Debian alert DLA-4594-1 (thunderbird)

From:
             
 
Emilio Pozuelo Monfort <pochu@debian.org>
To:
             
 
<debian-lts-announce@lists.debian.org>
Subject:
             
 
[SECURITY] [DLA 4594-1] thunderbird security update
Date:
             
 
Fri, 22 May 2026 17:15:17 +0200
Message-ID:
             
 
<20260522151517.8571A5F0003E@kamino>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4594-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/               Emilio Pozuelo Monfort
May 22, 2026                                  https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : thunderbird
Version        : 1:140.11.0esr-1~deb11u1
CVE ID         : CVE-2026-8388 CVE-2026-8391 CVE-2026-8401 CVE-2026-8946
                 CVE-2026-8947 CVE-2026-8950 CVE-2026-8953 CVE-2026-8954
                 CVE-2026-8955 CVE-2026-8956 CVE-2026-8957 CVE-2026-8958
                 CVE-2026-8961 CVE-2026-8962 CVE-2026-8968 CVE-2026-8970
                 CVE-2026-8974 CVE-2026-8975

Multiple security issues were discovered in Thunderbird, which could
result in the execution of arbitrary code.

For Debian 11 bullseye, these problems have been fixed in version
1:140.11.0esr-1~deb11u1.

We recommend that you upgrade your thunderbird packages.

For the detailed security status of thunderbird please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/thunderbird

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEcJymx+vmJZxd92Q+nUbEiOQ2gwIFAmoQcwIACgkQnUbEiOQ2
gwJicA//dVRjyStwZZi5GAmiCb0VzHvWv8yV0hCAaz6PK60rLVhfDC/ke0hzfznR
/AVAVb+VmsLb3gu3kSYyNOtCA9xfAErc1vcM83fraNoC1uvtqY1z63EOtSOyeA9D
fDbz+5Knr2w9PvQZwvrQX3wbCf5cVSPD0DxQeTyP0smCknr2cDWN7COXVD2A0h2i
SbFyBzlZHhQNq3mS97OKzzsxvtbQdmsOrWlL0sjCU5/9FsUGKMmHaooPC1maaZb1
DpQcLpCZ0LMea6kfwXS+DDByFWDOeU8G106SuPasHDBxO/2GpLncYbNLJuxzzlNc
ovRu7xxCAKa4TuC1PNQzR3KJDBNqXsD9E/v95rYtG5rrzYt1ALVFJizC7DX4rYH0
0CS8W2OFSAzwCNMyVMeRLabRmwr9yzQlzoo0jDPaFDisV4YGz1esMztgdY1uB4Yd
dn3SnRC3MzV6gPBUuV0grsyE0sbsrHw+zX+ArAyPX0odKWdAm84ZKjO3Ea4ezjFe
I5YoZy0Q9KV/RJLxBPsB/0OyTmzEhVKrMsAAC+AR5ijEjFcS2CI0x/sIZqjyxz3o
KuwMPBt1cNWqBM5X02DgARP17rM8XcaDfFkasE3CZ94R01rLsuk+wZHlLzrvZqFv
8oipPXmMdtANCwyh8iOHVjjSlpjEFTxqBBaZYEkjdXBnMCXvorg=
=UdFQ
-----END PGP SIGNATURE-----