RHSA-2026:65159HighCVSS 7.5

Red Hat Security Advisory: thunderbird security update

Published
September 8, 2026
Last Modified
September 8, 2026

🔗 CVE IDs covered (21)

CVE-2026-74953 →CVE-2026-74957 →CVE-2026-74960 →CVE-2026-74976 →CVE-2026-74959 →CVE-2026-74963 →CVE-2026-74971 →CVE-2026-74962 →CVE-2026-74964 →CVE-2026-74936 →CVE-2026-74939 →CVE-2026-74945 →CVE-2026-74972 →CVE-2026-74974 →CVE-2026-74987 →CVE-2026-74934 →CVE-2026-74935 →CVE-2026-74973 →CVE-2026-74990 →CVE-2026-74942 →CVE-2026-74948 →

📋 Description

CVE-2026-74934 — firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component CVE-2026-74935 — firefox: thunderbird: Privilege escalation in the DOM: Networking component CVE-2026-74936 — firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component CVE-2026-74939 — firefox: thunderbird: Privilege escalation in the DOM: Navigation component CVE-2026-74942 — firefox: Privilege escalation in the Remote Settings Client component CVE-2026-74945 — firefox: thunderbird: Information disclosure in the Graphics: Text component CVE-2026-74948 — firefox: thunderbird: Information disclosure in the Graphics component CVE-2026-74953 — firefox: thunderbird: Privilege escalation in the Networking: Cookies component CVE-2026-74957 — firefox: thunderbird: Mitigation bypass in the Safe Browsing component CVE-2026-74959 — firefox: thunderbird: Mitigation bypass in the Storage: Cache API component CVE-2026-74960 — firefox: thunderbird: Site isolation issue in the WebExtensions component CVE-2026-74962 — firefox: Site isolation issue in the Networking: Cookies component CVE-2026-74963 — firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component CVE-2026-74964 — firefox: Integer overflow in the Graphics component CVE-2026-74971 — firefox: thunderbird: Information disclosure in the DOM: UI Events & Focus Handling component CVE-2026-74972 — firefox: thunderbird: Information disclosure in the DOM: Push Subscriptions component CVE-2026-74973 — firefox: Race condition, use-after-free in the Graphics component CVE-2026-74974 — firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component CVE-2026-74976 — firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component CVE-2026-74987 — firefox: thunderbird: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 CVE-2026-74990 — firefox: thunderbird: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154

🎯 Affected products14

  • Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-0:140.14.0-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-0:140.14.0-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-0:140.14.0-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-0:140.14.0-1.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-0:140.14.0-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-debuginfo-0:140.14.0-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-debuginfo-0:140.14.0-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-debuginfo-0:140.14.0-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-debuginfo-0:140.14.0-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-debugsource-0:140.14.0-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-debugsource-0:140.14.0-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-debugsource-0:140.14.0-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-debugsource-0:140.14.0-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

🔗 References (24)