Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

Vulnerability IntelligenceALSA-2026:6917

ALSA-2026:6917

UNKNOWN

Important: thunderbird security update

Published Apr 7, 2026

Modified 4 days ago

Fix available

Details

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701)
firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4721)
firefox: thunderbird: Privilege escalation in the Netmonitor component (CVE-2026-4717)
firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-4688)
firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4706)
firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4695)
firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4689)
firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-4698)
firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component (CVE-2026-4716)
firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component (CVE-2026-4684)
firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4705)
firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component (CVE-2026-4715)
firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4685)
firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4714)
firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-4709)
firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4710)
firefox: thunderbird: Information disclosure in the Widget: Cocoa component (CVE-2026-4712)
firefox: thunderbird: Incorrect...

Affected Packages

thunderbird

AlmaLinux 8

Fixed in:

140.9.0-1.el8_10.alma.1

References(41)

https://access.redhat.com/errata/RHSA-2026:6917

https://bugzilla.redhat.com/2450710

https://bugzilla.redhat.com/2450711

https://bugzilla.redhat.com/2450712

https://bugzilla.redhat.com/2450713

https://bugzilla.redhat.com/2450714

https://bugzilla.redhat.com/2450715

https://bugzilla.redhat.com/2450718

https://bugzilla.redhat.com/2450719

https://bugzilla.redhat.com/2450720

https://bugzilla.redhat.com/2450721

https://bugzilla.redhat.com/2450722

https://bugzilla.redhat.com/2450723

https://bugzilla.redhat.com/2450724

https://bugzilla.redhat.com/2450725

https://bugzilla.redhat.com/2450726

https://bugzilla.redhat.com/2450727

https://bugzilla.redhat.com/2450728

https://bugzilla.redhat.com/2450729

https://bugzilla.redhat.com/2450730

https://bugzilla.redhat.com/2450732

https://bugzilla.redhat.com/2450733

https://bugzilla.redhat.com/2450734

https://bugzilla.redhat.com/2450735

https://bugzilla.redhat.com/2450738

Related(39)

CVE-2026-3889 CVE-2026-4371 CVE-2026-4684 CVE-2026-4685 CVE-2026-4686 CVE-2026-4687 CVE-2026-4688 CVE-2026-4689 CVE-2026-4690 CVE-2026-4691 CVE-2026-4692 CVE-2026-4693 CVE-2026-4694 CVE-2026-4695 CVE-2026-4696 CVE-2026-4697 CVE-2026-4698 CVE-2026-4699 CVE-2026-4700 CVE-2026-4701 CVE-2026-4702 CVE-2026-4704 CVE-2026-4705 CVE-2026-4706 CVE-2026-4707

Ecosystems

Timeline

PublishedApr 7, 2026

ModifiedApr 15, 2026

ALSA-2026:6917 | Mondoo Vulnerability Intelligence