CLSA-2026-1787115646

See a problem?
Import Source
https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1787115646.json
JSON Data
https://api.osv.dev/v1/vulns/CLSA-2026-1787115646
Upstream
CVE (31)
  • CVE-2026-16364
  • CVE-2026-16365
  • CVE-2026-16366
  • CVE-2026-16367
  • CVE-2026-16370
  • CVE-2026-16372
  • CVE-2026-16376
  • CVE-2026-16378
  • CVE-2026-16380
  • CVE-2026-16382
  • CVE-2026-16384
  • CVE-2026-16385
  • CVE-2026-16386
  • CVE-2026-16388
  • CVE-2026-16389
  • CVE-2026-16392
  • CVE-2026-16393
  • CVE-2026-16394
  • CVE-2026-16395
  • CVE-2026-16398
  • CVE-2026-16399
  • CVE-2026-16400
  • CVE-2026-16401
  • CVE-2026-16402
  • CVE-2026-16403
  • CVE-2026-16406
  • CVE-2026-16407
  • CVE-2026-16408
  • CVE-2026-16409
  • CVE-2026-16410
  • CVE-2026-16411
Published
2026-08-20T10:20:38Z
Modified
2026-10-26T09:30:32Z
Summary
thunderbird: Fix of 48 CVEs
Details
  • update to 153.0.1 ESR (MFSA 2026-71)
  • drop six patches made obsolete by 153: P02 firefox-gcc-build (fixed upstream), P15 build-system-nss + P16 build-tb-system-nss (both patch third_party/rust/neqo-crypto, a directory 153 no longer has), P19 build-min-lexical, P52 exceptionHandled-for-IO-error-processhandler and P111 av1-else-condition-add (all upstreamed)
  • Source404 nss-3.126.0-1.el9.src.rpm is a locally rebranded Fedora artifact (md5 1fc9b7b02f848fc99e06d5a8680ea5a3), rebuilt from Fedora rawhide dist-git commit 43cbb021d9886d5abc3d4cb546d022929b9bb1dc (2026-07-29) whose own NVR is nss-3.126.0-1; there is no public nss-3.126.0-1.el9, so the .el9 disttag reflects the build target, not an upstream vendor NVR. The EL9-vs-Fedora patch disposition (Alma c9 carries 29 downstream patches, Fedora 3.126 carries 14) is tracked as a follow-up; NSS stays private to thunderbird either way
  • P103 mozilla-bmo1504834-part1 loses its gfx/2d/Types.h hunk: that hunk rewrote an #if MOZ_LITTLE_ENDIAN()/#elif MOZ_BIG_ENDIAN() block which 153 replaced with A8R8G8B8_UINT32 = std::endian::native == std::endian::little ? B8G8R8A8 : A8R8G8B8, so it had nothing left to apply; on little-endian that ternary yields B8G8R8A8, which is what the hunk forced. The surviving DrawTargetSkia.cpp kARGBAlphaOffset = 0 is a pre-existing Fedora-inherited override that does NOT match the upstream little-endian value there (that ternary yields 3), but it sits inside #ifdef DEBUG (gfx/2d/DrawTargetSkia.cpp:154-257) alongside VerifyRGBXFormat/VerifyRGBXCorners, so it is compiled out of release builds entirely and has no release impact on any arch
  • update bundled cbindgen to 0.29.4; Gecko 153 requires >= 0.29.4 and the previous bundle provided 0.27.0
  • update bundled NSS to 3.126.0 (with NSPR 4.39); Gecko 153 requires nss >= 3.125 and no RHEL/AlmaLinux stream ships one (9.8 still has 3.112). Rebased on the Fedora nss packaging, which tracks 3.126 with a patch set that applies cleanly; the RHEL 3.112 patch set does not survive the jump. NSS stays private to thunderbird under /usr/lib64/thunderbird/bundled as before -- the platform NSS is untouched. Note Source403 (EL8 path) still carries 3.112.
  • fix the unsorted openssl-backend SOURCES list in comm/third_party/rnp/moz.build; mozbuild requires SOURCES to be appended in sorted order and upstream only exercises the botan backend, so the bug is invisible to them
  • CVE-2026-16364: Incorrect boundary conditions in the Audio/Video: Playback component
  • CVE-2026-16365: Privilege escalation in the DOM: Workers component
  • CVE-2026-16366: Privilege escalation in the DOM: Navigation component
  • CVE-2026-16367: Sandbox escape due to invalid pointer in the Disability Access APIs component
  • CVE-2026-16370: Mitigation bypass in the DOM: Networking component
  • CVE-2026-16372: Privilege escalation in the DOM: Content Processes component
  • CVE-2026-16376: Denial-of-service in the Graphics: WebGPU component
  • CVE-2026-16378: Other issue in the DOM: Copy & Paste and Drag & Drop component
  • CVE-2026-16380: Mitigation bypass in the Networking component
  • CVE-2026-16382: Mitigation bypass in the DOM: Service Workers component
  • CVE-2026-16384: Information disclosure due to uninitialized memory in the Graphics: WebGPU component
  • CVE-2026-16385: Information disclosure due to uninitialized memory in the Graphics: WebGPU component
  • CVE-2026-16386: Information disclosure due to uninitialized memory in the Graphics: WebGPU component
  • CVE-2026-16388: Sandbox escape in the DOM: Networking component
  • CVE-2026-16389: Incorrect boundary conditions, integer overflow in the Libraries component in NSS
  • CVE-2026-16392: JIT miscompilation in the JavaScript Engine: JIT component
  • CVE-2026-16393: Incorrect boundary conditions in the Graphics: WebGPU component
  • CVE-2026-16394: Mitigation bypass in the DOM: Security component
  • CVE-2026-16395: Integer overflow in the Audio/Video component
  • CVE-2026-16398: Site isolation issue in the Graphics component
  • CVE-2026-16399: Site isolation issue in the DOM: Navigation component
  • CVE-2026-16400: Information disclosure in the DOM: Security component
  • CVE-2026-16401: Privilege escalation in the Data Loss Prevention component
  • CVE-2026-16402: Integer overflow in the Graphics: ImageLib component
  • CVE-2026-16403: Spoofing issue in the Address Bar component
  • CVE-2026-16406: Mitigation bypass in the Networking component
  • CVE-2026-16407: Mitigation bypass in the DOM: Service Workers component
  • CVE-2026-16408: Integer overflow in the Audio/Video: Playback component
  • CVE-2026-16409: Invalid pointer in the Security: PSM component
  • CVE-2026-16410: JIT miscompilation in the JavaScript Engine: JIT component
  • CVE-2026-16411: Memory safety bugs fixed in Thunderbird 153
References

Affected packages

TuxCare:AlmaLinux:9.2 / thunderbird

Package

Name
thunderbird
Purl
pkg:rpm/tuxcare/thunderbird?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
153.0.1-1.el9_2.alma.1.tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1787115646.json"