Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

RLSA-2026:29940 | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceRLSA-2026:29940

RLSA-2026:29940

HIGH7.5

Important: thunderbird security update

Published Jun 26, 2026

Modified 3 weeks ago

Fix available

Details

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

firefox: thunderbird: Sandbox escape in the DOM: Workers component (CVE-2026-12294)
firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12313)
firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12311)
firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12290)
firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12327)
firefox: thunderbird: JIT miscompilation in the DOM: Core & HTML component (CVE-2026-12299)
firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12329)
firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12312)
firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12302)
firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12328)
firefox: thunderbird: Incorrect boundary conditions in the Internationalization component (CVE-2026-12330)
firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12314)
firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12309)
firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12310)
firefox: thunderbird: Denial-of-service in the Graphics: ImageLib component (CVE-2026-12325)
firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-12295)
firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-12289)
firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12315)
firefox: thunderbird: Sandbox escape...

Affected Packages

thunderbird

Rocky Linux 9

Fixed in:

0:140.12.0-1.el9_8

References(30)

https://bugzilla.redhat.com/show_bug.cgi?id=2489207

https://bugzilla.redhat.com/show_bug.cgi?id=2489208

https://bugzilla.redhat.com/show_bug.cgi?id=2489209

https://bugzilla.redhat.com/show_bug.cgi?id=2489210

https://bugzilla.redhat.com/show_bug.cgi?id=2489211

https://bugzilla.redhat.com/show_bug.cgi?id=2489212

https://bugzilla.redhat.com/show_bug.cgi?id=2489214

https://bugzilla.redhat.com/show_bug.cgi?id=2489215

https://bugzilla.redhat.com/show_bug.cgi?id=2489217

https://bugzilla.redhat.com/show_bug.cgi?id=2489218

https://bugzilla.redhat.com/show_bug.cgi?id=2489220

https://bugzilla.redhat.com/show_bug.cgi?id=2489221

https://bugzilla.redhat.com/show_bug.cgi?id=2489223

https://bugzilla.redhat.com/show_bug.cgi?id=2489224

https://bugzilla.redhat.com/show_bug.cgi?id=2489225

https://bugzilla.redhat.com/show_bug.cgi?id=2489226

https://bugzilla.redhat.com/show_bug.cgi?id=2489229

https://bugzilla.redhat.com/show_bug.cgi?id=2489231

https://bugzilla.redhat.com/show_bug.cgi?id=2489232

https://bugzilla.redhat.com/show_bug.cgi?id=2489233

https://bugzilla.redhat.com/show_bug.cgi?id=2489234

https://bugzilla.redhat.com/show_bug.cgi?id=2489235

https://bugzilla.redhat.com/show_bug.cgi?id=2489236

https://bugzilla.redhat.com/show_bug.cgi?id=2489237

https://bugzilla.redhat.com/show_bug.cgi?id=2489239

CVSS Analysis

CVSS v3.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Upstream(29)

CVE-2026-12289 CVE-2026-12290 CVE-2026-12291 CVE-2026-12292 CVE-2026-12294 CVE-2026-12295 CVE-2026-12296 CVE-2026-12297 CVE-2026-12298 CVE-2026-12299 CVE-2026-12302 CVE-2026-12304 CVE-2026-12305 CVE-2026-12306 CVE-2026-12307 CVE-2026-12308 CVE-2026-12309 CVE-2026-12310 CVE-2026-12311 CVE-2026-12312 CVE-2026-12313 CVE-2026-12314 CVE-2026-12315 CVE-2026-12324 CVE-2026-12325

Ecosystems

Credits

Rocky Enterprise Software Foundation

Red Hat

Timeline

PublishedJun 26, 2026

ModifiedJul 5, 2026