CLSA-2026-1792779937

See a problem?
Import Source
https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792779937.json
JSON Data
https://api.osv.dev/v1/vulns/CLSA-2026-1792779937
Upstream
CVE (125)
  • CVE-2026-100756
  • CVE-2026-100757
  • CVE-2026-100758
  • CVE-2026-100759
  • CVE-2026-100760
  • CVE-2026-100762
  • CVE-2026-100765
  • CVE-2026-100766
  • CVE-2026-100767
  • CVE-2026-100769
  • CVE-2026-100770
  • CVE-2026-100771
  • CVE-2026-100772
  • CVE-2026-100773
  • CVE-2026-100774
  • CVE-2026-100775
  • CVE-2026-100776
  • CVE-2026-100777
  • CVE-2026-100778
  • CVE-2026-100779
  • CVE-2026-100780
  • CVE-2026-100781
  • CVE-2026-100782
  • CVE-2026-100783
  • CVE-2026-100784
  • CVE-2026-100785
  • CVE-2026-100786
  • CVE-2026-100787
  • CVE-2026-100788
  • CVE-2026-100789
  • CVE-2026-100790
  • CVE-2026-100791
  • CVE-2026-100792
  • CVE-2026-100794
  • CVE-2026-100797
  • CVE-2026-100798
  • CVE-2026-100800
  • CVE-2026-100801
  • CVE-2026-100803
  • CVE-2026-100806
  • CVE-2026-100807
  • CVE-2026-100808
  • CVE-2026-100809
  • CVE-2026-100811
  • CVE-2026-100812
  • CVE-2026-100814
  • CVE-2026-100815
  • CVE-2026-100816
  • CVE-2026-100818
  • CVE-2026-100819
  • CVE-2026-100820
  • CVE-2026-100821
  • CVE-2026-100822
  • CVE-2026-100824
  • CVE-2026-100825
  • CVE-2026-100826
  • CVE-2026-100828
  • CVE-2026-100829
  • CVE-2026-100830
  • CVE-2026-100831
  • CVE-2026-100832
  • CVE-2026-103500
  • CVE-2026-109704
  • CVE-2026-109705
  • CVE-2026-109706
  • CVE-2026-109707
  • CVE-2026-109708
  • CVE-2026-109709
  • CVE-2026-109710
  • CVE-2026-109711
  • CVE-2026-109712
  • CVE-2026-109713
  • CVE-2026-109715
  • CVE-2026-109716
  • CVE-2026-109717
  • CVE-2026-109718
  • CVE-2026-109719
  • CVE-2026-109720
  • CVE-2026-109721
  • CVE-2026-109722
  • CVE-2026-109723
  • CVE-2026-109724
  • CVE-2026-109725
  • CVE-2026-109726
  • CVE-2026-109727
  • CVE-2026-109728
  • CVE-2026-109729
  • CVE-2026-109730
  • CVE-2026-109731
  • CVE-2026-109732
  • CVE-2026-109733
  • CVE-2026-109734
  • CVE-2026-109736
  • CVE-2026-109737
  • CVE-2026-109738
  • CVE-2026-109740
  • CVE-2026-109741
  • CVE-2026-109742
  • CVE-2026-109743
  • CVE-2026-109744
  • CVE-2026-109745
  • CVE-2026-109751
  • CVE-2026-109752
  • CVE-2026-109753
  • CVE-2026-109754
  • CVE-2026-109756
  • CVE-2026-109757
  • CVE-2026-109759
  • CVE-2026-109760
  • CVE-2026-109762
  • CVE-2026-109763
  • CVE-2026-109764
  • CVE-2026-109765
  • CVE-2026-109766
  • CVE-2026-109767
  • CVE-2026-109770
  • CVE-2026-109775
  • CVE-2026-109776
  • CVE-2026-109777
  • CVE-2026-109778
  • CVE-2026-109781
  • CVE-2026-109782
  • CVE-2026-109783
  • CVE-2026-110249
  • CVE-2026-96869
Published
2026-10-23T18:27:45Z
Modified
2026-10-26T09:43:19Z
Summary
thunderbird: Fix of 56 CVEs
Details
  • update to 153.5.0 ESR (MFSA 2026-103 for 153.4, MFSA 2026-110 for 153.5)
  • drop CVE-2026-100779-CVE-2026-100785.patch and CVE-2026-100781.patch, their fixes are part of 153.5.0
  • stop packaging rnp-cli and rnpkeys: upstream no longer installs them (bug 2068130); librnp.so is still shipped
  • regenerate langpacks from the 153.5.0esr release xpi set (66 languages, the same set as 153.3.1esr)
  • CVE-2026-103500: Heap buffer overflow opening large email
  • CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback component
  • CVE-2026-100757: Use-after-free in the Widget component
  • CVE-2026-100758: Sandbox escape in the DOM: Navigation component
  • CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager component
  • CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing component
  • CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content Processes component
  • CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component
  • CVE-2026-100766: Information disclosure in the Networking: JAR component
  • CVE-2026-100767: Use-after-free in the Networking: Cache component
  • CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component
  • CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content Processes component
  • CVE-2026-100771: Undefined behavior in the DOM: Streams component
  • CVE-2026-100772: Use-after-free in the DOM: Core & HTML component
  • CVE-2026-100773: Use-after-free in the Storage: IndexedDB component
  • CVE-2026-100774: Use-after-free in the DOM: Core & HTML component
  • CVE-2026-100775: Sandbox escape in the Graphics component
  • CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component
  • CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component
  • CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core & HTML component
  • CVE-2026-100779: Use-after-free in the XSLT component
  • CVE-2026-100780: Use-after-free in the DOM: Core & HTML component
  • CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
  • CVE-2026-100782: Privilege escalation due to incorrect boundary conditions in the Graphics component
  • CVE-2026-100783: Uninitialized memory in the Audio/Video component
  • CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component
  • CVE-2026-100785: Use-after-free in the DOM: Core & HTML component
  • CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics component
  • CVE-2026-100787: Sandbox escape in the XUL component
  • CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component
  • CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component
  • CVE-2026-100790: Use-after-free in the XSLT component
  • CVE-2026-100791: Use-after-free in the DOM: Core & HTML component
  • CVE-2026-100832: Use-after-free in the Graphics: Canvas2D component
  • CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly component
  • CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the Internationalization component
  • CVE-2026-96869: Information disclosure in the Networking component
  • CVE-2026-100797: Privilege escalation due to use-after-free in the Graphics: WebRender component
  • CVE-2026-100798: Cryptography misuse in Storage: Quota Manager component
  • CVE-2026-100800: Sandbox escape due to use-after-free in the Disability Access APIs component
  • CVE-2026-100801: Privilege escalation in the DLL Services component
  • CVE-2026-100803: Same-origin policy bypass in the WebExtensions component
  • CVE-2026-100806: Uninitialized memory in the Graphics: WebGPU component
  • CVE-2026-100807: Privilege escalation in the DOM: Service Workers component
  • CVE-2026-100808: Mitigation bypass in the DOM: Service Workers component
  • CVE-2026-100809: Same-origin policy bypass in the DevTools component
  • CVE-2026-100811: Sandbox escape due to use-after-free in the DOM: Core & HTML component
  • CVE-2026-100812: Denial-of-service in the Graphics component
  • CVE-2026-100814: Incorrect boundary conditions in the JavaScript Engine: JIT component
  • CVE-2026-100815: Use-after-free in the CSS Parsing and Computation component
  • CVE-2026-100816: Site isolation issue in the DOM: Networking component
  • CVE-2026-100818: Sandbox escape due to use-after-free in the Widget: Gtk component
  • CVE-2026-100819: Sandbox escape due to incorrect boundary conditions in the XPCOM component
  • CVE-2026-100820: Privilege escalation in the Address Bar component
  • CVE-2026-100821: Site isolation issue in the Panning and Zooming component
  • CVE-2026-100822: Spoofing issue in the Networking: HTTP component
  • CVE-2026-100824: Privilege escalation in the Places component
  • CVE-2026-100825: Use-after-free in the JavaScript Engine: JIT component
  • CVE-2026-100826: Denial-of-service in the Storage: StorageManager component
  • CVE-2026-100828: Mitigation bypass in the Bookmarks & History component
  • CVE-2026-100829: Mitigation bypass in the DOM: Security component
  • CVE-2026-100830: Mitigation bypass in the DOM: Navigation component
  • CVE-2026-100831: Use-after-free in the DOM: UI Events & Focus Handling component
  • CVE-2026-110249: Denial-of-service in the Exchange email component
  • CVE-2026-109704: Privilege escalation in the Application Update component
  • CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component
  • CVE-2026-109706: Use-after-free in the Storage: IndexedDB component
  • CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component
  • CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component
  • CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component
  • CVE-2026-109710: Use-after-free in the Graphics: Text component
  • CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component
  • CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component
  • CVE-2026-109713: Use-after-free in the Crash Reporting component
  • CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component
  • CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component
  • CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component
  • CVE-2026-109718: Use-after-free in the XML component
  • CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component
  • CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component
  • CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component
  • CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component
  • CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component
  • CVE-2026-109724: Use-after-free in the DOM: Core & HTML component
  • CVE-2026-109725: Use-after-free in the DOM: Core & HTML component
  • CVE-2026-109726: Use-after-free in the SVG component
  • CVE-2026-109727: Use-after-free in the Audio/Video component
  • CVE-2026-109728: Use-after-free in the DOM: Animation component
  • CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component
  • CVE-2026-109730: Integer overflow in the Graphics component
  • CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component
  • CVE-2026-109732: Use-after-free in the DOM: Streams component
  • CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component
  • CVE-2026-109734: Mitigation bypass in the DOM: Security component
  • CVE-2026-109736: Frame poisoning in the Layout component
  • CVE-2026-109737: Mitigation bypass in the Enterprise Policies component
  • CVE-2026-109738: Use-after-free in the Audio/Video: Playback component
  • CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
  • CVE-2026-109741: Use-after-free in the Storage: Bucket File System component
  • CVE-2026-109742: Information disclosure in the PDF Viewer component
  • CVE-2026-109743: Privilege escalation in the Panning and Zooming component
  • CVE-2026-109744: Other issue in the DOM: File component
  • CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component
  • CVE-2026-109782: Mitigation bypass in the File Handling component
  • CVE-2026-109751: Information disclosure in the Networking component
  • CVE-2026-109752: Use-after-free in the DOM: Workers component
  • CVE-2026-109753: Incorrect boundary conditions in the Layout component
  • CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component
  • CVE-2026-109756: Privilege escalation in the DOM: Navigation component
  • CVE-2026-109757: Sandbox escape due to race condition in the Networking component
  • CVE-2026-109759: Site isolation issue in the Networking component
  • CVE-2026-109760: Mitigation bypass in the Networking: HTTP component
  • CVE-2026-109762: Incorrect boundary conditions in the SVG component
  • CVE-2026-109763: Mitigation bypass in the File Handling component
  • CVE-2026-109764: Mitigation bypass in the Enterprise Policies component
  • CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component
  • CVE-2026-109766: Mitigation bypass in the Enterprise Policies component
  • CVE-2026-109767: Information disclosure in the Networking component
  • CVE-2026-109783: Mitigation bypass in the File Handling component
  • CVE-2026-109770: Spoofing issue in the DOM: Web Serial component
  • CVE-2026-109775: Denial-of-service in the WebRTC component
  • CVE-2026-109776: Race condition in the XPCOM component
  • CVE-2026-109777: Information disclosure in the Storage: IndexedDB component
  • CVE-2026-109778: Privilege escalation in the WebExtensions component
  • CVE-2026-109781: Denial-of-service in the Printing: Output component
References

Affected packages

TuxCare:AlmaLinux:9.2 / thunderbird

Package

Name
thunderbird
Purl
pkg:rpm/tuxcare/thunderbird?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
153.5.0-1.el9_2.alma.1.tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792779937.json"