{"id":"SUSE-SU-2026:4736-1","summary":"Security update for MozillaThunderbird","details":"This update for MozillaThunderbird fixes the following issues:\n\nUpdate to Mozilla Thunderbird 153.5 (MFSA 2026-110, bsc#1284493):\n\n- CVE-2026-109704: Privilege escalation in the Application Update component.\n- CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the\n  Networking component.\n- CVE-2026-109706: Use-after-free in the Storage: IndexedDB component.\n- CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component.\n- CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component.\n- CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component.\n- CVE-2026-109710: Use-after-free in the Graphics: Text component.\n- CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component.\n- CVE-2026-109713: Use-after-free in the Crash Reporting component.\n- CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component.\n- CVE-2026-109718: Use-after-free in the XML component.\n- CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component.\n- CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component.\n- CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component.\n- CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component.\n- CVE-2026-109724: Use-after-free in the DOM: Core & HTML component.\n- CVE-2026-109725: Use-after-free in the DOM: Core & HTML component.\n- CVE-2026-109726: Use-after-free in the SVG component.\n- CVE-2026-109727: Use-after-free in the Audio/Video component.\n- CVE-2026-109728: Use-after-free in the DOM: Animation component.\n- CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component.\n- CVE-2026-109730: Integer overflow in the Graphics component.\n- CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component.\n- CVE-2026-109732: Use-after-free in the DOM: Streams component.\n- CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109734: Mitigation bypass in the DOM: Security component.\n- CVE-2026-109736: Frame poisoning in the Layout component.\n- CVE-2026-109737: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109738: Use-after-free in the Audio/Video: Playback component.\n- CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.\n- CVE-2026-109741: Use-after-free in the Storage: Bucket File System component.\n- CVE-2026-109742: Information disclosure in the PDF Viewer component.\n- CVE-2026-109743: Privilege escalation in the Panning and Zooming component.\n- CVE-2026-109744: Other issue in the DOM: File component.\n- CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component.\n- CVE-2026-109751: Information disclosure in the Networking component.\n- CVE-2026-109752: Use-after-free in the DOM: Workers component.\n- CVE-2026-109753: Incorrect boundary conditions in the Layout component.\n- CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component.\n- CVE-2026-109756: Privilege escalation in the DOM: Navigation component.\n- CVE-2026-109757: Sandbox escape due to race condition in the Networking component.\n- CVE-2026-109759: Site isolation issue in the Networking component.\n- CVE-2026-109760: Mitigation bypass in the Networking: HTTP component.\n- CVE-2026-109762: Incorrect boundary conditions in the SVG component.\n- CVE-2026-109763: Mitigation bypass in the File Handling component.\n- CVE-2026-109764: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component.\n- CVE-2026-109766: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109767: Information disclosure in the Networking component.\n- CVE-2026-109770: Spoofing issue in the DOM: Web Serial component.\n- CVE-2026-109775: Denial-of-service in the WebRTC component.\n- CVE-2026-109776: Race condition in the XPCOM component.\n- CVE-2026-109777: Information disclosure in the Storage: IndexedDB component.\n- CVE-2026-109778: Privilege escalation in the WebExtensions component.\n- CVE-2026-109781: Denial-of-service in the Printing: Output component.\n- CVE-2026-109782: Mitigation bypass in the File Handling component.\n- CVE-2026-109783: Mitigation bypass in the File Handling component.\n- CVE-2026-110249: Denial-of-service in the Exchange email component.\n\nlibexpat updated:\n \n- CVE-2026-50219: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking in libexpat could lead to information disclosure, integrity loss, or denial of service (bsc#1275108).\n- CVE-2026-56131: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking for XML_ResumeParser in libexpat could lead to denial of service (bsc#1275108).\n- CVE-2026-56132: libexpat: Heap buffer overflow in doProlog due to mishandled array reallocation in libexpat could lead to denial of service or memory corruption (bsc#1275108).\n- CVE-2026-56403: libexpat: Integer overflow vulnerability in the storeAtts attribute parsing function in libexpat could lead to memory corruption (bsc#1275108).\n- CVE-2026-56404: libexpat: Integer overflow vulnerability in the addBinding routine of libexpat could lead to memory corruption and potential security risks (bsc#1275108).\n- CVE-2026-56405: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275108).\n- CVE-2026-56406: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275108).\n- CVE-2026-56407: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275108).\n- CVE-2026-56408: libexpat: Integer overflow vulnerability in the copyString function in libexpat could lead to memory corruption (bsc#1275108).\n- CVE-2026-56409: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275108).\n- CVE-2026-56410: libexpat: Integer overflow vulnerability in the xmlwf utility of libexpat could lead to denial of service (bsc#1275108).\n- CVE-2026-56411: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275108).\n- CVE-2026-56412: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking in libexpat could lead to denial of service or memory corruption (bsc#1275108).\n- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c (bsc#1275736).\n- CVE-2026-72522: libexpat: Out-of-bounds read and resultant infinite loop in the Unicode processing functions in libexpat allowed attackers to cause denial of service (bsc#1275605).\n- CVE-2026-76641: libexpat: Out-of-bounds read vulnerability caused by a struct size mismatch in libexpat allowed attackers to trigger memory corruption or a crash (bsc#1275736).\n- CVE-2026-76956: libexpat: Insufficient entropy caused by misinterpretation of getentropy's return code in libexpat allowed attackers to cause a denial of service via hash flooding attacks (bsc#1275736).\n- CVE-2026-76957: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking with custom encoding callbacks in libexpat could lead to memory corruption (bsc#1275736).\n- CVE-2026-93990: libexpat: Improper handling of lone high surrogates in UTF-16 encoded XML in libexpat allowed attackers to pass unpaired surrogates or silently replace input characters (bsc#1282347).\n","modified":"2026-10-20T10:45:04.268837647Z","published":"2026-10-19T12:57:04Z","related":["CVE-2026-109704","CVE-2026-109705","CVE-2026-109706","CVE-2026-109707","CVE-2026-109708","CVE-2026-109709","CVE-2026-109710","CVE-2026-109711","CVE-2026-109712","CVE-2026-109713","CVE-2026-109715","CVE-2026-109716","CVE-2026-109717","CVE-2026-109718","CVE-2026-109719","CVE-2026-109720","CVE-2026-109721","CVE-2026-109722","CVE-2026-109723","CVE-2026-109724","CVE-2026-109725","CVE-2026-109726","CVE-2026-109727","CVE-2026-109728","CVE-2026-109729","CVE-2026-109730","CVE-2026-109731","CVE-2026-109732","CVE-2026-109733","CVE-2026-109734","CVE-2026-109736","CVE-2026-109737","CVE-2026-109738","CVE-2026-109740","CVE-2026-109741","CVE-2026-109742","CVE-2026-109743","CVE-2026-109744","CVE-2026-109745","CVE-2026-109751","CVE-2026-109752","CVE-2026-109753","CVE-2026-109754","CVE-2026-109756","CVE-2026-109757","CVE-2026-109759","CVE-2026-109760","CVE-2026-109762","CVE-2026-109763","CVE-2026-109764","CVE-2026-109765","CVE-2026-109766","CVE-2026-109767","CVE-2026-109770","CVE-2026-109775","CVE-2026-109776","CVE-2026-109777","CVE-2026-109778","CVE-2026-109781","CVE-2026-109782","CVE-2026-109783","CVE-2026-110249","CVE-2026-32776","CVE-2026-32777","CVE-2026-32778","CVE-2026-41080","CVE-2026-45186","CVE-2026-50219","CVE-2026-56131","CVE-2026-56132","CVE-2026-56403","CVE-2026-56404","CVE-2026-56405","CVE-2026-56406","CVE-2026-56407","CVE-2026-56408","CVE-2026-56409","CVE-2026-56410","CVE-2026-56411","CVE-2026-56412","CVE-2026-66046","CVE-2026-72522","CVE-2026-76641","CVE-2026-76956","CVE-2026-76957","CVE-2026-93990"],"upstream":["CVE-2026-109704","CVE-2026-109705","CVE-2026-109706","CVE-2026-109707","CVE-2026-109708","CVE-2026-109709","CVE-2026-109710","CVE-2026-109711","CVE-2026-109712","CVE-2026-109713","CVE-2026-109715","CVE-2026-109716","CVE-2026-109717","CVE-2026-109718","CVE-2026-109719","CVE-2026-109720","CVE-2026-109721","CVE-2026-109722","CVE-2026-109723","CVE-2026-109724","CVE-2026-109725","CVE-2026-109726","CVE-2026-109727","CVE-2026-109728","CVE-2026-109729","CVE-2026-109730","CVE-2026-109731","CVE-2026-109732","CVE-2026-109733","CVE-2026-109734","CVE-2026-109736","CVE-2026-109737","CVE-2026-109738","CVE-2026-109740","CVE-2026-109741","CVE-2026-109742","CVE-2026-109743","CVE-2026-109744","CVE-2026-109745","CVE-2026-109751","CVE-2026-109752","CVE-2026-109753","CVE-2026-109754","CVE-2026-109756","CVE-2026-109757","CVE-2026-109759","CVE-2026-109760","CVE-2026-109762","CVE-2026-109763","CVE-2026-109764","CVE-2026-109765","CVE-2026-109766","CVE-2026-109767","CVE-2026-109770","CVE-2026-109775","CVE-2026-109776","CVE-2026-109777","CVE-2026-109778","CVE-2026-109781","CVE-2026-109782","CVE-2026-109783","CVE-2026-110249","CVE-2026-32776","CVE-2026-32777","CVE-2026-32778","CVE-2026-41080","CVE-2026-45186","CVE-2026-50219","CVE-2026-56131","CVE-2026-56132","CVE-2026-56403","CVE-2026-56404","CVE-2026-56405","CVE-2026-56406","CVE-2026-56407","CVE-2026-56408","CVE-2026-56409","CVE-2026-56410","CVE-2026-56411","CVE-2026-56412","CVE-2026-66046","CVE-2026-72522","CVE-2026-76641","CVE-2026-76956","CVE-2026-76957","CVE-2026-93990"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264736-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1259712"},{"type":"REPORT","url":"https://bugzilla.suse.com/1259727"},{"type":"REPORT","url":"https://bugzilla.suse.com/1259730"},{"type":"REPORT","url":"https://bugzilla.suse.com/1262263"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264713"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275108"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275605"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275736"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282347"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284493"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109704"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109705"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109706"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109707"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109708"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109709"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109710"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109711"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109712"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109713"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109715"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109716"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109717"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109718"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109719"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109720"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109721"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109722"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109723"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109724"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109725"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109726"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109727"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109728"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109729"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109730"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109731"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109732"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109733"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109734"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109736"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109737"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109738"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109740"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109741"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109742"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109743"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109744"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109745"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109751"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109752"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109753"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109754"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109756"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109757"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109759"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109760"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109762"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109763"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109764"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109765"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109766"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109767"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109770"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109775"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109776"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109777"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109778"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109781"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109782"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-109783"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110249"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-32776"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-32777"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-32778"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-41080"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-45186"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-50219"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56131"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56132"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56403"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56404"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56405"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56406"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56407"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56408"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56409"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56410"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56411"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56412"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-66046"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-72522"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-76641"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-76956"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-76957"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93990"}],"affected":[{"package":{"name":"MozillaThunderbird","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","purl":"pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.13.9.1"}]}],"ecosystem_specific":{"binaries":[{"MozillaThunderbird-translations-other":"153.5.0-150400.13.9.1","MozillaThunderbird":"153.5.0-150400.13.9.1","MozillaThunderbird-translations-common":"153.5.0-150400.13.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4736-1.json"}},{"package":{"name":"MozillaThunderbird","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","purl":"pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.13.9.1"}]}],"ecosystem_specific":{"binaries":[{"MozillaThunderbird-translations-other":"153.5.0-150400.13.9.1","MozillaThunderbird":"153.5.0-150400.13.9.1","MozillaThunderbird-translations-common":"153.5.0-150400.13.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4736-1.json"}}],"schema_version":"1.9.1"}