RHSA-2026:38753

Details:

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

• firefox: thunderbird: Sandbox escape in the DOM: Workers component (CVE-2026-12294)

• firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12313)

• firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12311)

• firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12290)

• firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12327)

• firefox: thunderbird: JIT miscompilation in the DOM: Core & HTML component (CVE-2026-12299)

• firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12329)

• firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12312)

• firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12302)

• firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12328)

• firefox: thunderbird: Incorrect boundary conditions in the Internationalization component (CVE-2026-12330)

• firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12314)

• firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12309)

• firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12310)

• firefox: thunderbird: Denial-of-service in the Graphics: ImageLib component (CVE-2026-12325)

• firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-12295)

• firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-12289)

• firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12315)

• firefox: thunderbird:...