[Git][security-tracker-team/security-tracker][master] Reserve DSA number for thunderbird update

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d65161b3 by Salvatore Bonaccorso at 2026-08-07T21:00:24+02:00
Reserve DSA number for thunderbird update

- - - - -


3 changed files:

- data/CVE/list
- data/DSA/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -31138,11 +31138,9 @@ CVE-2026-57995 (phpMyFAQ before 4.1.5 contains a privilege escalation vulnerabil
 	NOT-FOR-US: phpMyFAQ
 CVE-2026-57963 (An attacker who can send HTML chat messages (via Matrix or XMPP) can i ...)
 	- thunderbird 1:140.13.0esr-1
-	[trixie] - thunderbird <postponed> (Minor issue, wait for next security round)
 	NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-64/#CVE-2026-57963
 CVE-2026-57962 (A malicious LDAP server, which a Thunderbird user is configured to que ...)
 	- thunderbird 1:140.13.0esr-1
-	[trixie] - thunderbird <postponed> (Minor issue, wait for next security round)
 	NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-64/#CVE-2026-57962
 CVE-2026-57585 (MessagePack is the serializer implementation for Python msgpack.org. P ...)
 	- python-msgpack 1.1.2-3 (bug #1141340)


=====================================
data/DSA/list
=====================================
@@ -1,3 +1,6 @@
+[07 Aug 2026] DSA-6418-1 thunderbird - security update
+	{CVE-2026-14899 CVE-2026-15718 CVE-2026-15719 CVE-2026-16349 CVE-2026-16350 CVE-2026-16351 CVE-2026-16352 CVE-2026-16353 CVE-2026-16354 CVE-2026-16355 CVE-2026-16356 CVE-2026-16357 CVE-2026-16358 CVE-2026-16359 CVE-2026-16360 CVE-2026-16361 CVE-2026-16362 CVE-2026-16363 CVE-2026-16368 CVE-2026-16369 CVE-2026-16371 CVE-2026-16374 CVE-2026-16375 CVE-2026-16377 CVE-2026-16379 CVE-2026-16381 CVE-2026-16383 CVE-2026-16387 CVE-2026-16390 CVE-2026-16391 CVE-2026-16396 CVE-2026-16405 CVE-2026-16412 CVE-2026-57962 CVE-2026-57963}
+	[trixie] - thunderbird 1:140.13.0esr-2~deb13u1
 [08 Aug 2026] DSA-6417-1 libheif - security update
 	{CVE-2025-68431 CVE-2026-32740 CVE-2026-32741 CVE-2026-32882 CVE-2026-47178 CVE-2026-47247 CVE-2026-47709 CVE-2026-47714 CVE-2026-48029 CVE-2026-49271 CVE-2026-62289 CVE-2026-62292}
 	[trixie] - libheif 1.19.8-1+deb13u1


=====================================
data/dsa-needed.txt
=====================================
@@ -136,8 +136,6 @@ shaarli
 --
 starlette
 --
-thunderbird (carnil)
---
 tomcat10
 --
 tomcat11



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d65161b3ce34049a2414ca577988024d813e4a13

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d65161b3ce34049a2414ca577988024d813e4a13
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260807/cb0388d5/attachment.htm>