SUSE-SU-2026:4627-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2026/suse-su-20264627-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4627-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2026:4627-1
Upstream
CVE (129)
  • CVE-2026-100756
  • CVE-2026-100757
  • CVE-2026-100758
  • CVE-2026-100759
  • CVE-2026-100760
  • CVE-2026-100762
  • CVE-2026-100765
  • CVE-2026-100766
  • CVE-2026-100767
  • CVE-2026-100769
  • CVE-2026-100770
  • CVE-2026-100771
  • CVE-2026-100772
  • CVE-2026-100773
  • CVE-2026-100774
  • CVE-2026-100775
  • CVE-2026-100776
  • CVE-2026-100777
  • CVE-2026-100778
  • CVE-2026-100779
  • CVE-2026-100780
  • CVE-2026-100781
  • CVE-2026-100782
  • CVE-2026-100783
  • CVE-2026-100784
  • CVE-2026-100785
  • CVE-2026-100786
  • CVE-2026-100787
  • CVE-2026-100788
  • CVE-2026-100789
  • CVE-2026-100790
  • CVE-2026-100791
  • CVE-2026-100792
  • CVE-2026-100794
  • CVE-2026-100797
  • CVE-2026-100798
  • CVE-2026-100800
  • CVE-2026-100801
  • CVE-2026-100803
  • CVE-2026-100806
  • CVE-2026-100807
  • CVE-2026-100808
  • CVE-2026-100809
  • CVE-2026-100811
  • CVE-2026-100812
  • CVE-2026-100814
  • CVE-2026-100815
  • CVE-2026-100816
  • CVE-2026-100818
  • CVE-2026-100819
  • CVE-2026-100820
  • CVE-2026-100821
  • CVE-2026-100822
  • CVE-2026-100824
  • CVE-2026-100825
  • CVE-2026-100826
  • CVE-2026-100828
  • CVE-2026-100829
  • CVE-2026-100830
  • CVE-2026-100831
  • CVE-2026-100832
  • CVE-2026-103500
  • CVE-2026-92005
  • CVE-2026-92006
  • CVE-2026-92007
  • CVE-2026-92008
  • CVE-2026-92009
  • CVE-2026-92010
  • CVE-2026-92011
  • CVE-2026-92012
  • CVE-2026-92013
  • CVE-2026-92015
  • CVE-2026-92016
  • CVE-2026-92017
  • CVE-2026-92018
  • CVE-2026-92019
  • CVE-2026-92020
  • CVE-2026-92022
  • CVE-2026-92023
  • CVE-2026-92024
  • CVE-2026-92025
  • CVE-2026-92026
  • CVE-2026-92027
  • CVE-2026-92028
  • CVE-2026-92029
  • CVE-2026-92030
  • CVE-2026-92031
  • CVE-2026-92032
  • CVE-2026-92035
  • CVE-2026-92038
  • CVE-2026-92039
  • CVE-2026-92041
  • CVE-2026-92042
  • CVE-2026-92043
  • CVE-2026-92044
  • CVE-2026-92045
  • CVE-2026-92046
  • CVE-2026-92047
  • CVE-2026-92048
  • CVE-2026-92049
  • CVE-2026-92052
  • CVE-2026-92053
  • CVE-2026-92054
  • CVE-2026-92055
  • CVE-2026-92056
  • CVE-2026-92057
  • CVE-2026-92058
  • CVE-2026-92059
  • CVE-2026-92060
  • CVE-2026-92062
  • CVE-2026-92064
  • CVE-2026-92065
  • CVE-2026-92067
  • CVE-2026-92068
  • CVE-2026-92069
  • CVE-2026-92070
  • CVE-2026-92071
  • CVE-2026-92072
  • CVE-2026-92073
  • CVE-2026-92074
  • CVE-2026-92075
  • CVE-2026-92076
  • CVE-2026-92077
  • CVE-2026-92078
  • CVE-2026-92079
  • CVE-2026-92238
  • CVE-2026-92239
  • CVE-2026-92240
  • CVE-2026-96869
Related
CVE (129)
  • CVE-2026-100756
  • CVE-2026-100757
  • CVE-2026-100758
  • CVE-2026-100759
  • CVE-2026-100760
  • CVE-2026-100762
  • CVE-2026-100765
  • CVE-2026-100766
  • CVE-2026-100767
  • CVE-2026-100769
  • CVE-2026-100770
  • CVE-2026-100771
  • CVE-2026-100772
  • CVE-2026-100773
  • CVE-2026-100774
  • CVE-2026-100775
  • CVE-2026-100776
  • CVE-2026-100777
  • CVE-2026-100778
  • CVE-2026-100779
  • CVE-2026-100780
  • CVE-2026-100781
  • CVE-2026-100782
  • CVE-2026-100783
  • CVE-2026-100784
  • CVE-2026-100785
  • CVE-2026-100786
  • CVE-2026-100787
  • CVE-2026-100788
  • CVE-2026-100789
  • CVE-2026-100790
  • CVE-2026-100791
  • CVE-2026-100792
  • CVE-2026-100794
  • CVE-2026-100797
  • CVE-2026-100798
  • CVE-2026-100800
  • CVE-2026-100801
  • CVE-2026-100803
  • CVE-2026-100806
  • CVE-2026-100807
  • CVE-2026-100808
  • CVE-2026-100809
  • CVE-2026-100811
  • CVE-2026-100812
  • CVE-2026-100814
  • CVE-2026-100815
  • CVE-2026-100816
  • CVE-2026-100818
  • CVE-2026-100819
  • CVE-2026-100820
  • CVE-2026-100821
  • CVE-2026-100822
  • CVE-2026-100824
  • CVE-2026-100825
  • CVE-2026-100826
  • CVE-2026-100828
  • CVE-2026-100829
  • CVE-2026-100830
  • CVE-2026-100831
  • CVE-2026-100832
  • CVE-2026-103500
  • CVE-2026-92005
  • CVE-2026-92006
  • CVE-2026-92007
  • CVE-2026-92008
  • CVE-2026-92009
  • CVE-2026-92010
  • CVE-2026-92011
  • CVE-2026-92012
  • CVE-2026-92013
  • CVE-2026-92015
  • CVE-2026-92016
  • CVE-2026-92017
  • CVE-2026-92018
  • CVE-2026-92019
  • CVE-2026-92020
  • CVE-2026-92022
  • CVE-2026-92023
  • CVE-2026-92024
  • CVE-2026-92025
  • CVE-2026-92026
  • CVE-2026-92027
  • CVE-2026-92028
  • CVE-2026-92029
  • CVE-2026-92030
  • CVE-2026-92031
  • CVE-2026-92032
  • CVE-2026-92035
  • CVE-2026-92038
  • CVE-2026-92039
  • CVE-2026-92041
  • CVE-2026-92042
  • CVE-2026-92043
  • CVE-2026-92044
  • CVE-2026-92045
  • CVE-2026-92046
  • CVE-2026-92047
  • CVE-2026-92048
  • CVE-2026-92049
  • CVE-2026-92052
  • CVE-2026-92053
  • CVE-2026-92054
  • CVE-2026-92055
  • CVE-2026-92056
  • CVE-2026-92057
  • CVE-2026-92058
  • CVE-2026-92059
  • CVE-2026-92060
  • CVE-2026-92062
  • CVE-2026-92064
  • CVE-2026-92065
  • CVE-2026-92067
  • CVE-2026-92068
  • CVE-2026-92069
  • CVE-2026-92070
  • CVE-2026-92071
  • CVE-2026-92072
  • CVE-2026-92073
  • CVE-2026-92074
  • CVE-2026-92075
  • CVE-2026-92076
  • CVE-2026-92077
  • CVE-2026-92078
  • CVE-2026-92079
  • CVE-2026-92238
  • CVE-2026-92239
  • CVE-2026-92240
  • CVE-2026-96869
Published
2026-10-12T14:57:41Z
Modified
2026-10-13T10:30:05Z
Summary
Security update for MozillaThunderbird
Details

This update for MozillaThunderbird fixes the following issues:

Update to Mozilla Thunderbird 153.4 (MFSA 2026-96, MFSA 2026-103, bsc#1280371, bsc#1282929):

  • CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component.
  • CVE-2026-92006: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
  • CVE-2026-92007: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
  • CVE-2026-92008: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
  • CVE-2026-92009: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
  • CVE-2026-92010: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
  • CVE-2026-92011: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
  • CVE-2026-92012: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
  • CVE-2026-92013: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
  • CVE-2026-92015: Privilege escalation in the WebExtensions component.
  • CVE-2026-92016: Use-after-free in the Disability Access APIs component.
  • CVE-2026-92017: Privilege escalation in the DOM: Service Workers component.
  • CVE-2026-92018: Sandbox escape in the DOM: Core & HTML component.
  • CVE-2026-92019: Mitigation bypass in the Remote Settings Client component.
  • CVE-2026-92020: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component.
  • CVE-2026-92022: Use-after-free in the DOM: HTML Parser component.
  • CVE-2026-92023: Use-after-free in the XML component.
  • CVE-2026-92024: Use-after-free in the SVG component.
  • CVE-2026-92025: Use-after-free in the DOM: Navigation component.
  • CVE-2026-92026: Use-after-free in the Networking component.
  • CVE-2026-92027: Use-after-free in the DOM: Streams component.
  • CVE-2026-92028: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-92029: Use-after-free in the SVG component.
  • CVE-2026-92030: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component.
  • CVE-2026-92031: Information disclosure in the Graphics: ImageLib component.
  • CVE-2026-92032: Sandbox escape due to invalid pointer in the Graphics component.
  • CVE-2026-92035: Sandbox escape due to incorrect boundary conditions in the Graphics component.
  • CVE-2026-92038: Mitigation bypass in the Remote Settings Client component.
  • CVE-2026-92039: Mitigation bypass in the DOM: Notifications component.
  • CVE-2026-92041: Mitigation bypass in the DOM: Networking component.
  • CVE-2026-92042: Race condition in the DOM: Content Processes component.
  • CVE-2026-92043: Privilege escalation due to incorrect boundary conditions in the Audio/Video component.
  • CVE-2026-92044: Information disclosure in the Networking: HTTP component.
  • CVE-2026-92045: Sandbox escape due to incorrect boundary conditions in the WebRTC component.
  • CVE-2026-92046: Use-after-free in the Graphics component.
  • CVE-2026-92047: Privilege escalation in the Crash Reporting component.
  • CVE-2026-92048: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.
  • CVE-2026-92049: Use-after-free in the Widget: Win32 component.
  • CVE-2026-92052: Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component.
  • CVE-2026-92053: Privilege escalation in the Graphics: CanvasWebGL component.
  • CVE-2026-92054: Privilege escalation in the Memory component.
  • CVE-2026-92055: Privilege escalation in the DevTools component.
  • CVE-2026-92056: Use-after-free in the Graphics: Text component.
  • CVE-2026-92057: Mitigation bypass in the Enterprise Policies component.
  • CVE-2026-92058: Use-after-free in the Graphics component.
  • CVE-2026-92059: Incorrect boundary conditions in the DOM: Editor component.
  • CVE-2026-92060: Use-after-free in the Internationalization component.
  • CVE-2026-92062: Privilege escalation in the Session Restore component.
  • CVE-2026-92064: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.
  • CVE-2026-92065: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.
  • CVE-2026-92067: Use-after-free in the Widget: Gtk component.
  • CVE-2026-92068: Site isolation issue in the Reader Mode component.
  • CVE-2026-92069: Spoofing issue in the DOM: Navigation component.
  • CVE-2026-92070: Information disclosure in the Networking component.
  • CVE-2026-92071: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.
  • CVE-2026-92072: Incorrect boundary conditions in the Safe Browsing component.
  • CVE-2026-92073: Privilege escalation in the Enterprise Policies component.
  • CVE-2026-92074: Mitigation bypass in the Popup Blocker component.
  • CVE-2026-92075: Mitigation bypass in the Networking component.
  • CVE-2026-92076: Incorrect boundary conditions in the Networking component.
  • CVE-2026-92077: Denial-of-service in the SVG component.
  • CVE-2026-92078: Denial-of-service in the Security component.
  • CVE-2026-92079: Mitigation bypass in the Widget: Win32 component.
  • CVE-2026-92238: Ambiguous parsing of mail headers.
  • CVE-2026-92239: Buffer overrun in IMAP.
  • CVE-2026-92240: Out-of-bounds read in IMAP response parser.
  • CVE-2026-96869: Information disclosure in the Networking component.
  • CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback component.
  • CVE-2026-100757: Use-after-free in the Widget component.
  • CVE-2026-100758: Sandbox escape in the DOM: Navigation component.
  • CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager component.
  • CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing component.
  • CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content Processes component.
  • CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component.
  • CVE-2026-100766: Information disclosure in the Networking: JAR component.
  • CVE-2026-100767: Use-after-free in the Networking: Cache component.
  • CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component.
  • CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content Processes component.
  • CVE-2026-100771: Undefined behavior in the DOM: Streams component.
  • CVE-2026-100772: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-100773: Use-after-free in the Storage: IndexedDB component.
  • CVE-2026-100774: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-100775: Sandbox escape in the Graphics component.
  • CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component.
  • CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component.
  • CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core & HTML component.
  • CVE-2026-100779: Use-after-free in the XSLT component.
  • CVE-2026-100780: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component.
  • CVE-2026-100782: Privilege escalation due to incorrect boundary conditions in the Graphics component.
  • CVE-2026-100783: Uninitialized memory in the Audio/Video component.
  • CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component.
  • CVE-2026-100785: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics component.
  • CVE-2026-100787: Sandbox escape in the XUL component.
  • CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component.
  • CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component.
  • CVE-2026-100790: Use-after-free in the XSLT component.
  • CVE-2026-100791: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly component.
  • CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the Internationalization component.
  • CVE-2026-100797: Privilege escalation due to use-after-free in the Graphics: WebRender component.
  • CVE-2026-100798: Cryptography misuse in Storage: Quota Manager component.
  • CVE-2026-100800: Sandbox escape due to use-after-free in the Disability Access APIs component.
  • CVE-2026-100801: Privilege escalation in the DLL Services component.
  • CVE-2026-100803: Same-origin policy bypass in the WebExtensions component.
  • CVE-2026-100806: Uninitialized memory in the Graphics: WebGPU component.
  • CVE-2026-100807: Privilege escalation in the DOM: Service Workers component.
  • CVE-2026-100808: Mitigation bypass in the DOM: Service Workers component.
  • CVE-2026-100809: Same-origin policy bypass in the DevTools component.
  • CVE-2026-100811: Sandbox escape due to use-after-free in the DOM: Core & HTML component.
  • CVE-2026-100812: Denial-of-service in the Graphics component.
  • CVE-2026-100814: Incorrect boundary conditions in the JavaScript Engine: JIT component.
  • CVE-2026-100815: Use-after-free in the CSS Parsing and Computation component.
  • CVE-2026-100816: Site isolation issue in the DOM: Networking component.
  • CVE-2026-100818: Sandbox escape due to use-after-free in the Widget: Gtk component.
  • CVE-2026-100819: Sandbox escape due to incorrect boundary conditions in the XPCOM component.
  • CVE-2026-100820: Privilege escalation in the Address Bar component.
  • CVE-2026-100821: Site isolation issue in the Panning and Zooming component.
  • CVE-2026-100822: Spoofing issue in the Networking: HTTP component.
  • CVE-2026-100824: Privilege escalation in the Places component.
  • CVE-2026-100825: Use-after-free in the JavaScript Engine: JIT component.
  • CVE-2026-100826: Denial-of-service in the Storage: StorageManager component.
  • CVE-2026-100828: Mitigation bypass in the Bookmarks & History component.
  • CVE-2026-100829: Mitigation bypass in the DOM: Security component.
  • CVE-2026-100830: Mitigation bypass in the DOM: Navigation component.
  • CVE-2026-100831: Use-after-free in the DOM: UI Events & Focus Handling component.
  • CVE-2026-100832: Use-after-free in the Graphics: Canvas2D component.
  • CVE-2026-103500: Heap buffer overflow opening large email.

Changes for MozillaThunderbird:

  • changed: RNP command-line utilities are no longer included with Thunderbird (bmo#2068130)
  • changed: Thundermail built-in add-on updated to v2.0.16 (bmo#2071989)
  • fixed: Ctrl+Shift+K could fail to open the Quick Filter UI (bmo#2062942)
  • fixed: Nested S/MIME signed parts could fail to render (bmo#2062971)
  • fixed: Thunderbird could hang when waiting for IMAP server greeting during account setup (bmo#2028760)
  • fixed: Gmail OAuth2 authentication could intermittently fail on Windows (bmo#2063816)
  • fixed: AppUpdatePin policy did not prevent Thunderbird from updating beyond pinned version (bmo#1910603)
  • fixed: 'What's New?' linked to Release channel notes instead of ESR release notes (bmo#2073813)
  • fixed: Detached attachment links were truncated when folder path contained & (bmo#2060451)
  • fixed: Save All, Detach All, and Delete All failed after deleting one attachment (bmo#2057025)
  • fixed: Blank 1970-dated messages could appear from incomplete message file copies (bmo#209501)
  • fixed: Forwarded messages could display incorrect encoding (bmo#2059963)
  • fixed: Manual Get Messages failed after startup until toggling offline mode (bmo#2057431)
  • fixed: Thunderbird could crash on shutdown while waiting for OAuth2 password entry (bmo#1524247)
References

Affected packages

SUSE:Linux Enterprise Module for Package Hub 15 SP7
MozillaThunderbird

Package

Name
MozillaThunderbird
Purl
pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
153.4.0-150400.13.6.1

Ecosystem specific 

{
    "binaries":  [
        {
            "MozillaThunderbird":  "153.4.0-150400.13.6.1",
            "MozillaThunderbird-translations-common":  "153.4.0-150400.13.6.1",
            "MozillaThunderbird-translations-other":  "153.4.0-150400.13.6.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4627-1.json"
SUSE:Linux Enterprise Workstation Extension 15 SP7
MozillaThunderbird

Package

Name
MozillaThunderbird
Purl
pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
153.4.0-150400.13.6.1

Ecosystem specific 

{
    "binaries":  [
        {
            "MozillaThunderbird":  "153.4.0-150400.13.6.1",
            "MozillaThunderbird-translations-common":  "153.4.0-150400.13.6.1",
            "MozillaThunderbird-translations-other":  "153.4.0-150400.13.6.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4627-1.json"