Описание
Security update for MozillaThunderbird
This update for MozillaThunderbird fixes the following issues
Update to Firefox 140.12.0 ESR (MFSA 2026-58, bsc#1268071):
- CVE-2026-12289: Privilege escalation in the Graphics: WebRender component.
- CVE-2026-12290: Memory safety bug fixed in Firefox ESR 140.12.
- CVE-2026-12291: Use-after-free in the Networking: HTTP component.
- CVE-2026-12292: Incorrect boundary conditions in the Web Audio component.
- CVE-2026-12294: Sandbox escape in the DOM: Workers component.
- CVE-2026-12295: Sandbox escape in the DOM: Navigation component.
- CVE-2026-12296: Sandbox escape in the Security: Process Sandboxing component.
- CVE-2026-12297: Sandbox escape due to incorrect boundary conditions in the Networking component.
- CVE-2026-12298: Memory safety bug fixed in Firefox ESR 140.12.
- CVE-2026-12299: JIT miscompilation in the DOM: Core & HTML component.
- CVE-2026-12302: Mitigation bypass in the DOM: Security component.
- CVE-2026-12304: Same-origin policy bypass in the Networking: Cookies component.
- CVE-2026-12305: Memory safety bug fixed in Firefox ESR 140.12.
- CVE-2026-12306: Memory safety bug fixed in Firefox ESR 140.12.
- CVE-2026-12307: Memory safety bug fixed in Firefox ESR 140.12.
- CVE-2026-12308: Memory safety bug fixed in Firefox ESR 140.12.
- CVE-2026-12309: Memory safety bug fixed in Firefox ESR 140.12.
- CVE-2026-12310: Memory safety bug fixed in Firefox ESR 140.12.
- CVE-2026-12311: Information disclosure, sandbox escape in the Security: Process Sandboxing component.
- CVE-2026-12312: Memory safety bug fixed in Firefox ESR 140.12.
- CVE-2026-12313: Information disclosure, sandbox escape in the Security: Process Sandboxing component.
- CVE-2026-12314: Memory safety bug fixed in Firefox ESR 140.12.
- CVE-2026-12315: Mitigation bypass in the DOM: Security component.
- CVE-2026-12324: Incorrect boundary conditions in the Graphics: CanvasWebGL component.
- CVE-2026-12325: Denial-of-service in the Graphics: ImageLib component.
- CVE-2026-12327: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152.
- CVE-2026-12328: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152.
- CVE-2026-12329: Memory safety bug fixed in Firefox ESR 140.12.
- CVE-2026-12330: Incorrect boundary conditions in the Internationalization component.
Список пакетов
SUSE Linux Enterprise Module for Package Hub 15 SP7
SUSE Linux Enterprise Workstation Extension 15 SP7
Ссылки
- Link for SUSE-SU-2026:2852-1
- E-Mail link for SUSE-SU-2026:2852-1
- SUSE Security Ratings
- SUSE Bug 1268071
- SUSE CVE CVE-2026-12289 page
- SUSE CVE CVE-2026-12290 page
- SUSE CVE CVE-2026-12291 page
- SUSE CVE CVE-2026-12292 page
- SUSE CVE CVE-2026-12294 page
- SUSE CVE CVE-2026-12295 page
- SUSE CVE CVE-2026-12296 page
- SUSE CVE CVE-2026-12297 page
- SUSE CVE CVE-2026-12298 page
- SUSE CVE CVE-2026-12299 page
- SUSE CVE CVE-2026-12302 page
- SUSE CVE CVE-2026-12304 page
- SUSE CVE CVE-2026-12305 page
- SUSE CVE CVE-2026-12306 page
- SUSE CVE CVE-2026-12307 page
- SUSE CVE CVE-2026-12308 page
Описание
Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12289
- SUSE Bug 1268071
Описание
Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12290
- SUSE Bug 1268071
Описание
Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12291
- SUSE Bug 1268071
Описание
Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12292
- SUSE Bug 1268071
Описание
Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12294
- SUSE Bug 1268071
Описание
Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12295
- SUSE Bug 1268071
Описание
Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12296
- SUSE Bug 1268071
Описание
Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12297
- SUSE Bug 1268071
Описание
Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12298
- SUSE Bug 1268071
Описание
JIT miscompilation in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12299
- SUSE Bug 1268071
Описание
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12302
- SUSE Bug 1268071
Описание
Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12304
- SUSE Bug 1268071
Описание
Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12305
- SUSE Bug 1268071
Описание
Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12306
- SUSE Bug 1268071
Описание
Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12307
- SUSE Bug 1268071
Описание
Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12308
- SUSE Bug 1268071
Описание
Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12309
- SUSE Bug 1268071
Описание
Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12310
- SUSE Bug 1268071
Описание
Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12311
- SUSE Bug 1268071
Описание
Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12312
- SUSE Bug 1268071
Описание
Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12313
- SUSE Bug 1268071
Описание
Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12314
- SUSE Bug 1268071
Описание
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12315
- SUSE Bug 1268071
Описание
Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12324
- SUSE Bug 1268071
Описание
Denial-of-service in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12325
- SUSE Bug 1268071
Описание
Memory safety bugs present in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12327
- SUSE Bug 1268071
Описание
Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12328
- SUSE Bug 1268071
Описание
Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12329
- SUSE Bug 1268071
Описание
Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 140.12, Firefox ESR 115.37, and Thunderbird 140.12.
Затронутые продукты
Ссылки
- CVE-2026-12330
- SUSE Bug 1268071