Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Thunderbird could allow attackers to view or alter messages
published 8 months ago
Summary
The Thunderbird email program on AlmaLinux contains coding errors that could let a malicious sender trick the application into showing false information, reading private emails, or running unwanted code. This could expose confidential communications or give an attacker control of the computer. Install the latest Thunderbird update as soon as possible to apply the fixes.
What to do
- Update almalinux thunderbird to version 140.7.0-1.el8_10.alma.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | thunderbird |
< 140.7.0-1.el8_10.alma.1 Fix: upgrade to 140.7.0-1.el8_10.alma.1
|
Original advisory text
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* firefox: Spoofing issue in the Downloads Panel component (CVE-2025-14327)
* firefox: Use-after-free in the JavaScript: GC component (CVE-2026-0885)
* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147 (CVE-2026-0891)
* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-0878)
* firefox: Use-after-free in the IPC component (CVE-2026-0882)
* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-0884)
* firefox: Information disclosure in the Networking component (CVE-2026-0883)
* firefox: Mitigation bypass in the DOM: Security component (CVE-2026-0877)
* firefox: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-0890)
* firefox: Clickjacking issue, information disclosure in the PDF Viewer component (CVE-2026-0887)
* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-0879)
* firefox: Sandbox escape due to integer overflow in the Graphics component (CVE-2026-0880)
* firefox: Incorrect boundary conditions in the Graphics component (CVE-2026-0886)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* firefox: Spoofing issue in the Downloads Panel component (CVE-2025-14327)
* firefox: Use-after-free in the JavaScript: GC component (CVE-2026-0885)
* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147 (CVE-2026-0891)
* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-0878)
* firefox: Use-after-free in the IPC component (CVE-2026-0882)
* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-0884)
* firefox: Information disclosure in the Networking component (CVE-2026-0883)
* firefox: Mitigation bypass in the DOM: Security component (CVE-2026-0877)
* firefox: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-0890)
* firefox: Clickjacking issue, information disclosure in the PDF Viewer component (CVE-2026-0887)
* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-0879)
* firefox: Sandbox escape due to integer overflow in the Graphics component (CVE-2026-0880)
* firefox: Incorrect boundary conditions in the Graphics component (CVE-2026-0886)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:2220 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-14327 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0877 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0878 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0879 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0880 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0882 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0883 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0884 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0885 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0886 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0887 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0890 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-0891 Third Party Advisory
- https://bugzilla.redhat.com/2420507 Third Party Advisory
- https://bugzilla.redhat.com/2428961 Third Party Advisory
- https://bugzilla.redhat.com/2428963 Third Party Advisory
- https://bugzilla.redhat.com/2428965 Third Party Advisory
- https://bugzilla.redhat.com/2428966 Third Party Advisory
- https://bugzilla.redhat.com/2428967 Third Party Advisory
- https://bugzilla.redhat.com/2428968 Third Party Advisory
- https://bugzilla.redhat.com/2428969 Third Party Advisory
- https://bugzilla.redhat.com/2428971 Third Party Advisory
- https://bugzilla.redhat.com/2428972 Third Party Advisory
- https://bugzilla.redhat.com/2428973 Third Party Advisory
- https://bugzilla.redhat.com/2428975 Third Party Advisory
- https://bugzilla.redhat.com/2428978 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2026-2220.html Vendor Advisory
Timeline
Published9 Feb 2026
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2026:2220 · OSV
Track software like this
Free during beta