{
  "schema_version": "1.7.0",
  "id": "MGASA-2026-0583",
  "published": "2026-11-09T16:32:57Z",
  "modified": "2026-11-09T16:13:40Z",
  "summary": "Updated thunderbird package fixes security vulnerabilities",
  "details": "Displaying a message could load an attacker-chosen URL through an\nOpenPGP key attachment. (CVE-2026-118174)\nContent of other messages could be included when replying to a crafted\nmessage. (CVE-2026-118175)\nBypass of remote UNC path restriction in mailbox: URLs.\n(CVE-2026-118176)\nCalendar discovery accepted local file and remote network share\nlocations. (CVE-2026-118177)\nRSS feed could redirect its subscription to a local file or network\nshare. (CVE-2026-118178)\nRequest forgery via news: links. (CVE-2026-118179)\nMatrix homeserver could redirect the chat session to a local file or\nnetwork share. (CVE-2026-118180)\nInteger overflow in libmime buffer growth could lead to heap corruption.\n(CVE-2026-110247)\nUse-after-free in S/MIME decryption during a security device password\nprompt. (CVE-2026-113869)\nSame-origin policy bypass in the DOM: Navigation component.\n(CVE-2026-117860)\nSandbox escape in the DOM: Navigation component. (CVE-2026-117861)\nPrivilege escalation due to incorrect boundary conditions in the\nNetworking component. (CVE-2026-117862)\nInformation disclosure due to uninitialized memory in the Audio/Video\ncomponent. (CVE-2026-117863)\nSandbox escape in the Form Manager component. (CVE-2026-117864)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117865)\nPrivilege escalation due to use-after-free in the Graphics: Canvas2D\ncomponent. (CVE-2026-117866)\nUse-after-free in the Layout component. (CVE-2026-117867)\nSandbox escape in the DOM: Networking component. (CVE-2026-117868)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117869)\nUse-after-free in the JavaScript Engine component. (CVE-2026-117870)\nInvalid pointer in the Graphics component. (CVE-2026-117871)\nUse-after-free in the JavaScript: Standard Library component.\n(CVE-2026-117872)\nIncorrect boundary conditions in the Audio/Video: Playback component.\n(CVE-2026-117873)\nUse-after-free in the Internationalization component. (CVE-2026-117874)\nUse-after-free in the Layout: Scrolling and Overflow component.\n(CVE-2026-117875)\nUse-after-free in the Layout: Text and Fonts component.\n(CVE-2026-117876)\nUse-after-free in the Layout: Text and Fonts component.\n(CVE-2026-117877)\nOther issue, use-after-free in the Storage: IndexedDB component.\n(CVE-2026-117878)\nIncorrect boundary conditions in the Layout: Tables component.\n(CVE-2026-117879)\nUse-after-free in the XML component. (CVE-2026-117880)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117881)\nUse-after-free in the Layout component. (CVE-2026-117882)\nUse-after-free in the DOM: HTML Parser component. (CVE-2026-117883)\nUse-after-free in the Networking component. (CVE-2026-117884)\nUse-after-free in the Layout: Grid component. (CVE-2026-117885)\nIncorrect boundary conditions in the Graphics: Text component.\n(CVE-2026-117886)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117887)\nUninitialized memory in the Graphics: Canvas2D component.\n(CVE-2026-117888)\nIncorrect boundary conditions in the JavaScript Engine component.\n(CVE-2026-117889)\nJIT miscompilation in the JavaScript Engine: JIT component.\n(CVE-2026-117890)\nUse-after-free in the JavaScript Engine: JIT component.\n(CVE-2026-117891)\nPrivilege escalation due to use-after-free in the WebRTC: Networking\ncomponent. (CVE-2026-117892)\nIncorrect boundary conditions in the Security: PSM component.\n(CVE-2026-117893)\nIncorrect boundary conditions in the WebRTC: Signaling component.\n(CVE-2026-117894)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117895)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117896)\nIncorrect boundary conditions in the Layout: Tables component.\n(CVE-2026-117897)\nUse-after-free in the JavaScript Engine: JIT component.\n(CVE-2026-117898)\nUse-after-free in the Networking: HTTP component. (CVE-2026-117899)\nUse-after-free in the DOM: Editor component. (CVE-2026-117900)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117901)\nUse-after-free in the Layout: Text and Fonts component.\n(CVE-2026-117902)\nUse-after-free in the Audio/Video component. (CVE-2026-117903)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117904)\nUse-after-free in the Audio/Video: Playback component. (CVE-2026-117905)\nUse-after-free in the CSS Parsing and Computation component.\n(CVE-2026-117906)\nUse-after-free in the Networking component. (CVE-2026-117907)\nUse-after-free in the Graphics: ImageLib component. (CVE-2026-117908)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117909)\nInvalid pointer in the JavaScript Engine component. (CVE-2026-117910)\nUse-after-free in the Audio/Video: Playback component. (CVE-2026-117911)\nSame-origin policy bypass in the CSS Parsing and Computation component.\n(CVE-2026-117912)\nUse-after-free in the SVG component. (CVE-2026-117913)\nUse-after-free in the SVG component. (CVE-2026-117914)\nIncorrect boundary conditions in the Layout: Block and Inline component.\n(CVE-2026-117915)\nUse-after-free in the XSLT component. (CVE-2026-117916)\nInvalid pointer in the Graphics: WebRender component. (CVE-2026-117917)\nUse-after-free in the Graphics: Canvas2D component. (CVE-2026-117918)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117919)\nUse-after-free in the DOM: HTML Parser component. (CVE-2026-117920)\nUse-after-free in the CSS Parsing and Computation component.\n(CVE-2026-117921)\nUse-after-free in the Networking: WebSockets component.\n(CVE-2026-117922)\nUse-after-free in the Audio/Video component. (CVE-2026-117923)\nUse-after-free in the XSLT component. (CVE-2026-117924)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117925)\nIncorrect boundary conditions in the SVG component. (CVE-2026-117926)\nUse-after-free in the SVG component. (CVE-2026-117927)\nSame-origin policy bypass in the CSS Parsing and Computation component.\n(CVE-2026-117928)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117929)\nUse-after-free in the DOM: Bindings (WebIDL) component.\n(CVE-2026-117930)\nUse-after-free in the DOM: Events component. (CVE-2026-117931)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117932)\nFrame poisoning in the CSS Parsing and Computation component.\n(CVE-2026-117933)\nUse-after-free in the Layout component. (CVE-2026-117934)\nUse-after-free in the DOM: Bindings (WebIDL) component.\n(CVE-2026-117935)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117936)\nInvalid pointer in the JavaScript Engine component. (CVE-2026-117937)\nUse-after-free in the Layout component. (CVE-2026-117938)\nUse-after-free in the XML component. (CVE-2026-117939)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117940)\nUse-after-free in the DOM: CSS Object Model component. (CVE-2026-117941)\nIncorrect boundary conditions in the JavaScript Engine: JIT component.\n(CVE-2026-117942)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117943)\nUse-after-free in the Layout component. (CVE-2026-117944)\nIncorrect boundary conditions in the XML component. (CVE-2026-117945)\nIncorrect boundary conditions in the JavaScript Engine component.\n(CVE-2026-117946)\nUse-after-free in the XML component. (CVE-2026-117947)\nUse-after-free in the SVG component. (CVE-2026-117948)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117949)\nIncorrect boundary conditions in the DOM: Core & HTML component.\n(CVE-2026-117950)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117951)\nUninitialized memory in the Networking component. (CVE-2026-117952)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117953)\nUse-after-free in the Layout: Positioned component. (CVE-2026-117954)\nJIT miscompilation in the JavaScript: WebAssembly component.\n(CVE-2026-117955)\nPrivilege escalation in the DLL Services component. (CVE-2026-100801)\nInvalid pointer in the Nimbus Desktop Client component.\n(CVE-2026-117956)\nCryptographic issue in the WebRTC: Networking component.\n(CVE-2026-117957)\nSite isolation issue in the Networking: HTTP component.\n(CVE-2026-117958)\nSite isolation issue in the DOM: Service Workers component.\n(CVE-2026-117959)\nSpoofing issue in the DOM: Core & HTML component. (CVE-2026-117960)\nIncorrect boundary conditions in the Layout: Text and Fonts component.\n(CVE-2026-117961)\nSandbox escape due to incorrect boundary conditions in the Storage:\nQuota Manager component. (CVE-2026-117962)\nIncorrect boundary conditions in the DOM: Service Workers component.\n(CVE-2026-117963)\nUse-after-free in the Panning and Zooming component. (CVE-2026-117964)\nSame-origin policy bypass in the Address Bar component.\n(CVE-2026-117965)\nSite isolation issue in the Networking: HTTP component.\n(CVE-2026-117966)\nMitigation bypass in the DOM: Security component. (CVE-2026-117967)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117968)\nInvalid pointer in the JavaScript Engine: JIT component.\n(CVE-2026-117969)\nRace condition in the Disability Access APIs component.\n(CVE-2026-117970)\nSandbox escape due to use-after-free in the Print Preview component.\n(CVE-2026-117971)\nUse-after-free in the Graphics component. (CVE-2026-117972)\nUse-after-free in the Networking: DNS component. (CVE-2026-117973)\nUse-after-free in the XML component. (CVE-2026-117974)\nSandbox escape due to invalid pointer in the Graphics: WebRender\ncomponent. (CVE-2026-117975)\nSite isolation issue in the DOM: Navigation component. (CVE-2026-117976)\nOther issue in the Console component. (CVE-2026-117977)\nIncorrect boundary conditions in the Graphics component.\n(CVE-2026-117978)\nIncorrect boundary conditions in the Graphics: WebRender component.\n(CVE-2026-117979)\nUse-after-free in the Graphics component. (CVE-2026-117980)\nPrivilege escalation in the Toolkit component. (CVE-2026-117981)\nInvalid pointer in the JavaScript Engine: JIT component.\n(CVE-2026-117982)\nUse-after-free in the Graphics component. (CVE-2026-117983)\nIncorrect boundary conditions in the Layout: Scrolling and Overflow\ncomponent. (CVE-2026-117984)\nSandbox escape due to use-after-free in the Graphics component.\n(CVE-2026-117985)\nUse-after-free in the Graphics component. (CVE-2026-117986)\nUse-after-free in the Graphics component. (CVE-2026-117987)\nSandbox escape due to incorrect boundary conditions in the Graphics:\nCanvasWebGL component. (CVE-2026-117988)\nUse-after-free in the Graphics component. (CVE-2026-117989)\nSandbox escape due to incorrect boundary conditions in the Graphics:\nWebRender component. (CVE-2026-117990)\nIncorrect boundary conditions in the Layout: Text and Fonts component.\n(CVE-2026-117991)\nInformation disclosure in the CSS Parsing and Computation component.\n(CVE-2026-117992)\nInteger overflow in the Graphics: Text component. (CVE-2026-117993)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117994)\nPrivilege escalation in the DOM: UI Events & Focus Handling component.\n(CVE-2026-117995)\nIncorrect boundary conditions in the WebRTC component. (CVE-2026-117996)\nSandbox escape due to use-after-free in the Widget component.\n(CVE-2026-117997)\nMitigation bypass in the DOM: Push Subscriptions component.\n(CVE-2026-117998)\nRace condition in the IPC component. (CVE-2026-117999)\nInformation disclosure in the Networking: HTTP component.\n(CVE-2026-118000)\nInformation disclosure due to race condition in the Networking\ncomponent. (CVE-2026-118002)\nInformation disclosure in the Networking: DNS component.\n(CVE-2026-118003)\nIncorrect boundary conditions in the CSS Transitions and Animations\ncomponent. (CVE-2026-118004)\n",
  "upstream": [
    "CVE-2026-118174",
    "CVE-2026-118175",
    "CVE-2026-118176",
    "CVE-2026-118177",
    "CVE-2026-118178",
    "CVE-2026-118179",
    "CVE-2026-118180",
    "CVE-2026-110247",
    "CVE-2026-113869",
    "CVE-2026-117860",
    "CVE-2026-117861",
    "CVE-2026-117862",
    "CVE-2026-117863",
    "CVE-2026-117864",
    "CVE-2026-117865",
    "CVE-2026-117866",
    "CVE-2026-117867",
    "CVE-2026-117868",
    "CVE-2026-117869",
    "CVE-2026-117870",
    "CVE-2026-117871",
    "CVE-2026-117872",
    "CVE-2026-117873",
    "CVE-2026-117874",
    "CVE-2026-117875",
    "CVE-2026-117876",
    "CVE-2026-117877",
    "CVE-2026-117878",
    "CVE-2026-117879",
    "CVE-2026-117880",
    "CVE-2026-117881",
    "CVE-2026-117882",
    "CVE-2026-117883",
    "CVE-2026-117884",
    "CVE-2026-117885",
    "CVE-2026-117886",
    "CVE-2026-117887",
    "CVE-2026-117888",
    "CVE-2026-117889",
    "CVE-2026-117890",
    "CVE-2026-117891",
    "CVE-2026-117892",
    "CVE-2026-117893",
    "CVE-2026-117894",
    "CVE-2026-117895",
    "CVE-2026-117896",
    "CVE-2026-117897",
    "CVE-2026-117898",
    "CVE-2026-117899",
    "CVE-2026-117900",
    "CVE-2026-117901",
    "CVE-2026-117902",
    "CVE-2026-117903",
    "CVE-2026-117904",
    "CVE-2026-117905",
    "CVE-2026-117906",
    "CVE-2026-117907",
    "CVE-2026-117908",
    "CVE-2026-117909",
    "CVE-2026-117910",
    "CVE-2026-117911",
    "CVE-2026-117912",
    "CVE-2026-117913",
    "CVE-2026-117914",
    "CVE-2026-117915",
    "CVE-2026-117916",
    "CVE-2026-117917",
    "CVE-2026-117918",
    "CVE-2026-117919",
    "CVE-2026-117920",
    "CVE-2026-117921",
    "CVE-2026-117922",
    "CVE-2026-117923",
    "CVE-2026-117924",
    "CVE-2026-117925",
    "CVE-2026-117926",
    "CVE-2026-117927",
    "CVE-2026-117928",
    "CVE-2026-117929",
    "CVE-2026-117930",
    "CVE-2026-117931",
    "CVE-2026-117932",
    "CVE-2026-117933",
    "CVE-2026-117934",
    "CVE-2026-117935",
    "CVE-2026-117936",
    "CVE-2026-117937",
    "CVE-2026-117938",
    "CVE-2026-117939",
    "CVE-2026-117940",
    "CVE-2026-117941",
    "CVE-2026-117942",
    "CVE-2026-117943",
    "CVE-2026-117944",
    "CVE-2026-117945",
    "CVE-2026-117946",
    "CVE-2026-117947",
    "CVE-2026-117948",
    "CVE-2026-117949",
    "CVE-2026-117950",
    "CVE-2026-117951",
    "CVE-2026-117952",
    "CVE-2026-117953",
    "CVE-2026-117954",
    "CVE-2026-117955",
    "CVE-2026-100801",
    "CVE-2026-117956",
    "CVE-2026-117957",
    "CVE-2026-117958",
    "CVE-2026-117959",
    "CVE-2026-117960",
    "CVE-2026-117961",
    "CVE-2026-117962",
    "CVE-2026-117963",
    "CVE-2026-117964",
    "CVE-2026-117965",
    "CVE-2026-117966",
    "CVE-2026-117967",
    "CVE-2026-117968",
    "CVE-2026-117969",
    "CVE-2026-117970",
    "CVE-2026-117971",
    "CVE-2026-117972",
    "CVE-2026-117973",
    "CVE-2026-117974",
    "CVE-2026-117975",
    "CVE-2026-117976",
    "CVE-2026-117977",
    "CVE-2026-117978",
    "CVE-2026-117979",
    "CVE-2026-117980",
    "CVE-2026-117981",
    "CVE-2026-117982",
    "CVE-2026-117983",
    "CVE-2026-117984",
    "CVE-2026-117985",
    "CVE-2026-117986",
    "CVE-2026-117987",
    "CVE-2026-117988",
    "CVE-2026-117989",
    "CVE-2026-117990",
    "CVE-2026-117991",
    "CVE-2026-117992",
    "CVE-2026-117993",
    "CVE-2026-117994",
    "CVE-2026-117995",
    "CVE-2026-117996",
    "CVE-2026-117997",
    "CVE-2026-117998",
    "CVE-2026-117999",
    "CVE-2026-118000",
    "CVE-2026-118002",
    "CVE-2026-118003",
    "CVE-2026-118004"
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://advisories.mageia.org/MGASA-2026-0583.html"
    },
    {
      "type": "REPORT",
      "url": "https://bugs.mageia.org/show_bug.cgi?id=36593"
    },
    {
      "type": "WEB",
      "url": "https://www.thunderbird.net/en-US/thunderbird/153.6.0esr/releasenotes/"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-122/"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Mageia:10",
        "name": "thunderbird",
        "purl": "pkg:rpm/mageia/thunderbird?arch=source&distro=mageia-10"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "153.6.0-1.mga10"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "section": "core"
      }
    }
  ],
  "credits": [
    {
      "name": "Mageia",
      "type": "COORDINATOR",
      "contact": [
        "https://wiki.mageia.org/en/Packages_Security_Team"
      ]
    }
  ]
}