|
|
Log in / Subscribe / Register

SUSE alert openSUSE-SU-2026:21168-1 (thunderbird)

From:  null@suse.de
To:  security-announce@lists.opensuse.org
Subject:  openSUSE-SU-2026:21168-1: critical: Security update for MozillaThunderbird
Date:  Tue, 30 Jun 2026 09:48:43 +0200
Message-ID:  <20260630074843.3C693FF4B@maintenance.suse.de>
Archive-link:  Article

openSUSE security update: security update for mozillathunderbird ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21168-1 Rating: critical References: * bsc#1158957 * bsc#1263110 * bsc#1264378 * bsc#1265212 * bsc#1268071 Cross-References: * CVE-2026-12289 * CVE-2026-12290 * CVE-2026-12291 * CVE-2026-12292 * CVE-2026-12294 * CVE-2026-12295 * CVE-2026-12296 * CVE-2026-12297 * CVE-2026-12298 * CVE-2026-12299 * CVE-2026-12302 * CVE-2026-12304 * CVE-2026-12305 * CVE-2026-12306 * CVE-2026-12307 * CVE-2026-12308 * CVE-2026-12309 * CVE-2026-12310 * CVE-2026-12311 * CVE-2026-12312 * CVE-2026-12313 * CVE-2026-12314 * CVE-2026-12315 * CVE-2026-12324 * CVE-2026-12325 * CVE-2026-12327 * CVE-2026-12328 * CVE-2026-12329 * CVE-2026-12330 * CVE-2026-7320 * CVE-2026-7321 * CVE-2026-7322 * CVE-2026-7323 * CVE-2026-8090 * CVE-2026-8092 * CVE-2026-8094 * CVE-2026-8388 * CVE-2026-8391 * CVE-2026-8401 * CVE-2026-8946 * CVE-2026-8947 * CVE-2026-8949 * CVE-2026-8950 * CVE-2026-8953 * CVE-2026-8954 * CVE-2026-8955 * CVE-2026-8956 * CVE-2026-8957 * CVE-2026-8958 * CVE-2026-8959 * CVE-2026-8961 * CVE-2026-8962 * CVE-2026-8968 * CVE-2026-8970 * CVE-2026-8974 * CVE-2026-8975 CVSS scores: * CVE-2026-12290 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N * CVE-2026-12291 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-12292 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L * CVE-2026-12294 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-12295 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-12296 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-12297 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-12298 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N * CVE-2026-12299 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N * CVE-2026-12302 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-12304 ( SUSE ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-12305 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-12306 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2026-12307 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2026-12308 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2026-12309 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L * CVE-2026-12310 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-12311 ( SUSE ): 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N * CVE-2026-12312 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-12313 ( SUSE ): 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N * CVE-2026-12314 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-12315 ( SUSE ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-12324 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2026-12325 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-12327 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2026-12328 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2026-12329 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-12330 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N * CVE-2026-8090 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-8092 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-8094 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-8401 ( SUSE ): 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H * CVE-2026-8946 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-8947 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-8949 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L * CVE-2026-8950 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2026-8953 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L * CVE-2026-8954 ( SUSE ): 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L * CVE-2026-8955 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L * CVE-2026-8956 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L * CVE-2026-8957 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L * CVE-2026-8958 ( SUSE ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N * CVE-2026-8959 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L * CVE-2026-8961 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2026-8962 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N * CVE-2026-8968 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2026-8970 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L * CVE-2026-8974 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-8975 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves 56 vulnerabilities and has 5 bug fixes can now be installed. Description: This update for MozillaThunderbird fixes the following issues: Changes in MozillaThunderbird: - Mozilla Thunderbird 140.12.0 ESR MFSA 2026-61 (bsc#1268071) * CVE-2026-12289 (bmo#2023443) Privilege escalation in the Graphics: WebRender component * CVE-2026-12290 (bmo#2024852) Memory safety bug fixed in Thunderbird ESR 140.12 * CVE-2026-12291 (bmo#2036929) Use-after-free in the Networking: HTTP component * CVE-2026-12292 (bmo#2038465) Incorrect boundary conditions in the Web Audio component * CVE-2026-12294 (bmo#2039873) Sandbox escape in the DOM: Workers component * CVE-2026-12295 (bmo#2040160) Sandbox escape in the DOM: Navigation component * CVE-2026-12298 (bmo#2041981) Memory safety bug fixed in Thunderbird ESR 140.12 * CVE-2026-12296 (bmo#2040515) Sandbox escape in the Security: Process Sandboxing component * CVE-2026-12297 (bmo#2041610) Sandbox escape due to incorrect boundary conditions in the Networking component * CVE-2026-12299 (bmo#2043139) JIT miscompilation in the DOM: Core & HTML component * CVE-2026-12329 (bmo#2044738) Memory safety bug fixed in Thunderbird ESR 140.12 * CVE-2026-12302 (bmo#2034489) Mitigation bypass in the DOM: Security component * CVE-2026-12304 (bmo#2034944) Same-origin policy bypass in the Networking: Cookies component * CVE-2026-12305 (bmo#2037290) Memory safety bug fixed in Thunderbird ESR 140.12 * CVE-2026-12306 (bmo#2037323) Memory safety bug fixed in Thunderbird ESR 140.12 * CVE-2026-12307 (bmo#2038133) Memory safety bug fixed in Thunderbird ESR 140.12 * CVE-2026-12308 (bmo#2038302) Memory safety bug fixed in Thunderbird ESR 140.12 * CVE-2026-12309 (bmo#2038476) Memory safety bug fixed in Thunderbird ESR 140.12 * CVE-2026-12310 (bmo#2039707) Memory safety bug fixed in Thunderbird ESR 140.12 * CVE-2026-12311 (bmo#2040177) Information disclosure, sandbox escape in the Security: Process Sandboxing component * CVE-2026-12312 (bmo#2040383) Memory safety bug fixed in Thunderbird ESR 140.12 * CVE-2026-12313 (bmo#2040477) Information disclosure, sandbox escape in the Security: Process Sandboxing component * CVE-2026-12314 (bmo#2041856) Memory safety bug fixed in Thunderbird ESR 140.12 * CVE-2026-12315 (bmo#2042058) Mitigation bypass in the DOM: Security component * CVE-2026-12330 (bmo#2029326) Incorrect boundary conditions in the Internationalization component * CVE-2026-12324 (bmo#2038444) Incorrect boundary conditions in the Graphics: CanvasWebGL component * CVE-2026-12325 (bmo#2039443) Denial-of-service in the Graphics: ImageLib component * CVE-2026-12327 (bmo#2011842, bmo#2023902, bmo#2025512, bmo#2027312, bmo#2029444, bmo#2036571, bmo#2036900, bmo#2036936, bmo#2037995, bmo#2038551, bmo#2040717, bmo#2042724) Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 * CVE-2026-12328 (bmo#2029402, bmo#2038477, bmo#2039726, bmo#2041373, bmo#2042268, bmo#2042451, bmo#2042782, bmo#2042858, bmo#2042929, bmo#2042965, bmo#2043213) Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 - Mozilla Thunderbird 140.11.0 ESR MFSA 2026-51 (bsc#1265212) * CVE-2026-8946 (bmo#2029070) Incorrect boundary conditions in the Audio/Video: Web Codecs component * CVE-2026-8388 (bmo#2036978) Incorrect boundary conditions in the JavaScript Engine: JIT component * CVE-2026-8947 (bmo#2038439) Use-after-free in the DOM: Bindings (WebIDL) component * CVE-2026-8391 (bmo#2038575) Other issue in the JavaScript Engine component * CVE-2026-8401 (bmo#2038679) Sandbox escape in the Profile Backup component * CVE-2026-8949 (bmo#1355639) Integer overflow in the Widget: Win32 component * CVE-2026-8950 (bmo#1965430) Same-origin policy bypass in the Networking: HTTP component * CVE-2026-8953 (bmo#2029511) Sandbox escape due to use-after-free in the Disability Access APIs component * CVE-2026-8954 (bmo#2030747) Incorrect boundary conditions, integer overflow in the Audio/Video component * CVE-2026-8955 (bmo#2031064) Privilege escalation in the DOM: Workers component * CVE-2026-8956 (bmo#2032427) Integer overflow in the Networking: JAR component * CVE-2026-8957 (bmo#2033850) Privilege escalation in the Enterprise Policies component * CVE-2026-8958 (bmo#2034713) Information disclosure, sandbox escape in the Security: Process Sandboxing component * CVE-2026-8959 (bmo#2034754) Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component * CVE-2026-8961 (bmo#1962625) Spoofing issue in the Form Autofill component * CVE-2026-8962 (bmo#2004804) Mitigation bypass in the DOM: Security component * CVE-2026-8968 (bmo#2030467) Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component * CVE-2026-8970 (bmo#2032174) Privilege escalation in the Security component * CVE-2026-8974 (bmo#1784128, bmo#1883230, bmo#1983677, bmo#2022390, bmo#2023116, bmo#2023657, bmo#2024255, bmo#2024418, bmo#2024441, bmo#2024447, bmo#2024966, bmo#2025412, bmo#2025467, bmo#2025940, bmo#2025950, bmo#2025956, bmo#2026284, bmo#2027247, bmo#2027255, bmo#2027288, bmo#2027306, bmo#2027322, bmo#2027332, bmo#2027333, bmo#2028266, bmo#2028292, bmo#2028319, bmo#2028526, bmo#2028870, bmo#2028876, bmo#2028882, bmo#2029062, bmo#2029309, bmo#2029414, bmo#2029422, bmo#2029428, bmo#2029447, bmo#2029732, bmo#2029785, bmo#2029793, bmo#2029813, bmo#2029899, bmo#2031028, bmo#2031457, bmo#2032039, bmo#2033610, bmo#2033854, bmo#2034498, bmo#2034628, bmo#2034978, bmo#2035966, bmo#2036668, bmo#2036905, bmo#2036930) Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151 * CVE-2026-8975 (bmo#1860195, bmo#2029325, bmo#2029429, bmo#2029910, bmo#2035915, bmo#2038669, bmo#2038678) Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151 - Mozilla Thunderbird 140.10.2 MFSA 2026-44 (bsc#1264378) * CVE-2026-8090 (bmo#2034352) Use-after-free in the DOM: Networking component * CVE-2026-8094 (bmo#2035939) Other issue in the WebRTC component * CVE-2026-8092 (bmo#1806249, bmo#2021977, bmo#2022576, bmo#2022722, bmo#2024439, bmo#2027883, bmo#2029463, bmo#2030323, bmo#2032042, bmo#2032043, bmo#2033270, bmo#2033637, bmo#2034422, bmo#2034496, bmo#2035879, bmo#2036516) Memory safety bugs fixed in Thunderbird ESR 140.10.2 and Thunderbird 150.0.2 - Mozilla Thunderbird 140.10.1 ESR MFSA 2026-39 (bsc#1263110) * CVE-2026-7320 (bmo#2027433) Information disclosure due to incorrect boundary conditions in the Audio/Video component * CVE-2026-7321 (bmo#2029461) Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component * CVE-2026-7322 (bmo#2021904, bmo#2022731, bmo#2027158, bmo#2027733, bmo#2027973, bmo#2027976, bmo#2028231, bmo#2028731, bmo#2028886, bmo#2029067, bmo#2029700, bmo#2029724, bmo#2029806, bmo#2029814, bmo#2030108, bmo#2030111, bmo#2031524, bmo#2031921, bmo#2032040) Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 * CVE-2026-7323 (bmo#2028537, bmo#2029911, bmo#2031121, bmo#2033602) Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 Patch instructions: To install this openSUSE security update use the suse recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 16.0 zypper in -t patch openSUSE-Leap-16.0-packagehub-363=1 Package List: - openSUSE Leap 16.0: MozillaThunderbird-140.12.0-bp160.1.1 MozillaThunderbird-openpgp-librnp-140.12.0-bp160.1.1 MozillaThunderbird-translations-common-140.12.0-bp160.1.1 MozillaThunderbird-translations-other-140.12.0-bp160.1.1 References: * https://www.suse.com/security/cve/CVE-2026-12289.html * https://www.suse.com/security/cve/CVE-2026-12290.html * https://www.suse.com/security/cve/CVE-2026-12291.html * https://www.suse.com/security/cve/CVE-2026-12292.html * https://www.suse.com/security/cve/CVE-2026-12294.html * https://www.suse.com/security/cve/CVE-2026-12295.html * https://www.suse.com/security/cve/CVE-2026-12296.html * https://www.suse.com/security/cve/CVE-2026-12297.html * https://www.suse.com/security/cve/CVE-2026-12298.html * https://www.suse.com/security/cve/CVE-2026-12299.html * https://www.suse.com/security/cve/CVE-2026-12302.html * https://www.suse.com/security/cve/CVE-2026-12304.html * https://www.suse.com/security/cve/CVE-2026-12305.html * https://www.suse.com/security/cve/CVE-2026-12306.html * https://www.suse.com/security/cve/CVE-2026-12307.html * https://www.suse.com/security/cve/CVE-2026-12308.html * https://www.suse.com/security/cve/CVE-2026-12309.html * https://www.suse.com/security/cve/CVE-2026-12310.html * https://www.suse.com/security/cve/CVE-2026-12311.html * https://www.suse.com/security/cve/CVE-2026-12312.html * https://www.suse.com/security/cve/CVE-2026-12313.html * https://www.suse.com/security/cve/CVE-2026-12314.html * https://www.suse.com/security/cve/CVE-2026-12315.html * https://www.suse.com/security/cve/CVE-2026-12324.html * https://www.suse.com/security/cve/CVE-2026-12325.html * https://www.suse.com/security/cve/CVE-2026-12327.html * https://www.suse.com/security/cve/CVE-2026-12328.html * https://www.suse.com/security/cve/CVE-2026-12329.html * https://www.suse.com/security/cve/CVE-2026-12330.html * https://www.suse.com/security/cve/CVE-2026-7320.html * https://www.suse.com/security/cve/CVE-2026-7321.html * https://www.suse.com/security/cve/CVE-2026-7322.html * https://www.suse.com/security/cve/CVE-2026-7323.html * https://www.suse.com/security/cve/CVE-2026-8090.html * https://www.suse.com/security/cve/CVE-2026-8092.html * https://www.suse.com/security/cve/CVE-2026-8094.html * https://www.suse.com/security/cve/CVE-2026-8388.html * https://www.suse.com/security/cve/CVE-2026-8391.html * https://www.suse.com/security/cve/CVE-2026-8401.html * https://www.suse.com/security/cve/CVE-2026-8946.html * https://www.suse.com/security/cve/CVE-2026-8947.html * https://www.suse.com/security/cve/CVE-2026-8949.html * https://www.suse.com/security/cve/CVE-2026-8950.html * https://www.suse.com/security/cve/CVE-2026-8953.html * https://www.suse.com/security/cve/CVE-2026-8954.html * https://www.suse.com/security/cve/CVE-2026-8955.html * https://www.suse.com/security/cve/CVE-2026-8956.html * https://www.suse.com/security/cve/CVE-2026-8957.html * https://www.suse.com/security/cve/CVE-2026-8958.html * https://www.suse.com/security/cve/CVE-2026-8959.html * https://www.suse.com/security/cve/CVE-2026-8961.html * https://www.suse.com/security/cve/CVE-2026-8962.html * https://www.suse.com/security/cve/CVE-2026-8968.html * https://www.suse.com/security/cve/CVE-2026-8970.html * https://www.suse.com/security/cve/CVE-2026-8974.html * https://www.suse.com/security/cve/CVE-2026-8975.html


to post comments


Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds