[Git][security-tracker-team/security-tracker][master] mark issues specific to ESR140 as n/a for thunderbird in trixie/bookworm
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Fri Oct 2 13:43:21 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
9db65d2b by Moritz Muehlenhoff at 2026-10-02T14:40:44+02:00
mark issues specific to ESR140 as n/a for thunderbird in trixie/bookworm
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -4790,6 +4790,8 @@ CVE-2026-100760 (Sandbox escape in the Security: Process Sandboxing component. T
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
+ [trixie] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
+ [bookworm] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100760
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100760
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100760
@@ -4815,6 +4817,8 @@ CVE-2026-100765 (Use-after-free in the JavaScript: WebAssembly component. This v
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
+ [trixie] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
+ [bookworm] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100765
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100765
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100765
@@ -4986,6 +4990,8 @@ CVE-2026-100787 (Sandbox escape in the XUL component. This vulnerability was fix
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
+ [trixie] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
+ [bookworm] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100787
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100787
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100787
@@ -5067,6 +5073,8 @@ CVE-2026-100798 (Cryptography misuse in Storage: Quota Manager component. This v
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
+ [trixie] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
+ [bookworm] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100798
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100798
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100798
@@ -5078,6 +5086,8 @@ CVE-2026-100800 (Sandbox escape due to use-after-free in the Disability Access A
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
+ [trixie] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
+ [bookworm] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100800
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100800
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100800
@@ -5111,6 +5121,8 @@ CVE-2026-100806 (Uninitialized memory in the Graphics: WebGPU component. This vu
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
+ [trixie] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
+ [bookworm] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100806
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100806
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100806
@@ -5127,6 +5139,8 @@ CVE-2026-100808 (Mitigation bypass in the DOM: Service Workers component. This v
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
+ [trixie] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
+ [bookworm] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100808
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100808
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100808
@@ -5135,6 +5149,8 @@ CVE-2026-100809 (Same-origin policy bypass in the DevTools component. This vulne
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
+ [trixie] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
+ [bookworm] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100809
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100809
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100809
@@ -5154,6 +5170,8 @@ CVE-2026-100812 (Denial-of-service in the Graphics component. This vulnerability
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
+ [trixie] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
+ [bookworm] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100812
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100812
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100812
@@ -5165,6 +5183,8 @@ CVE-2026-100814 (Incorrect boundary conditions in the JavaScript Engine: JIT com
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
+ [trixie] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
+ [bookworm] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100814
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100814
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100814
@@ -5173,6 +5193,8 @@ CVE-2026-100815 (Use-after-free in the CSS Parsing and Computation component. Th
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
+ [trixie] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
+ [bookworm] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100815
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100815
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100815
@@ -5181,6 +5203,8 @@ CVE-2026-100816 (Site isolation issue in the DOM: Networking component. This vul
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
+ [trixie] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
+ [bookworm] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100816
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100816
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100816
@@ -5224,6 +5248,8 @@ CVE-2026-100822 (Spoofing issue in the Networking: HTTP component. This vulnerab
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
+ [trixie] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
+ [bookworm] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100822
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100822
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100822
@@ -5235,6 +5261,8 @@ CVE-2026-100824 (Privilege escalation in the Places component. This vulnerabilit
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
+ [trixie] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
+ [bookworm] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100824
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100824
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100824
@@ -5243,6 +5271,8 @@ CVE-2026-100825 (Use-after-free in the JavaScript Engine: JIT component. This vu
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
+ [trixie] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
+ [bookworm] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100825
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100825
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100825
@@ -5251,6 +5281,8 @@ CVE-2026-100826 (Denial-of-service in the Storage: StorageManager component. Thi
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
+ [trixie] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
+ [bookworm] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100826
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100826
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100826
@@ -5259,6 +5291,8 @@ CVE-2026-100828 (Mitigation bypass in the Bookmarks & History component. This vu
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
+ [trixie] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
+ [bookworm] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100828
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100828
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100828
@@ -5267,6 +5301,8 @@ CVE-2026-100829 (Mitigation bypass in the DOM: Security component. This vulnerab
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
+ [trixie] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
+ [bookworm] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100829
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100829
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100829
@@ -5275,6 +5311,8 @@ CVE-2026-100830 (Mitigation bypass in the DOM: Navigation component. This vulner
- firefox 157.0-1
- firefox-esr 153.4.0esr-1
- thunderbird 1:153.4.0esr-1
+ [trixie] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
+ [bookworm] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100830
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100830
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100830
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9db65d2bcb7fb77dfadeef09271451647087d8bb
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9db65d2bcb7fb77dfadeef09271451647087d8bb
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261002/05b0a258/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list