openSUSE-SU-2026:20046-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20046-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2026:20046-1
Upstream
CVE (10)
Related
CVE (10)
Published
2026-01-16T12:09:04Z
Modified
2026-03-23T04:54:42Z
Summary
Security update for MozillaThunderbird
Details

This update for MozillaThunderbird fixes the following issues:

Changes in MozillaThunderbird:

  • Mozilla Thunderbird 140.6.0 ESR MFSA 2025-96 (bsc#1254551)
    • CVE-2025-14321 (bmo#1992760) Use-after-free in the WebRTC: Signaling component
    • CVE-2025-14322 (bmo#1996473) Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
    • CVE-2025-14323 (bmo#1996555) Privilege escalation in the DOM: Notifications component
    • CVE-2025-14324 (bmo#1996840) JIT miscompilation in the JavaScript Engine: JIT component
    • CVE-2025-14325 (bmo#1998050) JIT miscompilation in the JavaScript Engine: JIT component
    • CVE-2025-14328 (bmo#1996761) Privilege escalation in the Netmonitor component
    • CVE-2025-14329 (bmo#1997018) Privilege escalation in the Netmonitor component
    • CVE-2025-14330 (bmo#1997503) JIT miscompilation in the JavaScript Engine: JIT component
    • CVE-2025-14331 (bmo#2000218) Same-origin policy bypass in the Request Handling component
    • CVE-2025-14333 (bmo#1966501, bmo#1997639) Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146
References

Affected packages

openSUSE:Leap 16.0 / MozillaThunderbird

Package

Name
MozillaThunderbird
Purl
pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
140.6.0-bp160.1.1

Ecosystem specific 

{
    "binaries":  [
        {
            "MozillaThunderbird":  "140.6.0-bp160.1.1",
            "MozillaThunderbird-openpgp-librnp":  "140.6.0-bp160.1.1",
            "MozillaThunderbird-translations-common":  "140.6.0-bp160.1.1",
            "MozillaThunderbird-translations-other":  "140.6.0-bp160.1.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20046-1.json"