.html
* https://www.suse.com/security/cve/CVE-2026-109778.html
* https://www.suse.com/security/cve/CVE-2026-109781.html
* https://www.suse.com/security/cve/CVE-2026-109782.html
* https://www.suse.com/security/cve/CVE-2026-109783.html
* https://www.suse.com/security/cve/CVE-2026-110249.html
* https://www.suse.com/security/cve/CVE-2026-32776.html
* https://www.suse.com/security/cve/CVE-2026-32777.html
* https://www.suse.com/security/cve/CVE-2026-32778.html
* https://www.suse.com/security/cve/CVE-2026-41080.html
* https://www.suse.com/security/cve/CVE-2026-45186.html
* https://www.suse.com/security/cve/CVE-2026-50219.html
* https://www.suse.com/security/cve/CVE-2026-56131.html
* https://www.suse.com/security/cve/CVE-2026-56132.html
* https://www.suse.com/security/cve/CVE-2026-56403.html
* https://www.suse.com/security/cve/CVE-2026-56404.html
* https://www.suse.com/security/cve/CVE-2026-56405.html
* https://www.suse.com/security/cve/CVE-2026-56406.html
* https://www.suse.com/security/cve/CVE-2026-56407.html
* https://www.suse.com/security/cve/CVE-2026-56408.html
* https://www.suse.com/security/cve/CVE-2026-56409.html
* https://www.suse.com/security/cve/CVE-2026-56410.html
* https://www.suse.com/security/cve/CVE-2026-56411.html
* https://www.suse.com/security/cve/CVE-2026-56412.html
* https://www.suse.com/security/cve/CVE-2026-66046.html
* https://www.suse.com/security/cve/CVE-2026-72522.html
* https://www.suse.com/security/cve/CVE-2026-76641.html
* https://www.suse.com/security/cve/CVE-2026-76956.html
* https://www.suse.com/security/cve/CVE-2026-76957.html
* https://www.suse.com/security/cve/CVE-2026-93990.html
* https://bugzilla.suse.com/show_bug.cgi?id=1259712
* https://bugzilla.suse.com/show_bug.cgi?id=1259727
* https://bugzilla.suse.com/show_bug.cgi?id=1259730
* https://bugzilla.suse.com/show_bug.cgi?id=1262263
* https://bugzilla.suse.com/show_bug.cgi?id=1264713
* https://bugzilla.suse.com/show_bug.cgi?id=1275108
* https://bugzilla.suse.com/show_bug.cgi?id=1275605
* https://bugzilla.suse.com/show_bug.cgi?id=1275736
* https://bugzilla.suse.com/show_bug.cgi?id=1282347
* https://bugzilla.suse.com/show_bug.cgi?id=1284493
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20261019/10bdc7cc/attachment.htm>
More information about the sle-security-updates
mailing list