Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Thunderbird could leak data or show wrong links

published 5 months ago

Summary

The Thunderbird email program on AlmaLinux has several issues that could let an attacker learn private information, cause crashes when rendering web graphics, bypass security rules for website connections, or show incorrect attachment URLs. These problems stem from how the software handles encryption, web graphics, security policies, and attachment display. Update Thunderbird to the latest version as soon as possible to apply the fixes.

What to do

Update almalinux thunderbird to version 115.4.1-1.el9_2.alma.tuxcare.els4.

Affected software

Ecosystem	Vendor	Product	Affected versions
TuxCare:AlmaLinux:9.2	almalinux	thunderbird	< 115.4.1-1.el9_2.alma.tuxcare.els4 Fix: upgrade to 115.4.1-1.el9_2.alma.tuxcare.els4

Original advisory text

thunderbird: Fix of 4 CVEs

- CVE-2023-5388: NSS MPI RSA decryption timing side-channel (Marvin attack);
backport upstream NSS_3_90 commit 196716d8 to security/nss/lib/freebl
- CVE-2024-0741: ANGLE VariablePacker int32 overflow leading to heap
out-of-bounds write in WebGL shader compilation
- CVE-2024-0753: PSM HSTS superdomain walk did not honor ancestor
includeSubDomains policy (RFC 6797 conformance)
- CVE-2025-3523: attachment URL UI misrepresentation in
displayAttachmentsForExpandedViewExternal; mouseover/focus showed last URL
for all rows

References

https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1779786876.html Vendor Advisory

Timeline

Published26 May 2026

Updated26 Oct 2026

First seen26 Oct 2026

Sources

CLSA-2026-1779786876 · OSV

Track software like this

Free during beta