SUSE-SU-2026:1163-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2026/suse-su-20261163-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1163-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2026:1163-1
Upstream
  • CVE-2026-3889
  • CVE-2026-4371
  • CVE-2026-4684
  • CVE-2026-4685
  • CVE-2026-4686
  • CVE-2026-4687
  • CVE-2026-4688
  • CVE-2026-4689
  • CVE-2026-4690
  • CVE-2026-4691
  • CVE-2026-4692
  • CVE-2026-4693
  • CVE-2026-4694
  • CVE-2026-4695
  • CVE-2026-4696
  • CVE-2026-4697
  • CVE-2026-4698
  • CVE-2026-4699
  • CVE-2026-4700
  • CVE-2026-4701
  • CVE-2026-4702
  • CVE-2026-4704
  • CVE-2026-4705
  • CVE-2026-4706
  • CVE-2026-4707
  • CVE-2026-4708
  • CVE-2026-4709
  • CVE-2026-4710
  • CVE-2026-4711
  • CVE-2026-4712
  • CVE-2026-4713
  • CVE-2026-4714
  • CVE-2026-4715
  • CVE-2026-4716
  • CVE-2026-4717
  • CVE-2026-4718
  • CVE-2026-4719
  • CVE-2026-4720
  • CVE-2026-4721
Related
  • CVE-2025-59375
  • CVE-2026-3889
  • CVE-2026-4371
  • CVE-2026-4684
  • CVE-2026-4685
  • CVE-2026-4686
  • CVE-2026-4687
  • CVE-2026-4688
  • CVE-2026-4689
  • CVE-2026-4690
  • CVE-2026-4691
  • CVE-2026-4692
  • CVE-2026-4693
  • CVE-2026-4694
  • CVE-2026-4695
  • CVE-2026-4696
  • CVE-2026-4697
  • CVE-2026-4698
  • CVE-2026-4699
  • CVE-2026-4700
  • CVE-2026-4701
  • CVE-2026-4702
  • CVE-2026-4704
  • CVE-2026-4705
  • CVE-2026-4706
  • CVE-2026-4707
  • CVE-2026-4708
  • CVE-2026-4709
  • CVE-2026-4710
  • CVE-2026-4711
  • CVE-2026-4712
  • CVE-2026-4713
  • CVE-2026-4714
  • CVE-2026-4715
  • CVE-2026-4716
  • CVE-2026-4717
  • CVE-2026-4718
  • CVE-2026-4719
  • CVE-2026-4720
  • CVE-2026-4721
Published
2026-04-01T08:49:11Z
Modified
2026-04-02T13:30:49.113203Z
Summary
Security update for MozillaThunderbird
Details

This update for MozillaThunderbird fixes the following issues:

Update to Mozilla Thunderbird 140.9 (MFSA 2026-24, bsc#1260083):

  • CVE-2026-3889: Spoofing issue in Thunderbird
  • CVE-2026-4371: Out of bounds read in IMAP parsing
  • CVE-2026-4684: Race condition, use-after-free in the Graphics: WebRender component
  • CVE-2026-4685: Incorrect boundary conditions in the Graphics: Canvas2D component
  • CVE-2026-4686: Incorrect boundary conditions in the Graphics: Canvas2D component
  • CVE-2026-4687: Sandbox escape due to incorrect boundary conditions in the Telemetry component
  • CVE-2026-4688: Sandbox escape due to use-after-free in the Disability Access APIs component
  • CVE-2026-4689: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component
  • CVE-2026-4690: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component
  • CVE-2026-4691: Use-after-free in the CSS Parsing and Computation component
  • CVE-2026-4692: Sandbox escape in the Responsive Design Mode component
  • CVE-2026-4693: Incorrect boundary conditions in the Audio/Video: Playback component
  • CVE-2026-4694: Incorrect boundary conditions, integer overflow in the Graphics component
  • CVE-2026-4695: Incorrect boundary conditions in the Audio/Video: Web Codecs component
  • CVE-2026-4696: Use-after-free in the Layout: Text and Fonts component
  • CVE-2026-4697: Incorrect boundary conditions in the Audio/Video: Web Codecs component
  • CVE-2026-4698: JIT miscompilation in the JavaScript Engine: JIT component
  • CVE-2026-4699: Incorrect boundary conditions in the Layout: Text and Fonts component
  • CVE-2026-4700: Mitigation bypass in the Networking: HTTP component
  • CVE-2026-4701: Use-after-free in the JavaScript Engine component
  • CVE-2026-4702: JIT miscompilation in the JavaScript Engine component
  • CVE-2026-4704: Denial-of-service in the WebRTC: Signaling component
  • CVE-2026-4705: Undefined behavior in the WebRTC: Signaling component
  • CVE-2026-4706: Incorrect boundary conditions in the Graphics: Canvas2D component
  • CVE-2026-4707: Incorrect boundary conditions in the Graphics: Canvas2D component
  • CVE-2026-4708: Incorrect boundary conditions in the Graphics component
  • CVE-2026-4709: Incorrect boundary conditions in the Audio/Video: GMP component
  • CVE-2026-4710: Incorrect boundary conditions in the Audio/Video component
  • CVE-2026-4711: Use-after-free in the Widget: Cocoa component
  • CVE-2026-4712: Information disclosure in the Widget: Cocoa component
  • CVE-2026-4713: Incorrect boundary conditions in the Graphics component
  • CVE-2026-4714: Incorrect boundary conditions in the Audio/Video component
  • CVE-2026-4715: Uninitialized memory in the Graphics: Canvas2D component
  • CVE-2026-4716: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component
  • CVE-2026-4717: Privilege escalation in the Netmonitor component
  • CVE-2025-59375: Denial-of-service in the XML component
  • CVE-2026-4718: Undefined behavior in the WebRTC: Signaling component
  • CVE-2026-4719: Incorrect boundary conditions in the Graphics: Text component
  • CVE-2026-4720: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149
  • CVE-2026-4721: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149
References

Affected packages

openSUSE:Leap 15.6 / MozillaThunderbird

Package

Name
MozillaThunderbird
Purl
pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Leap%2015.6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
140.9.0-150200.8.263.1

Ecosystem specific 

{
    "binaries": [
        {
            "MozillaThunderbird-translations-common": "140.9.0-150200.8.263.1",
            "MozillaThunderbird-translations-other": "140.9.0-150200.8.263.1",
            "MozillaThunderbird": "140.9.0-150200.8.263.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1163-1.json"