[Git][security-tracker-team/security-tracker][master] new thunderbird issues

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
8aecb2cd by Moritz Mühlenhoff at 2026-10-22T01:04:05+02:00
new thunderbird issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1721,13 +1721,17 @@ CVE-2026-114038 (A flaw was found in device-mapper-multipath. A local user can t
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2469787
 	NOTE: https://github.com/opensvc/multipath-tools/commit/d75d74f1d344cab8a98258773b85dbffa6895902 (0.15.1)
 CVE-2026-113869 (When Thunderbird asked for a security device password (for example a s ...)
-	TODO: check
+	- thunderbird <not-affected> (Only affects Thunderbird post ESR153)
+	NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-114/#CVE-2026-113869
 CVE-2026-113868 (When authenticating to a POP3 or SMTP server using NTLM, Thunderbird d ...)
-	TODO: check
+	- thunderbird <unfixed>
+	NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-115/#CVE-2026-113868
 CVE-2026-113867 (Thunderbird did not escape attribute values when serializing outgoing  ...)
-	TODO: check
+	- thunderbird <unfixed>
+	NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-115/#CVE-2026-113867
 CVE-2026-113866 (When setting up an account, Thunderbird's Exchange AutoDiscover lookup ...)
-	TODO: check
+	- thunderbird <unfixed>
+	NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-115/#CVE-2026-113866
 CVE-2026-113776 (virtualenv is a tool for creating isolated virtual python environments ...)
 	TODO: check
 CVE-2026-113744 (A security vulnerability has been detected in Tenda AC19 16.03.10.07.  ...)
@@ -4305,8 +4309,10 @@ CVE-2026-113400 (Uninitialized memory in the Audio/Video: cubeb component. This
 CVE-2026-113470 (Mozilla blocked compromised intermediate eMudhra certificates via OneC ...)
 	- firefox 158.0.1-1
 	- firefox-esr 153.5.1esr-1
+	- thunderbird <unfixed>
 	NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/#CVE-2026-113470
 	NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-112/#CVE-2026-113470
+	NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-115/#CVE-2026-113866
 	NOTE: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449
 	NOTE: https://www.openwall.com/lists/oss-security/2026/10/20/1
 CVE-2026-113399 (Incorrect boundary conditions in the SVG component. This vulnerability ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8aecb2cd965607c98575c24f71aef9851b029134

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8aecb2cd965607c98575c24f71aef9851b029134
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261021/48ebb30e/attachment.htm>