[Git][security-tracker-team/security-tracker][master] new thunderbird issues
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Wed Oct 14 14:28:57 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
a8c8fa3a by Moritz Muehlenhoff at 2026-10-14T15:28:30+02:00
new thunderbird issues
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -4095,9 +4095,11 @@ CVE-2026-11731 (An authentication bypass vulnerability in the listed NETGEAR RAX
CVE-2026-11730 (Insufficient session randomness vulnerability in the listed NETGEAR Ex ...)
NOT-FOR-US: Netgear
CVE-2026-110249 (A malicious, compromised, or MITM-controlled Exchange server can retur ...)
- TODO: check
+ - thunderbird <unfixed>
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-110249
CVE-2026-110247 (Several buffer-growth sites in libmime performed size arithmetic in 32 ...)
- TODO: check
+ - thunderbird <unfixed>
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-110247
CVE-2026-110240 (Lancet through 2.3.9 contains an SSRF protection bypass vulnerability ...)
NOT-FOR-US: Lancet
CVE-2026-110239 (Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulne ...)
@@ -4730,207 +4732,284 @@ CVE-2026-109782 (Mitigation bypass in the File Handling component. This vulnerab
CVE-2026-109704 (Privilege escalation in the Application Update component. This vulnera ...)
- firefox <not-affected> (Vulnerable code in Application Update component)
- firefox-esr <not-affected> (Vulnerable code in Application Update component)
+ - thunerbird <not-affected> (Vulnerable code in Application Update component)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109704
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109704
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109704
CVE-2026-109705 (Sandbox escape, site isolation issue due to incorrect boundary conditi ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109705
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109705
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109705
CVE-2026-109706 (Use-after-free in the Storage: IndexedDB component. This vulnerability ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109706
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109706
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109706
CVE-2026-109707 (Sandbox escape due to use-after-free in the Networking component. This ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109707
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109707
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109707
CVE-2026-109708 (Sandbox escape due to incorrect boundary conditions in the Networking ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109708
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109708
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109708
CVE-2026-109709 (Information disclosure, privilege escalation in the Security: Process ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109709
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109709
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109709
CVE-2026-109710 (Use-after-free in the Graphics: Text component. This vulnerability was ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109710
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109710
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109710
CVE-2026-109711 (Use-after-free in the Graphics: Canvas2D component. This vulnerability ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109711
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109711
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109711
CVE-2026-109712 (Sandbox escape due to uninitialized memory in the Graphics component. ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109712
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109712
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109712
CVE-2026-109713 (Use-after-free in the Crash Reporting component. This vulnerability wa ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109713
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109713
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109713
CVE-2026-109714 (Incorrect boundary conditions in the Layout component. This vulnerabil ...)
- firefox <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109714
CVE-2026-109715 (Incorrect boundary conditions in the JavaScript Engine component. This ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109715
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109715
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109715
CVE-2026-109716 (Incorrect boundary conditions in the JavaScript Engine component. This ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109716
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109716
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109716
CVE-2026-109717 (Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerabi ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109717
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109717
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109717
CVE-2026-109718 (Use-after-free in the XML component. This vulnerability was fixed in F ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109718
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109718
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109718
CVE-2026-109719 (Race condition, use-after-free in the Graphics: CanvasWebGL component. ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109719
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109719
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109719
CVE-2026-109720 (JIT miscompilation in the JavaScript: WebAssembly component. This vuln ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109720
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109720
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109720
CVE-2026-109721 (Incorrect boundary conditions in the JavaScript Engine: JIT component. ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109721
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109721
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109721
CVE-2026-109722 (JIT miscompilation in the JavaScript Engine: JIT component. This vulne ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109722
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109722
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109722
CVE-2026-109723 (Integer overflow in the Layout: Text and Fonts component. This vulnera ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109723
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109723
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109723
CVE-2026-109724 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109724
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109724
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109724
CVE-2026-109725 (Use-after-free in the DOM: Core & HTML component. This vulnerability w ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109725
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109725
CVE-2026-109726 (Use-after-free in the SVG component. This vulnerability was fixed in F ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109726
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109726
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109726
CVE-2026-109727 (Use-after-free in the Audio/Video component. This vulnerability was fi ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109727
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109727
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109727
CVE-2026-109728 (Use-after-free in the DOM: Animation component. This vulnerability was ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109728
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109728
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109728
CVE-2026-109729 (Use-after-free in the JavaScript Engine: JIT component. This vulnerabi ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109729
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109729
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109729
CVE-2026-109730 (Integer overflow in the Graphics component. This vulnerability was fix ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109730
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109730
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109730
CVE-2026-109731 (Incorrect boundary conditions in the Graphics: Canvas2D component. Thi ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109731
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109731
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109731
CVE-2026-109732 (Use-after-free in the DOM: Streams component. This vulnerability was f ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109732
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109732
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109732
CVE-2026-109733 (JIT miscompilation in the JavaScript Engine: JIT component. This vulne ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109733
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109733
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109733
CVE-2026-109734 (Mitigation bypass in the DOM: Security component. This vulnerability w ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109734
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109734
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109734
CVE-2026-109735 (Use-after-free in the DOM: Animation component. This vulnerability was ...)
- firefox <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109735
CVE-2026-109736 (Frame poisoning in the Layout component. This vulnerability was fixed ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109736
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109736
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109736
CVE-2026-109737 (Mitigation bypass in the Enterprise Policies component. This vulnerabi ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109737
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109737
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109737
CVE-2026-109738 (Use-after-free in the Audio/Video: Playback component. This vulnerabil ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109738
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109738
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109738
CVE-2026-109739 (Privilege escalation in the WebExtensions component. This vulnerabilit ...)
- firefox <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109739
CVE-2026-109740 (Sandbox escape due to incorrect boundary conditions in the Widget: Win ...)
- firefox <not-affected> (Only affects Firefox on Windows)
- firefox-esr <not-affected> (Only affects Firefox ESR on Windows)
+ - thunderbird <not-affected> (Only affects Thunderbird on Windows)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109740
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109740
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109740
CVE-2026-109741 (Use-after-free in the Storage: Bucket File System component. This vuln ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109741
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109741
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109741
CVE-2026-109742 (Information disclosure in the PDF Viewer component. This vulnerability ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109742
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109742
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109742
CVE-2026-109743 (Privilege escalation in the Panning and Zooming component. This vulner ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109743
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109743
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109743
CVE-2026-109744 (Other issue in the DOM: File component. This vulnerability was fixed i ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109744
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109744
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109744
CVE-2026-109745 (Sandbox escape due to uninitialized memory in the DOM: Web Serial comp ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109745
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109745
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109745
CVE-2026-109746 (Mitigation bypass in the DOM: Security component. This vulnerability w ...)
- firefox <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109746
@@ -4949,79 +5028,107 @@ CVE-2026-109750 (Site isolation issue in the DOM: Web Authentication component.
CVE-2026-109751 (Information disclosure in the Networking component. This vulnerability ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109751
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109751
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109751
CVE-2026-109752 (Use-after-free in the DOM: Workers component. This vulnerability was f ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109752
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109752
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109752
CVE-2026-109753 (Incorrect boundary conditions in the Layout component. This vulnerabil ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109753
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109753
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109753
CVE-2026-109754 (Incorrect boundary conditions in the DOM: Editor component. This vulne ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109754
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109754
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109754
CVE-2026-109755 (Sandbox escape in the DOM: Content Processes component. This vulnerabi ...)
- firefox <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109755
CVE-2026-109756 (Privilege escalation in the DOM: Navigation component. This vulnerabil ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109756
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109756
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109756
CVE-2026-109757 (Sandbox escape due to race condition in the Networking component. This ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109757
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109757
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109757
CVE-2026-109759 (Site isolation issue in the Networking component. This vulnerability w ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109759
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109759
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109759
CVE-2026-109760 (Mitigation bypass in the Networking: HTTP component. This vulnerabilit ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109760
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109760
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109760
CVE-2026-109761 (Use-after-free in the JavaScript: WebAssembly component. This vulnerab ...)
- firefox <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109761
CVE-2026-109762 (Incorrect boundary conditions in the SVG component. This vulnerability ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109762
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109762
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109762
CVE-2026-109763 (Mitigation bypass in the File Handling component. This vulnerability w ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109763
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109763
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109763
CVE-2026-109764 (Mitigation bypass in the Enterprise Policies component. This vulnerabi ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109764
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109764
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109764
CVE-2026-109765 (Race condition, use-after-free in the Graphics: Text component. This v ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109765
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109765
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109765
CVE-2026-109766 (Mitigation bypass in the Enterprise Policies component. This vulnerabi ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109766
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109766
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109766
CVE-2026-109767 (Information disclosure in the Networking component. This vulnerability ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109767
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109767
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109767
CVE-2026-109768 (Denial-of-service in the Site Reports component. This vulnerability wa ...)
- firefox <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109768
@@ -5031,8 +5138,10 @@ CVE-2026-109769 (Information disclosure in the Networking: Cache component. This
CVE-2026-109770 (Spoofing issue in the DOM: Web Serial component. This vulnerability wa ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109770
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109770
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109770
CVE-2026-109771 (Information disclosure in the WebRTC: Networking component. This vulne ...)
- firefox <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109771
@@ -5048,23 +5157,31 @@ CVE-2026-109774 (Invalid pointer, undefined behavior in the DOM: Notifications c
CVE-2026-109775 (Denial-of-service in the WebRTC component. This vulnerability was fixe ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109775
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109775
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109775
CVE-2026-109776 (Race condition in the XPCOM component. This vulnerability was fixed in ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109776
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109776
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109776
CVE-2026-109777 (Information disclosure in the Storage: IndexedDB component. This vulne ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109777
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109777
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109777
CVE-2026-109778 (Privilege escalation in the WebExtensions component. This vulnerabilit ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109778
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109778
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109778
CVE-2026-109779 (Race condition in the Networking: DNS component. This vulnerability wa ...)
- firefox <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109779
@@ -5074,8 +5191,10 @@ CVE-2026-109780 (Mitigation bypass in the DOM: Core & HTML component. This vulne
CVE-2026-109781 (Denial-of-service in the Printing: Output component. This vulnerabilit ...)
- firefox <unfixed>
- firefox-esr 153.5.0esr-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/#CVE-2026-109781
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/#CVE-2026-109781
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-109781
CVE-2026-102699 ([This CNA information record relates to multiple CVEs; the text explai ...)
- xen <unfixed>
NOTE: https://xenbits.xen.org/xsa/advisory-519.html
@@ -12918,7 +13037,9 @@ CVE-2026-106026 (tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerab
NOTE: https://git.kernel.org/pub/scm/network/tftp/tftp-hpa.git/commit/?id=6735086fb6475c3e1f1daf9829836b3d06f14291 (tftp-hpa-6.0)
CVE-2026-106016 (Mitigation bypass in the File Handling component. This vulnerability w ...)
- firefox 157.0.1-1
+ - thunderbird <unfixed>
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-104/#CVE-2026-106016
+ NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/#CVE-2026-106016
CVE-2026-105985 (Craft CMS 5.10.13.2 contains an authenticated remote code execution vu ...)
NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-105957 (A vulnerability was detected in SourceCodester Performance Indicator S ...)
=====================================
data/dsa-needed.txt
=====================================
@@ -171,6 +171,8 @@ spip (carnil)
--
squid
--
+thunderbird (jmm)
+--
tomcat10
Bastien Roucaries proposed an update for review
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a8c8fa3a70f9a0c10936005781c36e22a2fc7839
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a8c8fa3a70f9a0c10936005781c36e22a2fc7839
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261014/62304b08/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list