Advisories ยป MGASA-2026-0583

Updated thunderbird package fixes security vulnerabilities

Publication date: 09 Nov 2026
Modification date: 09 Nov 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-118174 , CVE-2026-118175 , CVE-2026-118176 , CVE-2026-118177 , CVE-2026-118178 , CVE-2026-118179 , CVE-2026-118180 , CVE-2026-110247 , CVE-2026-113869 , CVE-2026-117860 , CVE-2026-117861 , CVE-2026-117862 , CVE-2026-117863 , CVE-2026-117864 , CVE-2026-117865 , CVE-2026-117866 , CVE-2026-117867 , CVE-2026-117868 , CVE-2026-117869 , CVE-2026-117870 , CVE-2026-117871 , CVE-2026-117872 , CVE-2026-117873 , CVE-2026-117874 , CVE-2026-117875 , CVE-2026-117876 , CVE-2026-117877 , CVE-2026-117878 , CVE-2026-117879 , CVE-2026-117880 , CVE-2026-117881 , CVE-2026-117882 , CVE-2026-117883 , CVE-2026-117884 , CVE-2026-117885 , CVE-2026-117886 , CVE-2026-117887 , CVE-2026-117888 , CVE-2026-117889 , CVE-2026-117890 , CVE-2026-117891 , CVE-2026-117892 , CVE-2026-117893 , CVE-2026-117894 , CVE-2026-117895 , CVE-2026-117896 , CVE-2026-117897 , CVE-2026-117898 , CVE-2026-117899 , CVE-2026-117900 , CVE-2026-117901 , CVE-2026-117902 , CVE-2026-117903 , CVE-2026-117904 , CVE-2026-117905 , CVE-2026-117906 , CVE-2026-117907 , CVE-2026-117908 , CVE-2026-117909 , CVE-2026-117910 , CVE-2026-117911 , CVE-2026-117912 , CVE-2026-117913 , CVE-2026-117914 , CVE-2026-117915 , CVE-2026-117916 , CVE-2026-117917 , CVE-2026-117918 , CVE-2026-117919 , CVE-2026-117920 , CVE-2026-117921 , CVE-2026-117922 , CVE-2026-117923 , CVE-2026-117924 , CVE-2026-117925 , CVE-2026-117926 , CVE-2026-117927 , CVE-2026-117928 , CVE-2026-117929 , CVE-2026-117930 , CVE-2026-117931 , CVE-2026-117932 , CVE-2026-117933 , CVE-2026-117934 , CVE-2026-117935 , CVE-2026-117936 , CVE-2026-117937 , CVE-2026-117938 , CVE-2026-117939 , CVE-2026-117940 , CVE-2026-117941 , CVE-2026-117942 , CVE-2026-117943 , CVE-2026-117944 , CVE-2026-117945 , CVE-2026-117946 , CVE-2026-117947 , CVE-2026-117948 , CVE-2026-117949 , CVE-2026-117950 , CVE-2026-117951 , CVE-2026-117952 , CVE-2026-117953 , CVE-2026-117954 , CVE-2026-117955 , CVE-2026-100801 , CVE-2026-117956 , CVE-2026-117957 , CVE-2026-117958 , CVE-2026-117959 , CVE-2026-117960 , CVE-2026-117961 , CVE-2026-117962 , CVE-2026-117963 , CVE-2026-117964 , CVE-2026-117965 , CVE-2026-117966 , CVE-2026-117967 , CVE-2026-117968 , CVE-2026-117969 , CVE-2026-117970 , CVE-2026-117971 , CVE-2026-117972 , CVE-2026-117973 , CVE-2026-117974 , CVE-2026-117975 , CVE-2026-117976 , CVE-2026-117977 , CVE-2026-117978 , CVE-2026-117979 , CVE-2026-117980 , CVE-2026-117981 , CVE-2026-117982 , CVE-2026-117983 , CVE-2026-117984 , CVE-2026-117985 , CVE-2026-117986 , CVE-2026-117987 , CVE-2026-117988 , CVE-2026-117989 , CVE-2026-117990 , CVE-2026-117991 , CVE-2026-117992 , CVE-2026-117993 , CVE-2026-117994 , CVE-2026-117995 , CVE-2026-117996 , CVE-2026-117997 , CVE-2026-117998 , CVE-2026-117999 , CVE-2026-118000 , CVE-2026-118002 , CVE-2026-118003 , CVE-2026-118004

Description

Displaying a message could load an attacker-chosen URL through an
OpenPGP key attachment. (CVE-2026-118174)
Content of other messages could be included when replying to a crafted
message. (CVE-2026-118175)
Bypass of remote UNC path restriction in mailbox: URLs.
(CVE-2026-118176)
Calendar discovery accepted local file and remote network share
locations. (CVE-2026-118177)
RSS feed could redirect its subscription to a local file or network
share. (CVE-2026-118178)
Request forgery via news: links. (CVE-2026-118179)
Matrix homeserver could redirect the chat session to a local file or
network share. (CVE-2026-118180)
Integer overflow in libmime buffer growth could lead to heap corruption.
(CVE-2026-110247)
Use-after-free in S/MIME decryption during a security device password
prompt. (CVE-2026-113869)
Same-origin policy bypass in the DOM: Navigation component.
(CVE-2026-117860)
Sandbox escape in the DOM: Navigation component. (CVE-2026-117861)
Privilege escalation due to incorrect boundary conditions in the
Networking component. (CVE-2026-117862)
Information disclosure due to uninitialized memory in the Audio/Video
component. (CVE-2026-117863)
Sandbox escape in the Form Manager component. (CVE-2026-117864)
Use-after-free in the JavaScript: GC component. (CVE-2026-117865)
Privilege escalation due to use-after-free in the Graphics: Canvas2D
component. (CVE-2026-117866)
Use-after-free in the Layout component. (CVE-2026-117867)
Sandbox escape in the DOM: Networking component. (CVE-2026-117868)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-117869)
Use-after-free in the JavaScript Engine component. (CVE-2026-117870)
Invalid pointer in the Graphics component. (CVE-2026-117871)
Use-after-free in the JavaScript: Standard Library component.
(CVE-2026-117872)
Incorrect boundary conditions in the Audio/Video: Playback component.
(CVE-2026-117873)
Use-after-free in the Internationalization component. (CVE-2026-117874)
Use-after-free in the Layout: Scrolling and Overflow component.
(CVE-2026-117875)
Use-after-free in the Layout: Text and Fonts component.
(CVE-2026-117876)
Use-after-free in the Layout: Text and Fonts component.
(CVE-2026-117877)
Other issue, use-after-free in the Storage: IndexedDB component.
(CVE-2026-117878)
Incorrect boundary conditions in the Layout: Tables component.
(CVE-2026-117879)
Use-after-free in the XML component. (CVE-2026-117880)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-117881)
Use-after-free in the Layout component. (CVE-2026-117882)
Use-after-free in the DOM: HTML Parser component. (CVE-2026-117883)
Use-after-free in the Networking component. (CVE-2026-117884)
Use-after-free in the Layout: Grid component. (CVE-2026-117885)
Incorrect boundary conditions in the Graphics: Text component.
(CVE-2026-117886)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-117887)
Uninitialized memory in the Graphics: Canvas2D component.
(CVE-2026-117888)
Incorrect boundary conditions in the JavaScript Engine component.
(CVE-2026-117889)
JIT miscompilation in the JavaScript Engine: JIT component.
(CVE-2026-117890)
Use-after-free in the JavaScript Engine: JIT component.
(CVE-2026-117891)
Privilege escalation due to use-after-free in the WebRTC: Networking
component. (CVE-2026-117892)
Incorrect boundary conditions in the Security: PSM component.
(CVE-2026-117893)
Incorrect boundary conditions in the WebRTC: Signaling component.
(CVE-2026-117894)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-117895)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-117896)
Incorrect boundary conditions in the Layout: Tables component.
(CVE-2026-117897)
Use-after-free in the JavaScript Engine: JIT component.
(CVE-2026-117898)
Use-after-free in the Networking: HTTP component. (CVE-2026-117899)
Use-after-free in the DOM: Editor component. (CVE-2026-117900)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-117901)
Use-after-free in the Layout: Text and Fonts component.
(CVE-2026-117902)
Use-after-free in the Audio/Video component. (CVE-2026-117903)
Use-after-free in the JavaScript: GC component. (CVE-2026-117904)
Use-after-free in the Audio/Video: Playback component. (CVE-2026-117905)
Use-after-free in the CSS Parsing and Computation component.
(CVE-2026-117906)
Use-after-free in the Networking component. (CVE-2026-117907)
Use-after-free in the Graphics: ImageLib component. (CVE-2026-117908)
Use-after-free in the JavaScript: GC component. (CVE-2026-117909)
Invalid pointer in the JavaScript Engine component. (CVE-2026-117910)
Use-after-free in the Audio/Video: Playback component. (CVE-2026-117911)
Same-origin policy bypass in the CSS Parsing and Computation component.
(CVE-2026-117912)
Use-after-free in the SVG component. (CVE-2026-117913)
Use-after-free in the SVG component. (CVE-2026-117914)
Incorrect boundary conditions in the Layout: Block and Inline component.
(CVE-2026-117915)
Use-after-free in the XSLT component. (CVE-2026-117916)
Invalid pointer in the Graphics: WebRender component. (CVE-2026-117917)
Use-after-free in the Graphics: Canvas2D component. (CVE-2026-117918)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-117919)
Use-after-free in the DOM: HTML Parser component. (CVE-2026-117920)
Use-after-free in the CSS Parsing and Computation component.
(CVE-2026-117921)
Use-after-free in the Networking: WebSockets component.
(CVE-2026-117922)
Use-after-free in the Audio/Video component. (CVE-2026-117923)
Use-after-free in the XSLT component. (CVE-2026-117924)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-117925)
Incorrect boundary conditions in the SVG component. (CVE-2026-117926)
Use-after-free in the SVG component. (CVE-2026-117927)
Same-origin policy bypass in the CSS Parsing and Computation component.
(CVE-2026-117928)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-117929)
Use-after-free in the DOM: Bindings (WebIDL) component.
(CVE-2026-117930)
Use-after-free in the DOM: Events component. (CVE-2026-117931)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-117932)
Frame poisoning in the CSS Parsing and Computation component.
(CVE-2026-117933)
Use-after-free in the Layout component. (CVE-2026-117934)
Use-after-free in the DOM: Bindings (WebIDL) component.
(CVE-2026-117935)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-117936)
Invalid pointer in the JavaScript Engine component. (CVE-2026-117937)
Use-after-free in the Layout component. (CVE-2026-117938)
Use-after-free in the XML component. (CVE-2026-117939)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-117940)
Use-after-free in the DOM: CSS Object Model component. (CVE-2026-117941)
Incorrect boundary conditions in the JavaScript Engine: JIT component.
(CVE-2026-117942)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-117943)
Use-after-free in the Layout component. (CVE-2026-117944)
Incorrect boundary conditions in the XML component. (CVE-2026-117945)
Incorrect boundary conditions in the JavaScript Engine component.
(CVE-2026-117946)
Use-after-free in the XML component. (CVE-2026-117947)
Use-after-free in the SVG component. (CVE-2026-117948)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-117949)
Incorrect boundary conditions in the DOM: Core & HTML component.
(CVE-2026-117950)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-117951)
Uninitialized memory in the Networking component. (CVE-2026-117952)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-117953)
Use-after-free in the Layout: Positioned component. (CVE-2026-117954)
JIT miscompilation in the JavaScript: WebAssembly component.
(CVE-2026-117955)
Privilege escalation in the DLL Services component. (CVE-2026-100801)
Invalid pointer in the Nimbus Desktop Client component.
(CVE-2026-117956)
Cryptographic issue in the WebRTC: Networking component.
(CVE-2026-117957)
Site isolation issue in the Networking: HTTP component.
(CVE-2026-117958)
Site isolation issue in the DOM: Service Workers component.
(CVE-2026-117959)
Spoofing issue in the DOM: Core & HTML component. (CVE-2026-117960)
Incorrect boundary conditions in the Layout: Text and Fonts component.
(CVE-2026-117961)
Sandbox escape due to incorrect boundary conditions in the Storage:
Quota Manager component. (CVE-2026-117962)
Incorrect boundary conditions in the DOM: Service Workers component.
(CVE-2026-117963)
Use-after-free in the Panning and Zooming component. (CVE-2026-117964)
Same-origin policy bypass in the Address Bar component.
(CVE-2026-117965)
Site isolation issue in the Networking: HTTP component.
(CVE-2026-117966)
Mitigation bypass in the DOM: Security component. (CVE-2026-117967)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-117968)
Invalid pointer in the JavaScript Engine: JIT component.
(CVE-2026-117969)
Race condition in the Disability Access APIs component.
(CVE-2026-117970)
Sandbox escape due to use-after-free in the Print Preview component.
(CVE-2026-117971)
Use-after-free in the Graphics component. (CVE-2026-117972)
Use-after-free in the Networking: DNS component. (CVE-2026-117973)
Use-after-free in the XML component. (CVE-2026-117974)
Sandbox escape due to invalid pointer in the Graphics: WebRender
component. (CVE-2026-117975)
Site isolation issue in the DOM: Navigation component. (CVE-2026-117976)
Other issue in the Console component. (CVE-2026-117977)
Incorrect boundary conditions in the Graphics component.
(CVE-2026-117978)
Incorrect boundary conditions in the Graphics: WebRender component.
(CVE-2026-117979)
Use-after-free in the Graphics component. (CVE-2026-117980)
Privilege escalation in the Toolkit component. (CVE-2026-117981)
Invalid pointer in the JavaScript Engine: JIT component.
(CVE-2026-117982)
Use-after-free in the Graphics component. (CVE-2026-117983)
Incorrect boundary conditions in the Layout: Scrolling and Overflow
component. (CVE-2026-117984)
Sandbox escape due to use-after-free in the Graphics component.
(CVE-2026-117985)
Use-after-free in the Graphics component. (CVE-2026-117986)
Use-after-free in the Graphics component. (CVE-2026-117987)
Sandbox escape due to incorrect boundary conditions in the Graphics:
CanvasWebGL component. (CVE-2026-117988)
Use-after-free in the Graphics component. (CVE-2026-117989)
Sandbox escape due to incorrect boundary conditions in the Graphics:
WebRender component. (CVE-2026-117990)
Incorrect boundary conditions in the Layout: Text and Fonts component.
(CVE-2026-117991)
Information disclosure in the CSS Parsing and Computation component.
(CVE-2026-117992)
Integer overflow in the Graphics: Text component. (CVE-2026-117993)
Use-after-free in the JavaScript: GC component. (CVE-2026-117994)
Privilege escalation in the DOM: UI Events & Focus Handling component.
(CVE-2026-117995)
Incorrect boundary conditions in the WebRTC component. (CVE-2026-117996)
Sandbox escape due to use-after-free in the Widget component.
(CVE-2026-117997)
Mitigation bypass in the DOM: Push Subscriptions component.
(CVE-2026-117998)
Race condition in the IPC component. (CVE-2026-117999)
Information disclosure in the Networking: HTTP component.
(CVE-2026-118000)
Information disclosure due to race condition in the Networking
component. (CVE-2026-118002)
Information disclosure in the Networking: DNS component.
(CVE-2026-118003)
Incorrect boundary conditions in the CSS Transitions and Animations
component. (CVE-2026-118004)

References

SRPMS

10/core