RHSA-2026:85243

Vulnerability from csaf_redhat - Published: 2026-10-19 16:27 - Updated: 2026-11-02 11:38
Summary
Red Hat Security Advisory: thunderbird security update
Severity
Important
Notes
Topic: An update for thunderbird is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100832) * firefox: Use-after-free in the Layout: Text and Fonts component (CVE-2026-100784) * firefox: thunderbird: Privilege escalation in the DLL Services component (CVE-2026-100801) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component (CVE-2026-100794) * firefox: thunderbird: Privilege escalation in the Address Bar component (CVE-2026-100820) * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100777) * firefox: thunderbird: Information disclosure in the Networking: JAR component (CVE-2026-100766) * firefox: thunderbird: Use-after-free in the XSLT component (CVE-2026-100779) * firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-100807) * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-100792) * firefox: Privilege escalation due to use-after-free in the Graphics: WebRender component (CVE-2026-100797) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the XPCOM component (CVE-2026-100819) * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-100776) * firefox: thunderbird: Use-after-free in the Widget component (CVE-2026-100757) * firefox: Sandbox escape due to use-after-free in the Graphics component (CVE-2026-100786) * firefox: thunderbird: Information disclosure in the Networking component (CVE-2026-96869) * firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component (CVE-2026-100770) * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-100769) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-100791) * firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component (CVE-2026-100818) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-100782) * firefox: firefox: Sandbox escape via use-after-free in DOM component (CVE-2026-100811) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-100772) * firefox: thunderbird: Uninitialized memory in the Storage: Quota Manager component (CVE-2026-100759) * firefox: Sandbox escape due to use-after-free in the DOM: Core & HTML component (CVE-2026-100778) * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-100758) * firefox: thunderbird: Sandbox escape in the Graphics component (CVE-2026-100775) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-100781) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-100774) * firefox: thunderbird: Same-origin policy bypass in the WebExtensions component (CVE-2026-100803) * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100789) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-100785) * firefox: thunderbird: Site isolation issue in the Panning and Zooming component (CVE-2026-100821) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-100788) * firefox: thunderbird: Undefined behavior in the DOM: Streams component (CVE-2026-100771) * firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component (CVE-2026-100762) * firefox: thunderbird: Use-after-free in the XSLT component (CVE-2026-100790) * firefox: thunderbird: Use-after-free in the Storage: IndexedDB component (CVE-2026-100773) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-100780) * firefox: thunderbird: Use-after-free in the Networking: Cache component (CVE-2026-100767) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-100756) * firefox: thunderbird: Uninitialized memory in the Audio/Video component (CVE-2026-100783) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-96869

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Networking component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-201 - Insertion of Sensitive Information Into Sent Data
Affected products
Product Identifier Version Remediation
Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src —
Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64 —
Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64 —
Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64 —
Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src —
Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64 —
Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64 —
Vendor Fix fix
Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64 —
Vendor Fix fix
Threats
Impact Moderate
CVE-2026-100756

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Audio/Video: Playback component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100757

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Widget component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100758

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the DOM: Navigation component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-284 - Improper Access Control
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100759

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Uninitialized memory in the Storage: Quota Manager component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-457 - Use of Uninitialized Variable
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100762

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Content Processes component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100766

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Networking: JAR component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100767

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Networking: Cache component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100769

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: WebAssembly component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100770

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Content Processes component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100771

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Undefined behavior in the DOM: Streams component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-758 - Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100772

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100773

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Storage: IndexedDB component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100774

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100775

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the Graphics component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-693 - Protection Mechanism Failure
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100776

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: WebAssembly component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100777

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Graphics: Canvas2D component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100778

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Core & HTML component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100779

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XSLT component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100780

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100781

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100782

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to incorrect boundary conditions in the Graphics component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100783

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Uninitialized memory in the Audio/Video component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-908 - Use of Uninitialized Resource
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100784

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Layout: Text and Fonts component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100785

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100786

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Graphics component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100788

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Invalid pointer in the JavaScript: WebAssembly component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-824 - Access of Uninitialized Pointer
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100789

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Graphics: Canvas2D component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100790

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XSLT component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100791

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100792

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript: WebAssembly component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-843 - Access of Resource Using Incompatible Type
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100794

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the Internationalization component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Moderate
CVE-2026-100797

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to use-after-free in the Graphics: WebRender component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Moderate
CVE-2026-100801

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DLL Services component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-269 - Improper Privilege Management
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Moderate
CVE-2026-100803

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the WebExtensions component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-346 - Origin Validation Error
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Moderate
CVE-2026-100807

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Service Workers component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-269 - Improper Privilege Management
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Moderate
CVE-2026-100811

A flaw was found in Firefox. A use-after-free memory flaw in the Document Object Model (DOM) Core and HTML component allows a remote attacker to perform a sandbox escape. By enticing a user to visit a specially crafted web page, an attacker can leverage this vulnerability to execute arbitrary code outside the browser's restricted sandbox environment.

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
CVE-2026-100818

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Widget: Gtk component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Moderate
CVE-2026-100819

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the XPCOM component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Moderate
CVE-2026-100820

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Address Bar component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-15 - External Control of System or Configuration Setting
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Moderate
CVE-2026-100821

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Panning and Zooming component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-346 - Origin Validation Error
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Moderate
CVE-2026-100832

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Graphics: Canvas2D component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 8 products, the same list as for CVE-2026-96869
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:85243 self
https://access.redhat.com/security/updates/classi… external
https://bugzilla.redhat.com/show_bug.cgi?id=2543113 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543114 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543116 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543120 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543121 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543123 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543125 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543128 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543130 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543131 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543133 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543134 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543137 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543140 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543142 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543144 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543145 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543146 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543149 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543150 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543152 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543154 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543155 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543156 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543157 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543159 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543160 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543161 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543163 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543164 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543166 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543167 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543172 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543174 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543177 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543182 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543183 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543185 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543187 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543188 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543192 external
https://bugzilla.redhat.com/show_bug.cgi?id=2543193 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-96869 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543144 external
https://www.cve.org/CVERecord?id=CVE-2026-96869 external
https://nvd.nist.gov/vuln/detail/CVE-2026-96869 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100756 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543192 external
https://www.cve.org/CVERecord?id=CVE-2026-100756 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100756 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100757 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543140 external
https://www.cve.org/CVERecord?id=CVE-2026-100757 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100757 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100758 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543159 external
https://www.cve.org/CVERecord?id=CVE-2026-100758 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100758 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100759 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543156 external
https://www.cve.org/CVERecord?id=CVE-2026-100759 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100759 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100762 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543182 external
https://www.cve.org/CVERecord?id=CVE-2026-100762 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100762 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100766 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543125 external
https://www.cve.org/CVERecord?id=CVE-2026-100766 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100766 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100767 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543188 external
https://www.cve.org/CVERecord?id=CVE-2026-100767 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100767 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100769 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543146 external
https://www.cve.org/CVERecord?id=CVE-2026-100769 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100769 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100770 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543145 external
https://www.cve.org/CVERecord?id=CVE-2026-100770 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100770 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100771 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543177 external
https://www.cve.org/CVERecord?id=CVE-2026-100771 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100771 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100772 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543155 external
https://www.cve.org/CVERecord?id=CVE-2026-100772 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100772 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100773 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543185 external
https://www.cve.org/CVERecord?id=CVE-2026-100773 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100773 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100774 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543163 external
https://www.cve.org/CVERecord?id=CVE-2026-100774 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100774 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100775 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543160 external
https://www.cve.org/CVERecord?id=CVE-2026-100775 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100775 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100776 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543137 external
https://www.cve.org/CVERecord?id=CVE-2026-100776 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100776 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100777 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543123 external
https://www.cve.org/CVERecord?id=CVE-2026-100777 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100777 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100778 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543157 external
https://www.cve.org/CVERecord?id=CVE-2026-100778 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100778 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100779 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543128 external
https://www.cve.org/CVERecord?id=CVE-2026-100779 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100779 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100780 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543187 external
https://www.cve.org/CVERecord?id=CVE-2026-100780 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100780 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100781 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543161 external
https://www.cve.org/CVERecord?id=CVE-2026-100781 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100781 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100782 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543152 external
https://www.cve.org/CVERecord?id=CVE-2026-100782 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100782 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100783 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543193 external
https://www.cve.org/CVERecord?id=CVE-2026-100783 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100783 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100784 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543114 external
https://www.cve.org/CVERecord?id=CVE-2026-100784 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100784 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100785 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543167 external
https://www.cve.org/CVERecord?id=CVE-2026-100785 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100785 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100786 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543142 external
https://www.cve.org/CVERecord?id=CVE-2026-100786 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100786 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100788 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543174 external
https://www.cve.org/CVERecord?id=CVE-2026-100788 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100788 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100789 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543166 external
https://www.cve.org/CVERecord?id=CVE-2026-100789 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100789 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100790 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543183 external
https://www.cve.org/CVERecord?id=CVE-2026-100790 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100790 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100791 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543149 external
https://www.cve.org/CVERecord?id=CVE-2026-100791 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100791 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100792 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543131 external
https://www.cve.org/CVERecord?id=CVE-2026-100792 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100792 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100794 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543120 external
https://www.cve.org/CVERecord?id=CVE-2026-100794 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100794 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100797 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543133 external
https://www.cve.org/CVERecord?id=CVE-2026-100797 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100797 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100801 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543116 external
https://www.cve.org/CVERecord?id=CVE-2026-100801 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100801 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100803 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543164 external
https://www.cve.org/CVERecord?id=CVE-2026-100803 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100803 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100807 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543130 external
https://www.cve.org/CVERecord?id=CVE-2026-100807 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100807 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100811 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543154 external
https://www.cve.org/CVERecord?id=CVE-2026-100811 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100811 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100818 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543150 external
https://www.cve.org/CVERecord?id=CVE-2026-100818 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100818 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100819 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543134 external
https://www.cve.org/CVERecord?id=CVE-2026-100819 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100819 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100820 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543121 external
https://www.cve.org/CVERecord?id=CVE-2026-100820 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100820 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100821 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543172 external
https://www.cve.org/CVERecord?id=CVE-2026-100821 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100821 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-100832 self
https://bugzilla.redhat.com/show_bug.cgi?id=2543113 external
https://www.cve.org/CVERecord?id=CVE-2026-100832 external
https://nvd.nist.gov/vuln/detail/CVE-2026-100832 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for thunderbird is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nSecurity Fix(es):\n\n* firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100832)\n\n* firefox: Use-after-free in the Layout: Text and Fonts component (CVE-2026-100784)\n\n* firefox: thunderbird: Privilege escalation in the DLL Services component (CVE-2026-100801)\n\n* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component (CVE-2026-100794)\n\n* firefox: thunderbird: Privilege escalation in the Address Bar component (CVE-2026-100820)\n\n* firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100777)\n\n* firefox: thunderbird: Information disclosure in the Networking: JAR component (CVE-2026-100766)\n\n* firefox: thunderbird: Use-after-free in the XSLT component (CVE-2026-100779)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-100807)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-100792)\n\n* firefox: Privilege escalation due to use-after-free in the Graphics: WebRender component (CVE-2026-100797)\n\n* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the XPCOM component (CVE-2026-100819)\n\n* firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-100776)\n\n* firefox: thunderbird: Use-after-free in the Widget component (CVE-2026-100757)\n\n* firefox: Sandbox escape due to use-after-free in the Graphics component (CVE-2026-100786)\n\n* firefox: thunderbird: Information disclosure in the Networking component (CVE-2026-96869)\n\n* firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component (CVE-2026-100770)\n\n* firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-100769)\n\n* firefox: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-100791)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component (CVE-2026-100818)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-100782)\n\n* firefox: firefox: Sandbox escape via use-after-free in DOM component (CVE-2026-100811)\n\n* firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-100772)\n\n* firefox: thunderbird: Uninitialized memory in the Storage: Quota Manager component (CVE-2026-100759)\n\n* firefox: Sandbox escape due to use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-100778)\n\n* firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-100758)\n\n* firefox: thunderbird: Sandbox escape in the Graphics component (CVE-2026-100775)\n\n* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-100781)\n\n* firefox: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-100774)\n\n* firefox: thunderbird: Same-origin policy bypass in the WebExtensions component (CVE-2026-100803)\n\n* firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100789)\n\n* firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-100785)\n\n* firefox: thunderbird: Site isolation issue in the Panning and Zooming component (CVE-2026-100821)\n\n* firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-100788)\n\n* firefox: thunderbird: Undefined behavior in the DOM: Streams component (CVE-2026-100771)\n\n* firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component (CVE-2026-100762)\n\n* firefox: thunderbird: Use-after-free in the XSLT component (CVE-2026-100790)\n\n* firefox: thunderbird: Use-after-free in the Storage: IndexedDB component (CVE-2026-100773)\n\n* firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-100780)\n\n* firefox: thunderbird: Use-after-free in the Networking: Cache component (CVE-2026-100767)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-100756)\n\n* firefox: thunderbird: Uninitialized memory in the Audio/Video component (CVE-2026-100783)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:85243",
        "url": "https://access.redhat.com/errata/RHSA-2026:85243"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2543113",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543113"
      },
      {
        "category": "external",
        "summary": "2543114",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543114"
      },
      {
        "category": "external",
        "summary": "2543116",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543116"
      },
      {
        "category": "external",
        "summary": "2543120",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543120"
      },
      {
        "category": "external",
        "summary": "2543121",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543121"
      },
      {
        "category": "external",
        "summary": "2543123",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543123"
      },
      {
        "category": "external",
        "summary": "2543125",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543125"
      },
      {
        "category": "external",
        "summary": "2543128",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543128"
      },
      {
        "category": "external",
        "summary": "2543130",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543130"
      },
      {
        "category": "external",
        "summary": "2543131",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543131"
      },
      {
        "category": "external",
        "summary": "2543133",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543133"
      },
      {
        "category": "external",
        "summary": "2543134",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543134"
      },
      {
        "category": "external",
        "summary": "2543137",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543137"
      },
      {
        "category": "external",
        "summary": "2543140",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543140"
      },
      {
        "category": "external",
        "summary": "2543142",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543142"
      },
      {
        "category": "external",
        "summary": "2543144",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543144"
      },
      {
        "category": "external",
        "summary": "2543145",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543145"
      },
      {
        "category": "external",
        "summary": "2543146",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543146"
      },
      {
        "category": "external",
        "summary": "2543149",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543149"
      },
      {
        "category": "external",
        "summary": "2543150",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543150"
      },
      {
        "category": "external",
        "summary": "2543152",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543152"
      },
      {
        "category": "external",
        "summary": "2543154",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543154"
      },
      {
        "category": "external",
        "summary": "2543155",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543155"
      },
      {
        "category": "external",
        "summary": "2543156",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543156"
      },
      {
        "category": "external",
        "summary": "2543157",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543157"
      },
      {
        "category": "external",
        "summary": "2543159",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543159"
      },
      {
        "category": "external",
        "summary": "2543160",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543160"
      },
      {
        "category": "external",
        "summary": "2543161",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543161"
      },
      {
        "category": "external",
        "summary": "2543163",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543163"
      },
      {
        "category": "external",
        "summary": "2543164",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543164"
      },
      {
        "category": "external",
        "summary": "2543166",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543166"
      },
      {
        "category": "external",
        "summary": "2543167",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543167"
      },
      {
        "category": "external",
        "summary": "2543172",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543172"
      },
      {
        "category": "external",
        "summary": "2543174",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543174"
      },
      {
        "category": "external",
        "summary": "2543177",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543177"
      },
      {
        "category": "external",
        "summary": "2543182",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543182"
      },
      {
        "category": "external",
        "summary": "2543183",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543183"
      },
      {
        "category": "external",
        "summary": "2543185",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543185"
      },
      {
        "category": "external",
        "summary": "2543187",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543187"
      },
      {
        "category": "external",
        "summary": "2543188",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543188"
      },
      {
        "category": "external",
        "summary": "2543192",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543192"
      },
      {
        "category": "external",
        "summary": "2543193",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543193"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85243.json"
      }
    ],
    "title": "Red Hat Security Advisory: thunderbird security update",
    "tracking": {
      "current_release_date": "2026-11-02T11:38:39+00:00",
      "generator": {
        "date": "2026-11-02T11:38:39+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHSA-2026:85243",
      "initial_release_date": "2026-10-19T16:27:47+00:00",
      "revision_history": [
        {
          "date": "2026-10-19T16:27:47+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-19T16:27:47+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-02T11:38:39+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream AUS (v.8.4)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream AUS (v.8.4)",
                  "product_id": "AppStream-8.4.0.Z.AUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_aus:8.4::appstream"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
                  "product_id": "AppStream-8.4.0.Z.EUS.EXTENSION",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "thunderbird-0:140.17.0-1.el8_4.src",
                "product": {
                  "name": "thunderbird-0:140.17.0-1.el8_4.src",
                  "product_id": "thunderbird-0:140.17.0-1.el8_4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird@140.17.0-1.el8_4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "thunderbird-0:140.17.0-1.el8_4.x86_64",
                "product": {
                  "name": "thunderbird-0:140.17.0-1.el8_4.x86_64",
                  "product_id": "thunderbird-0:140.17.0-1.el8_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird@140.17.0-1.el8_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
                "product": {
                  "name": "thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
                  "product_id": "thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debugsource@140.17.0-1.el8_4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
                "product": {
                  "name": "thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
                  "product_id": "thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.17.0-1.el8_4?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-0:140.17.0-1.el8_4.src as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
          "product_id": "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src"
        },
        "product_reference": "thunderbird-0:140.17.0-1.el8_4.src",
        "relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-0:140.17.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
          "product_id": "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64"
        },
        "product_reference": "thunderbird-0:140.17.0-1.el8_4.x86_64",
        "relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
          "product_id": "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64"
        },
        "product_reference": "thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
        "relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
          "product_id": "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        },
        "product_reference": "thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
        "relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-0:140.17.0-1.el8_4.src as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
          "product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src"
        },
        "product_reference": "thunderbird-0:140.17.0-1.el8_4.src",
        "relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-0:140.17.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
          "product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64"
        },
        "product_reference": "thunderbird-0:140.17.0-1.el8_4.x86_64",
        "relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
          "product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64"
        },
        "product_reference": "thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
        "relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
          "product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        },
        "product_reference": "thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
        "relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-96869",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "discovery_date": "2026-09-29T12:59:20.710323+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543144"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInformation disclosure in the Networking component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Information disclosure in the Networking component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-96869"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543144",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543144"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-96869",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-96869"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96869",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96869"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-96869",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-96869"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-96869",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-96869"
        }
      ],
      "release_date": "2026-09-29T12:36:15.110000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Information disclosure in the Networking component"
    },
    {
      "cve": "CVE-2026-100756",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "discovery_date": "2026-09-29T13:11:01.667411+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543192"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions in the Audio/Video: Playback component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100756"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543192",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543192"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100756",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100756"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100756",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100756"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100756",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100756"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100756",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100756"
        }
      ],
      "release_date": "2026-09-29T12:35:52.765000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component"
    },
    {
      "cve": "CVE-2026-100757",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-09-29T12:58:07.659873+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543140"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the Widget component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the Widget component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100757"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543140",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543140"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100757",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100757"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100757",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100757"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100757",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100757"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100757",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100757"
        }
      ],
      "release_date": "2026-09-29T12:35:53.396000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the Widget component"
    },
    {
      "cve": "CVE-2026-100758",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2026-09-29T13:04:02.653435+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543159"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape in the DOM: Navigation component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Sandbox escape in the DOM: Navigation component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100758"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543159",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543159"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100758",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100758"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100758",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100758"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100758",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100758"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100758",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100758"
        }
      ],
      "release_date": "2026-09-29T12:35:53.998000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Sandbox escape in the DOM: Navigation component"
    },
    {
      "cve": "CVE-2026-100759",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2026-09-29T13:02:55.149805+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543156"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUninitialized memory in the Storage: Quota Manager component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Uninitialized memory in the Storage: Quota Manager component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100759"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543156",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543156"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100759",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100759"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100759",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100759"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100759",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100759"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100759",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100759"
        }
      ],
      "release_date": "2026-09-29T12:35:54.685000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Uninitialized memory in the Storage: Quota Manager component"
    },
    {
      "cve": "CVE-2026-100762",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-29T13:09:40.990532+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543182"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape due to use-after-free in the DOM: Content Processes component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100762"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543182",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543182"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100762",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100762"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100762",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100762"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100762",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100762"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100762",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100762"
        }
      ],
      "release_date": "2026-09-29T12:35:56.448000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component"
    },
    {
      "cve": "CVE-2026-100766",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2026-09-29T12:53:12.120731+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543125"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInformation disclosure in the Networking: JAR component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Information disclosure in the Networking: JAR component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100766"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543125",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543125"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100766",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100766"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100766",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100766"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100766",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100766"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100766",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100766"
        }
      ],
      "release_date": "2026-09-29T12:35:58.608000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Information disclosure in the Networking: JAR component"
    },
    {
      "cve": "CVE-2026-100767",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-09-29T13:10:49.589988+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543188"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the Networking: Cache component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the Networking: Cache component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100767"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543188",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543188"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100767",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100767"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100767",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100767"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100767",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100767"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100767",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100767"
        }
      ],
      "release_date": "2026-09-29T12:35:59.246000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the Networking: Cache component"
    },
    {
      "cve": "CVE-2026-100769",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-09-29T12:59:37.357695+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543146"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the JavaScript: WebAssembly component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100769"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543146",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543146"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100769",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100769"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100769",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100769"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100769",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100769"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100769",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100769"
        }
      ],
      "release_date": "2026-09-29T12:36:00.465000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component"
    },
    {
      "cve": "CVE-2026-100770",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-29T12:59:53.900192+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543145"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape due to use-after-free in the DOM: Content Processes component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100770"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543145",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543145"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100770",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100770"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100770",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100770"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100770",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100770"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100770",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100770"
        }
      ],
      "release_date": "2026-09-29T12:36:01.104000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component"
    },
    {
      "cve": "CVE-2026-100771",
      "cwe": {
        "id": "CWE-758",
        "name": "Reliance on Undefined, Unspecified, or Implementation-Defined Behavior"
      },
      "discovery_date": "2026-09-29T13:08:56.753219+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543177"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUndefined behavior in the DOM: Streams component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Undefined behavior in the DOM: Streams component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100771"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543177",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543177"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100771",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100771"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100771",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100771"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100771",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100771"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100771",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100771"
        }
      ],
      "release_date": "2026-09-29T12:36:01.644000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Undefined behavior in the DOM: Streams component"
    },
    {
      "cve": "CVE-2026-100772",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-09-29T13:02:37.995188+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543155"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100772"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543155",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543155"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100772",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100772"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100772",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100772"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100772",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100772"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100772",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100772"
        }
      ],
      "release_date": "2026-09-29T12:36:02.178000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component"
    },
    {
      "cve": "CVE-2026-100773",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-09-29T13:11:15.321781+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543185"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the Storage: IndexedDB component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the Storage: IndexedDB component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100773"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543185",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543185"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100773",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100773"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100773",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100773"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100773",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100773"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100773",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100773"
        }
      ],
      "release_date": "2026-09-29T12:36:02.749000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the Storage: IndexedDB component"
    },
    {
      "cve": "CVE-2026-100774",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-29T13:03:30.207360+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543163"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Use-after-free in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100774"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543163",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543163"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100774",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100774"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100774",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100774"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100774",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100774"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100774",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100774"
        }
      ],
      "release_date": "2026-09-29T12:36:03.300000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: Use-after-free in the DOM: Core \u0026 HTML component"
    },
    {
      "cve": "CVE-2026-100775",
      "cwe": {
        "id": "CWE-693",
        "name": "Protection Mechanism Failure"
      },
      "discovery_date": "2026-09-29T13:03:44.990265+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543160"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape in the Graphics component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Sandbox escape in the Graphics component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100775"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543160",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543160"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100775",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100775"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100775",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100775"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100775",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100775"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100775",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100775"
        }
      ],
      "release_date": "2026-09-29T12:36:03.907000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Mozilla addressed this flaw in Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42 (and the corresponding Thunderbird releases); updating to a version that includes the upstream fix is the available remediation.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Sandbox escape in the Graphics component"
    },
    {
      "cve": "CVE-2026-100776",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-09-29T12:57:13.985073+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543137"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the JavaScript: WebAssembly component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100776"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543137",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543137"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100776",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100776"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100776",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100776"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100776",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100776"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100776",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100776"
        }
      ],
      "release_date": "2026-09-29T12:36:04.501000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component"
    },
    {
      "cve": "CVE-2026-100777",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-09-29T12:52:55.818981+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543123"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the Graphics: Canvas2D component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100777"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543123",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543123"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100777",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100777"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100777",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100777"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100777",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100777"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100777",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100777"
        }
      ],
      "release_date": "2026-09-29T12:36:05.019000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component"
    },
    {
      "cve": "CVE-2026-100778",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-29T13:02:20.120099+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543157"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape due to use-after-free in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Sandbox escape due to use-after-free in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100778"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543157",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543157"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100778",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100778"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100778",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100778"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100778",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100778"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100778",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100778"
        }
      ],
      "release_date": "2026-09-29T12:36:05.606000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: Sandbox escape due to use-after-free in the DOM: Core \u0026 HTML component"
    },
    {
      "cve": "CVE-2026-100779",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-09-29T12:54:51.039823+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543128"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the XSLT component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the XSLT component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100779"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543128",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543128"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100779",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100779"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100779",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100779"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100779",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100779"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100779",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100779"
        }
      ],
      "release_date": "2026-09-29T12:36:06.174000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the XSLT component"
    },
    {
      "cve": "CVE-2026-100780",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-09-29T13:10:24.139825+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543187"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100780"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543187",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543187"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100780",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100780"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100780",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100780"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100780",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100780"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100780",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100780"
        }
      ],
      "release_date": "2026-09-29T12:36:06.733000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component"
    },
    {
      "cve": "CVE-2026-100781",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "discovery_date": "2026-09-29T13:03:13.660003+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543161"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape due to incorrect boundary conditions in the Graphics: WebRender component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100781"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543161",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543161"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100781",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100781"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100781",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100781"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100781",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100781"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100781",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100781"
        }
      ],
      "release_date": "2026-09-29T12:36:07.342000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component"
    },
    {
      "cve": "CVE-2026-100782",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "discovery_date": "2026-09-29T13:01:26.200445+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543152"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation due to incorrect boundary conditions in the Graphics component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100782"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543152",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543152"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100782",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100782"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100782",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100782"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100782",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100782"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100782",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100782"
        }
      ],
      "release_date": "2026-09-29T12:36:07.879000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component"
    },
    {
      "cve": "CVE-2026-100783",
      "cwe": {
        "id": "CWE-908",
        "name": "Use of Uninitialized Resource"
      },
      "discovery_date": "2026-09-29T13:12:09.842869+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543193"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUninitialized memory in the Audio/Video component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Uninitialized memory in the Audio/Video component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100783"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543193",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543193"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100783",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100783"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100783",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100783"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100783",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100783"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100783",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100783"
        }
      ],
      "release_date": "2026-09-29T12:36:08.448000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Uninitialized memory in the Audio/Video component"
    },
    {
      "cve": "CVE-2026-100784",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-29T12:50:56.970328+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543114"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the Layout: Text and Fonts component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Use-after-free in the Layout: Text and Fonts component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100784"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543114",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543114"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100784",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100784"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100784",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100784"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100784",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100784"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100784",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100784"
        }
      ],
      "release_date": "2026-09-29T12:36:09.021000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: Use-after-free in the Layout: Text and Fonts component"
    },
    {
      "cve": "CVE-2026-100785",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-09-29T13:06:39.324979+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543167"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100785"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543167",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543167"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100785",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100785"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100785",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100785"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100785",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100785"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100785",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100785"
        }
      ],
      "release_date": "2026-09-29T12:36:09.566000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Upstream Mozilla has fixed this issue in Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42; for Red Hat products, update the firefox and thunderbird packages to a version containing the fix once it is released through the standard Red Hat update channels.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component"
    },
    {
      "cve": "CVE-2026-100786",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-29T12:58:26.429893+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543142"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape due to use-after-free in the Graphics component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Sandbox escape due to use-after-free in the Graphics component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100786"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543142",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543142"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100786",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100786"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100786",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100786"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100786",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100786"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100786",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100786"
        }
      ],
      "release_date": "2026-09-29T12:36:10.161000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: Sandbox escape due to use-after-free in the Graphics component"
    },
    {
      "cve": "CVE-2026-100788",
      "cwe": {
        "id": "CWE-824",
        "name": "Access of Uninitialized Pointer"
      },
      "discovery_date": "2026-09-29T13:07:49.474603+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543174"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInvalid pointer in the JavaScript: WebAssembly component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100788"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543174",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543174"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100788",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100788"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100788",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100788"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100788",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100788"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100788",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100788"
        }
      ],
      "release_date": "2026-09-29T12:36:11.268000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component"
    },
    {
      "cve": "CVE-2026-100789",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-29T13:05:10.387018+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543166"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the Graphics: Canvas2D component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100789"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543166",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543166"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100789",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100789"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100789",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100789"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100789",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100789"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100789",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100789"
        }
      ],
      "release_date": "2026-09-29T12:36:11.802000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component"
    },
    {
      "cve": "CVE-2026-100790",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-09-29T13:09:56.802866+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543183"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the XSLT component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the XSLT component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100790"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543183",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543183"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100790",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100790"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100790",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100790"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100790",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100790"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100790",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100790"
        }
      ],
      "release_date": "2026-09-29T12:36:12.376000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the XSLT component"
    },
    {
      "cve": "CVE-2026-100791",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-29T13:00:12.479977+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543149"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Use-after-free in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100791"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543149",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543149"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100791",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100791"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100791",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100791"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100791",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100791"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100791",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100791"
        }
      ],
      "release_date": "2026-09-29T12:36:12.904000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: Use-after-free in the DOM: Core \u0026 HTML component"
    },
    {
      "cve": "CVE-2026-100792",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type"
      },
      "discovery_date": "2026-09-29T12:55:08.264969+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543131"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nJIT miscompilation in the JavaScript: WebAssembly component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100792"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543131",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543131"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100792",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100792"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100792",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100792"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100792",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100792"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100792",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100792"
        }
      ],
      "release_date": "2026-09-29T12:36:13.478000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component"
    },
    {
      "cve": "CVE-2026-100794",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "discovery_date": "2026-09-29T12:53:36.640863+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543120"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape due to incorrect boundary conditions in the Internationalization component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100794"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543120",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543120"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100794",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100794"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100794",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100794"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100794",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100794"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100794",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100794"
        }
      ],
      "release_date": "2026-09-29T12:36:14.549000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component"
    },
    {
      "cve": "CVE-2026-100797",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-29T12:56:02.668176+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543133"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation due to use-after-free in the Graphics: WebRender component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Privilege escalation due to use-after-free in the Graphics: WebRender component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100797"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543133",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543133"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100797",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100797"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100797",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100797"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100797",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100797"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100797",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100797"
        }
      ],
      "release_date": "2026-09-29T12:36:16.796000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: Privilege escalation due to use-after-free in the Graphics: WebRender component"
    },
    {
      "cve": "CVE-2026-100801",
      "cwe": {
        "id": "CWE-269",
        "name": "Improper Privilege Management"
      },
      "discovery_date": "2026-09-29T12:51:14.332419+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543116"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the DLL Services component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation in the DLL Services component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100801"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543116",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543116"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100801",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100801"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100801",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100801"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100801",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100801"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-120/#CVE-2026-100801",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-120/#CVE-2026-100801"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-122/#CVE-2026-100801",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-122/#CVE-2026-100801"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100801",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100801"
        }
      ],
      "release_date": "2026-09-29T12:36:19.049000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation in the DLL Services component"
    },
    {
      "cve": "CVE-2026-100803",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-09-29T13:04:52.999767+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543164"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSame-origin policy bypass in the WebExtensions component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Same-origin policy bypass in the WebExtensions component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100803"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543164",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543164"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100803",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100803"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100803",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100803"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100803",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100803"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100803",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100803"
        }
      ],
      "release_date": "2026-09-29T12:36:20.195000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Same-origin policy bypass in the WebExtensions component"
    },
    {
      "cve": "CVE-2026-100807",
      "cwe": {
        "id": "CWE-269",
        "name": "Improper Privilege Management"
      },
      "discovery_date": "2026-09-29T12:55:26.530096+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543130"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the DOM: Service Workers component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation in the DOM: Service Workers component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100807"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543130",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543130"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100807",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100807"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100807",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100807"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100807",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100807"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100807",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100807"
        }
      ],
      "release_date": "2026-09-29T12:36:22.435000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation in the DOM: Service Workers component"
    },
    {
      "cve": "CVE-2026-100811",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-29T13:01:44.355214+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543154"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. A use-after-free memory flaw in the Document Object Model (DOM) Core and HTML component allows a remote attacker to perform a sandbox escape. By enticing a user to visit a specially crafted web page, an attacker can leverage this vulnerability to execute arbitrary code outside the browser\u0027s restricted sandbox environment.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: firefox: Sandbox escape via use-after-free in DOM component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An IMPORTANT severity use-after-free flaw was found in the Firefox web browser\u0027s Document Object Model (DOM) Core and HTML component. A remote attacker could entice a victim to visit a specially crafted web page to trigger the use-after-free condition and execute arbitrary code outside of the browser\u0027s restricted sandbox environment, resulting in a sandbox escape and potential compromise of the victim\u0027s user session. The firefox component as shipped in affected Red Hat product streams is affected by this flaw; no affected Red Hat product stream is currently distinguished as not affected. Red Hat Product Security has rated this flaw with a CVSS 3.1 score of 6.1 (moderate) (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), which is substantially lower than the 9.6 (critical) score assigned by CISA; the difference is mainly attributable to Red Hat\u0027s lower confidentiality and integrity impact assessment (C:L/I:L/A:N versus C:H/I:H/A:H).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100811"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543154",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543154"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100811",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100811"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100811",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100811"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100811",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100811"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100811",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100811"
        }
      ],
      "release_date": "2026-09-29T12:36:24.693000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: firefox: Sandbox escape via use-after-free in DOM component"
    },
    {
      "cve": "CVE-2026-100818",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-29T13:00:30.960057+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543150"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape due to use-after-free in the Widget: Gtk component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100818"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543150",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543150"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100818",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100818"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100818",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100818"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100818",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100818"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100818",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100818"
        }
      ],
      "release_date": "2026-09-29T12:36:28.602000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component"
    },
    {
      "cve": "CVE-2026-100819",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "discovery_date": "2026-09-29T12:56:55.939959+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543134"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape due to incorrect boundary conditions in the XPCOM component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the XPCOM component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100819"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543134",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543134"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100819",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100819"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100819",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100819"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100819",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100819"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100819",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100819"
        }
      ],
      "release_date": "2026-09-29T12:36:29.199000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the XPCOM component"
    },
    {
      "cve": "CVE-2026-100820",
      "cwe": {
        "id": "CWE-15",
        "name": "External Control of System or Configuration Setting"
      },
      "discovery_date": "2026-09-29T12:53:54.025151+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543121"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the Address Bar component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation in the Address Bar component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100820"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543121",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543121"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100820",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100820"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100820",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100820"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100820",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100820"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100820",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100820"
        }
      ],
      "release_date": "2026-09-29T12:36:29.773000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation in the Address Bar component"
    },
    {
      "cve": "CVE-2026-100821",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-09-29T13:07:31.072774+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543172"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSite isolation issue in the Panning and Zooming component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Site isolation issue in the Panning and Zooming component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100821"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543172",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543172"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100821",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100821"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100821",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100821"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100821",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100821"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100821",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100821"
        }
      ],
      "release_date": "2026-09-29T12:36:30.318000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Site isolation issue in the Panning and Zooming component"
    },
    {
      "cve": "CVE-2026-100832",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-09-29T12:51:31.326581+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543113"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the Graphics: Canvas2D component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
          "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-100832"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543113",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543113"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-100832",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-100832"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100832",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100832"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100832",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100832"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100832",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100832"
        }
      ],
      "release_date": "2026-09-29T12:36:35.869000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T16:27:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85243"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.AUS:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.src",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.17.0-1.el8_4.x86_64",
            "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.17.0-1.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.