Vulnerability-Lookup

SUSE-SU-2026:0153-1

Vulnerability from csaf_suse - Published: 2026-01-19 11:14 - Updated: 2026-01-19 11:14

Summary

Security update for MozillaThunderbird

Notes

Title of the patch

Security update for MozillaThunderbird

Description of the patch

This update for MozillaThunderbird fixes the following issues: MFSA 2026-05 (bsc#1256340): - CVE-2026-0877: Mitigation bypass in the DOM in Security component - CVE-2026-0878: Sandbox escape due to incorrect boundary conditions in the Graphics in CanvasWebGL component - CVE-2026-0879: Sandbox escape due to incorrect boundary conditions in the Graphics component - CVE-2026-0880: Sandbox escape due to integer overflow in the Graphics component - CVE-2026-0882: Use-after-free in the IPC component - CVE-2025-14327: Spoofing issue in the Downloads Panel component - CVE-2026-0883: Information disclosure in the Networking component - CVE-2026-0884: Use-after-free in the JavaScript Engine component - CVE-2026-0885: Use-after-free in the JavaScript: GC component - CVE-2026-0886: Incorrect boundary conditions in the Graphics component - CVE-2026-0887: Clickjacking issue, information disclosure in the PDF Viewer component - CVE-2026-0890: Spoofing issue in the DOM in Copy & Paste and Drag & Drop component - CVE-2026-0891: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147

Patchnames

SUSE-2026-153,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-153,SUSE-SLE-Product-WE-15-SP7-2026-153,openSUSE-SLE-15.6-2026-153

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for MozillaThunderbird",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for MozillaThunderbird fixes the following issues:\n\nMFSA 2026-05 (bsc#1256340):\n\n  - CVE-2026-0877: Mitigation bypass in the DOM in Security component\n  - CVE-2026-0878: Sandbox escape due to incorrect boundary conditions in the\n    Graphics in CanvasWebGL component\n  - CVE-2026-0879: Sandbox escape due to incorrect boundary conditions in the\n    Graphics component\n  - CVE-2026-0880: Sandbox escape due to integer overflow in the Graphics\n    component\n  - CVE-2026-0882: Use-after-free in the IPC component\n  - CVE-2025-14327: Spoofing issue in the Downloads Panel component\n  - CVE-2026-0883: Information disclosure in the Networking component\n  - CVE-2026-0884: Use-after-free in the JavaScript Engine component\n  - CVE-2026-0885: Use-after-free in the JavaScript: GC component\n  - CVE-2026-0886: Incorrect boundary conditions in the Graphics component\n  - CVE-2026-0887: Clickjacking issue, information disclosure in the PDF Viewer\n    component\n  - CVE-2026-0890: Spoofing issue in the DOM in Copy \u0026 Paste and Drag \u0026 Drop \n    component\n  - CVE-2026-0891: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird \n    ESR 140.7, Firefox 147 and Thunderbird 147\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-153,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-153,SUSE-SLE-Product-WE-15-SP7-2026-153,openSUSE-SLE-15.6-2026-153",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_0153-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:0153-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260153-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:0153-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023791.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256340",
        "url": "https://bugzilla.suse.com/1256340"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14327 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14327/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-0877 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-0877/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-0878 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-0878/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-0879 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-0879/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-0880 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-0880/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-0882 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-0882/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-0883 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-0883/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-0884 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-0884/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-0885 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-0885/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-0886 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-0886/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-0887 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-0887/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-0890 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-0890/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-0891 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-0891/"
      }
    ],
    "title": "Security update for MozillaThunderbird",
    "tracking": {
      "current_release_date": "2026-01-19T11:14:01Z",
      "generator": {
        "date": "2026-01-19T11:14:01Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:0153-1",
      "initial_release_date": "2026-01-19T11:14:01Z",
      "revision_history": [
        {
          "date": "2026-01-19T11:14:01Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
                "product": {
                  "name": "MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
                  "product_id": "MozillaThunderbird-140.7.0-150200.8.251.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
                "product": {
                  "name": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
                  "product_id": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
                "product": {
                  "name": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
                  "product_id": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
                "product": {
                  "name": "MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
                  "product_id": "MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
                "product": {
                  "name": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
                  "product_id": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
                "product": {
                  "name": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
                  "product_id": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
                "product": {
                  "name": "MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
                  "product_id": "MozillaThunderbird-140.7.0-150200.8.251.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
                "product": {
                  "name": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
                  "product_id": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
                "product": {
                  "name": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
                  "product_id": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
                "product": {
                  "name": "MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
                  "product_id": "MozillaThunderbird-140.7.0-150200.8.251.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
                "product": {
                  "name": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
                  "product_id": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
                "product": {
                  "name": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
                  "product_id": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
                  "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:packagehub:15:sp7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Workstation Extension 15 SP7",
                "product": {
                  "name": "SUSE Linux Enterprise Workstation Extension 15 SP7",
                  "product_id": "SUSE Linux Enterprise Workstation Extension 15 SP7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-we:15:sp7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.6",
                "product": {
                  "name": "openSUSE Leap 15.6",
                  "product_id": "openSUSE Leap 15.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-140.7.0-150200.8.251.1.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64"
        },
        "product_reference": "MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le"
        },
        "product_reference": "MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-140.7.0-150200.8.251.1.s390x as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x"
        },
        "product_reference": "MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64"
        },
        "product_reference": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le"
        },
        "product_reference": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x"
        },
        "product_reference": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64"
        },
        "product_reference": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le"
        },
        "product_reference": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x"
        },
        "product_reference": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-140.7.0-150200.8.251.1.x86_64 as component of SUSE Linux Enterprise Workstation Extension 15 SP7",
          "product_id": "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64"
        },
        "product_reference": "MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Workstation Extension 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64 as component of SUSE Linux Enterprise Workstation Extension 15 SP7",
          "product_id": "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64"
        },
        "product_reference": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Workstation Extension 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64 as component of SUSE Linux Enterprise Workstation Extension 15 SP7",
          "product_id": "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
        },
        "product_reference": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Workstation Extension 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-140.7.0-150200.8.251.1.aarch64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64"
        },
        "product_reference": "MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le"
        },
        "product_reference": "MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-140.7.0-150200.8.251.1.s390x as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x"
        },
        "product_reference": "MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-140.7.0-150200.8.251.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64"
        },
        "product_reference": "MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64"
        },
        "product_reference": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le"
        },
        "product_reference": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x"
        },
        "product_reference": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64"
        },
        "product_reference": "MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64"
        },
        "product_reference": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le"
        },
        "product_reference": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x"
        },
        "product_reference": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
        },
        "product_reference": "MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14327",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14327"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Spoofing issue in the Downloads Panel component. This vulnerability affects Firefox \u003c 146, Thunderbird \u003c 146, Firefox ESR \u003c 140.7, and Thunderbird \u003c 140.7.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14327",
          "url": "https://www.suse.com/security/cve/CVE-2025-14327"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1254551 for CVE-2025-14327",
          "url": "https://bugzilla.suse.com/1254551"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-19T11:14:01Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-14327"
    },
    {
      "cve": "CVE-2026-0877",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-0877"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 115.32, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-0877",
          "url": "https://www.suse.com/security/cve/CVE-2026-0877"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256340 for CVE-2026-0877",
          "url": "https://bugzilla.suse.com/1256340"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-19T11:14:01Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-0877"
    },
    {
      "cve": "CVE-2026-0878",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-0878"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-0878",
          "url": "https://www.suse.com/security/cve/CVE-2026-0878"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256340 for CVE-2026-0878",
          "url": "https://bugzilla.suse.com/1256340"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-19T11:14:01Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-0878"
    },
    {
      "cve": "CVE-2026-0879",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-0879"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 115.32, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-0879",
          "url": "https://www.suse.com/security/cve/CVE-2026-0879"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256340 for CVE-2026-0879",
          "url": "https://bugzilla.suse.com/1256340"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-19T11:14:01Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-0879"
    },
    {
      "cve": "CVE-2026-0880",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-0880"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Sandbox escape due to integer overflow in the Graphics component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 115.32, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-0880",
          "url": "https://www.suse.com/security/cve/CVE-2026-0880"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256340 for CVE-2026-0880",
          "url": "https://bugzilla.suse.com/1256340"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-19T11:14:01Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-0880"
    },
    {
      "cve": "CVE-2026-0882",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-0882"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Use-after-free in the IPC component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 115.32, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-0882",
          "url": "https://www.suse.com/security/cve/CVE-2026-0882"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256340 for CVE-2026-0882",
          "url": "https://bugzilla.suse.com/1256340"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-19T11:14:01Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-0882"
    },
    {
      "cve": "CVE-2026-0883",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-0883"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Information disclosure in the Networking component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-0883",
          "url": "https://www.suse.com/security/cve/CVE-2026-0883"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256340 for CVE-2026-0883",
          "url": "https://bugzilla.suse.com/1256340"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-19T11:14:01Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-0883"
    },
    {
      "cve": "CVE-2026-0884",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-0884"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-0884",
          "url": "https://www.suse.com/security/cve/CVE-2026-0884"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256340 for CVE-2026-0884",
          "url": "https://bugzilla.suse.com/1256340"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-19T11:14:01Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-0884"
    },
    {
      "cve": "CVE-2026-0885",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-0885"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-0885",
          "url": "https://www.suse.com/security/cve/CVE-2026-0885"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256340 for CVE-2026-0885",
          "url": "https://bugzilla.suse.com/1256340"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-19T11:14:01Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-0885"
    },
    {
      "cve": "CVE-2026-0886",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-0886"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 115.32, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-0886",
          "url": "https://www.suse.com/security/cve/CVE-2026-0886"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256340 for CVE-2026-0886",
          "url": "https://bugzilla.suse.com/1256340"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-19T11:14:01Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-0886"
    },
    {
      "cve": "CVE-2026-0887",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-0887"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Clickjacking issue, information disclosure in the PDF Viewer component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-0887",
          "url": "https://www.suse.com/security/cve/CVE-2026-0887"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256340 for CVE-2026-0887",
          "url": "https://bugzilla.suse.com/1256340"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-19T11:14:01Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-0887"
    },
    {
      "cve": "CVE-2026-0890",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-0890"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Spoofing issue in the DOM: Copy \u0026 Paste and Drag \u0026 Drop component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-0890",
          "url": "https://www.suse.com/security/cve/CVE-2026-0890"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256340 for CVE-2026-0890",
          "url": "https://bugzilla.suse.com/1256340"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-19T11:14:01Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-0890"
    },
    {
      "cve": "CVE-2026-0891",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-0891"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
          "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-0891",
          "url": "https://www.suse.com/security/cve/CVE-2026-0891"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256340 for CVE-2026-0891",
          "url": "https://bugzilla.suse.com/1256340"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-common-140.7.0-150200.8.251.1.x86_64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.aarch64",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.ppc64le",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.s390x",
            "openSUSE Leap 15.6:MozillaThunderbird-translations-other-140.7.0-150200.8.251.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-19T11:14:01Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-0891"
    }
  ]
}

CVE-2026-0880 (GCVE-0-2026-0880)

Vulnerability from cvelistv5 – Published: 2026-01-13 13:30 – Updated: 2026-01-15 09:31

Title

Sandbox escape due to integer overflow in the Graphics component

Summary

Sandbox escape due to integer overflow in the Graphics component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

mozilla

References

URL

Tags

	https://bugzilla.mozilla.org/show_bug.cgi?id=2005014
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

Vendor

Product

Version

Mozilla

Firefox

Affected: unspecified , < 147 (custom)

Mozilla	Firefox ESR	Affected: unspecified , < 115.32 (custom)
Mozilla	Firefox ESR	Affected: unspecified , < 140.7 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 147 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 140.7 (custom)

Credits

Oskar L

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-0880",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-13T18:40:37.196895Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-13T18:41:39.067Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "115.32",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Oskar L"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to integer overflow in the Graphics component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 115.32, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
            }
          ],
          "value": "Sandbox escape due to integer overflow in the Graphics component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 115.32, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T09:31:10.655Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2005014"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-01/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-02/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-03/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-04/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-05/"
        }
      ],
      "title": "Sandbox escape due to integer overflow in the Graphics component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-0880",
    "datePublished": "2026-01-13T13:30:54.679Z",
    "dateReserved": "2026-01-13T13:30:54.411Z",
    "dateUpdated": "2026-01-15T09:31:10.655Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0885 (GCVE-0-2026-0885)

Vulnerability from cvelistv5 – Published: 2026-01-13 13:30 – Updated: 2026-01-15 09:31

Title

Use-after-free in the JavaScript: GC component

Summary

Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

CWE

CWE-416 - Use After Free

Assigner

mozilla

References

URL

Tags

	https://bugzilla.mozilla.org/show_bug.cgi?id=2003607
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

Vendor

Product

Version

Mozilla

Firefox

Affected: unspecified , < 147 (custom)

Mozilla	Firefox ESR	Affected: unspecified , < 140.7 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 147 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 140.7 (custom)

Credits

Irvan Kurniawan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-0885",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-13T20:24:43.381223Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-13T20:25:45.847Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Irvan Kurniawan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
            }
          ],
          "value": "Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T09:31:13.413Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2003607"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-01/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-03/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-04/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-05/"
        }
      ],
      "title": "Use-after-free in the JavaScript: GC component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-0885",
    "datePublished": "2026-01-13T13:30:56.939Z",
    "dateReserved": "2026-01-13T13:30:56.753Z",
    "dateUpdated": "2026-01-15T09:31:13.413Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0887 (GCVE-0-2026-0887)

Vulnerability from cvelistv5 – Published: 2026-01-13 13:30 – Updated: 2026-01-15 15:32

Title

Clickjacking issue, information disclosure in the PDF Viewer component

Summary

Clickjacking issue, information disclosure in the PDF Viewer component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.

Severity ?

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CWE

CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

Assigner

mozilla

References

URL

Tags

	https://bugzilla.mozilla.org/show_bug.cgi?id=2006500
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

Vendor

Product

Version

Mozilla

Firefox

Affected: unspecified , < 147 (custom)

Mozilla	Firefox ESR	Affected: unspecified , < 140.7 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 147 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 140.7 (custom)

Credits

Lyra Rebane

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-0887",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-15T15:32:40.994965Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-497",
                "description": "CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-15T15:32:44.439Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Lyra Rebane"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Clickjacking issue, information disclosure in the PDF Viewer component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
            }
          ],
          "value": "Clickjacking issue, information disclosure in the PDF Viewer component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T09:31:14.501Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2006500"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-01/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-03/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-04/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-05/"
        }
      ],
      "title": "Clickjacking issue, information disclosure in the PDF Viewer component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-0887",
    "datePublished": "2026-01-13T13:30:57.847Z",
    "dateReserved": "2026-01-13T13:30:57.650Z",
    "dateUpdated": "2026-01-15T15:32:44.439Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0891 (GCVE-0-2026-0891)

Vulnerability from cvelistv5 – Published: 2026-01-13 13:30 – Updated: 2026-01-15 09:31

Title

Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147

Summary

Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.

Severity ?

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla

References

URL

Tags

	https://bugzilla.mozilla.org/buglist.cgi?bug_id=1…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

Vendor

Product

Version

Mozilla

Firefox

Affected: unspecified , < 147 (custom)

Mozilla	Firefox ESR	Affected: unspecified , < 140.7 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 147 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 140.7 (custom)

Credits

Andrew McCreight, Dennis Jackson and the Mozilla Fuzzing Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-0891",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-15T04:56:04.392Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Andrew McCreight, Dennis Jackson and the Mozilla Fuzzing Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
            }
          ],
          "value": "Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T09:31:16.819Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147",
          "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1964722%2C2000981%2C2003100%2C2003278"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-01/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-03/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-04/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-05/"
        }
      ],
      "title": "Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-0891",
    "datePublished": "2026-01-13T13:30:59.454Z",
    "dateReserved": "2026-01-13T13:30:59.286Z",
    "dateUpdated": "2026-01-15T09:31:16.819Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14327 (GCVE-0-2025-14327)

Vulnerability from cvelistv5 – Published: 2025-12-09 13:38 – Updated: 2026-01-15 09:31

Title

Spoofing issue in the Downloads Panel component

Summary

Spoofing issue in the Downloads Panel component. This vulnerability affects Firefox < 146, Thunderbird < 146, Firefox ESR < 140.7, and Thunderbird < 140.7.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-290 - Authentication Bypass by Spoofing

Assigner

mozilla

References

URL

Tags

	https://bugzilla.mozilla.org/show_bug.cgi?id=1970743
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

Vendor

Product

Version

Mozilla

Firefox

Affected: unspecified , < 146 (custom)

Mozilla	Thunderbird	Affected: unspecified , < 146 (custom)
Mozilla	Firefox ESR	Affected: unspecified , < 140.7 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 140.7 (custom)

Credits

Caro Kann

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-14327",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-11T20:42:08.839635Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-290",
                "description": "CWE-290 Authentication Bypass by Spoofing",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-11T20:45:35.202Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "146",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "146",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Caro Kann"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Spoofing issue in the Downloads Panel component. This vulnerability affects Firefox \u003c 146, Thunderbird \u003c 146, Firefox ESR \u003c 140.7, and Thunderbird \u003c 140.7."
            }
          ],
          "value": "Spoofing issue in the Downloads Panel component. This vulnerability affects Firefox \u003c 146, Thunderbird \u003c 146, Firefox ESR \u003c 140.7, and Thunderbird \u003c 140.7."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T09:31:17.854Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1970743"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-92/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-95/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-03/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-05/"
        }
      ],
      "title": "Spoofing issue in the Downloads Panel component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2025-14327",
    "datePublished": "2025-12-09T13:38:02.260Z",
    "dateReserved": "2025-12-09T13:38:01.463Z",
    "dateUpdated": "2026-01-15T09:31:17.854Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0879 (GCVE-0-2026-0879)

Vulnerability from cvelistv5 – Published: 2026-01-13 13:30 – Updated: 2026-01-15 09:31

Title

Sandbox escape due to incorrect boundary conditions in the Graphics component

Summary

Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla

References

URL

Tags

	https://bugzilla.mozilla.org/show_bug.cgi?id=2004602
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

Vendor

Product

Version

Mozilla

Firefox

Affected: unspecified , < 147 (custom)

Mozilla	Firefox ESR	Affected: unspecified , < 115.32 (custom)
Mozilla	Firefox ESR	Affected: unspecified , < 140.7 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 147 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 140.7 (custom)

Credits

Oskar L

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-0879",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-13T18:37:22.611097Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-13T18:38:32.416Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "115.32",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Oskar L"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 115.32, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
            }
          ],
          "value": "Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 115.32, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T09:31:10.036Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2004602"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-01/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-02/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-03/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-04/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-05/"
        }
      ],
      "title": "Sandbox escape due to incorrect boundary conditions in the Graphics component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-0879",
    "datePublished": "2026-01-13T13:30:54.207Z",
    "dateReserved": "2026-01-13T13:30:53.990Z",
    "dateUpdated": "2026-01-15T09:31:10.036Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0886 (GCVE-0-2026-0886)

Vulnerability from cvelistv5 – Published: 2026-01-13 13:30 – Updated: 2026-01-15 15:34

Title

Incorrect boundary conditions in the Graphics component

Summary

Incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla

References

URL

Tags

	https://bugzilla.mozilla.org/show_bug.cgi?id=2005658
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

Vendor

Product

Version

Mozilla

Firefox

Affected: unspecified , < 147 (custom)

Mozilla	Firefox ESR	Affected: unspecified , < 115.32 (custom)
Mozilla	Firefox ESR	Affected: unspecified , < 140.7 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 147 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 140.7 (custom)

Credits

Oskar L

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-0886",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-13T20:27:39.523757Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-15T15:34:33.932Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "115.32",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Oskar L"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 115.32, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
            }
          ],
          "value": "Incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 115.32, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T09:31:13.957Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2005658"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-01/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-02/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-03/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-04/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-05/"
        }
      ],
      "title": "Incorrect boundary conditions in the Graphics component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-0886",
    "datePublished": "2026-01-13T13:30:57.400Z",
    "dateReserved": "2026-01-13T13:30:57.209Z",
    "dateUpdated": "2026-01-15T15:34:33.932Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0890 (GCVE-0-2026-0890)

Vulnerability from cvelistv5 – Published: 2026-01-13 13:30 – Updated: 2026-01-15 15:30

Title

Spoofing issue in the DOM: Copy & Paste and Drag & Drop component

Summary

Spoofing issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.

Severity ?

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

CWE

CWE-290 - Authentication Bypass by Spoofing

Assigner

mozilla

References

URL

Tags

	https://bugzilla.mozilla.org/show_bug.cgi?id=2005081
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

Vendor

Product

Version

Mozilla

Firefox

Affected: unspecified , < 147 (custom)

Mozilla	Firefox ESR	Affected: unspecified , < 140.7 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 147 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 140.7 (custom)

Credits

Edgar Chen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-0890",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-15T15:30:33.018220Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-290",
                "description": "CWE-290 Authentication Bypass by Spoofing",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-15T15:30:48.870Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Edgar Chen"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Spoofing issue in the DOM: Copy \u0026 Paste and Drag \u0026 Drop component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
            }
          ],
          "value": "Spoofing issue in the DOM: Copy \u0026 Paste and Drag \u0026 Drop component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T09:31:16.279Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2005081"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-01/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-03/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-04/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-05/"
        }
      ],
      "title": "Spoofing issue in the DOM: Copy \u0026 Paste and Drag \u0026 Drop component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-0890",
    "datePublished": "2026-01-13T13:30:59.089Z",
    "dateReserved": "2026-01-13T13:30:58.912Z",
    "dateUpdated": "2026-01-15T15:30:48.870Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0882 (GCVE-0-2026-0882)

Vulnerability from cvelistv5 – Published: 2026-01-13 13:30 – Updated: 2026-01-15 09:31

Title

Use-after-free in the IPC component

Summary

Use-after-free in the IPC component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-416 - Use After Free

Assigner

mozilla

References

URL

Tags

	https://bugzilla.mozilla.org/show_bug.cgi?id=1924125
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

Vendor

Product

Version

Mozilla

Firefox

Affected: unspecified , < 147 (custom)

Mozilla	Firefox ESR	Affected: unspecified , < 115.32 (custom)
Mozilla	Firefox ESR	Affected: unspecified , < 140.7 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 147 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 140.7 (custom)

Credits

Randell Jesup

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-0882",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-13T18:21:25.499529Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-13T18:23:30.824Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "115.32",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Randell Jesup"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the IPC component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 115.32, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
            }
          ],
          "value": "Use-after-free in the IPC component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 115.32, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T09:31:11.810Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1924125"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-01/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-02/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-03/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-04/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-05/"
        }
      ],
      "title": "Use-after-free in the IPC component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-0882",
    "datePublished": "2026-01-13T13:30:55.562Z",
    "dateReserved": "2026-01-13T13:30:55.389Z",
    "dateUpdated": "2026-01-15T09:31:11.810Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0877 (GCVE-0-2026-0877)

Vulnerability from cvelistv5 – Published: 2026-01-13 13:30 – Updated: 2026-01-15 09:31

Title

Mitigation bypass in the DOM: Security component

Summary

Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.

Severity ?

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE

CWE-693 - Protection Mechanism Failure

Assigner

mozilla

References

URL

Tags

	https://bugzilla.mozilla.org/show_bug.cgi?id=1999257
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

Vendor

Product

Version

Mozilla

Firefox

Affected: unspecified , < 147 (custom)

Mozilla	Firefox ESR	Affected: unspecified , < 115.32 (custom)
Mozilla	Firefox ESR	Affected: unspecified , < 140.7 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 147 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 140.7 (custom)

Credits

mingijung

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-0877",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-13T15:24:18.449019Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-693",
                "description": "CWE-693 Protection Mechanism Failure",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-13T15:26:15.125Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "115.32",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "mingijung"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 115.32, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
            }
          ],
          "value": "Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 115.32, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T09:31:08.828Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1999257"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-01/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-02/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-03/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-04/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-05/"
        }
      ],
      "title": "Mitigation bypass in the DOM: Security component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-0877",
    "datePublished": "2026-01-13T13:30:52.979Z",
    "dateReserved": "2026-01-13T13:30:52.762Z",
    "dateUpdated": "2026-01-15T09:31:08.828Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0878 (GCVE-0-2026-0878)

Vulnerability from cvelistv5 – Published: 2026-01-13 13:30 – Updated: 2026-01-15 09:31

Title

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Summary

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.

Severity ?

8 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-20 - Improper Input Validation

Assigner

mozilla

References

URL

Tags

	https://bugzilla.mozilla.org/show_bug.cgi?id=2003989
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

Vendor

Product

Version

Mozilla

Firefox

Affected: unspecified , < 147 (custom)

Mozilla	Firefox ESR	Affected: unspecified , < 140.7 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 147 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 140.7 (custom)

Credits

Oskar L

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-0878",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-13T15:40:42.337589Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-13T15:43:10.236Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Oskar L"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
            }
          ],
          "value": "Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T09:31:09.491Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2003989"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-01/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-03/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-04/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-05/"
        }
      ],
      "title": "Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-0878",
    "datePublished": "2026-01-13T13:30:53.697Z",
    "dateReserved": "2026-01-13T13:30:53.395Z",
    "dateUpdated": "2026-01-15T09:31:09.491Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0884 (GCVE-0-2026-0884)

Vulnerability from cvelistv5 – Published: 2026-01-13 13:30 – Updated: 2026-01-15 09:31

Title

Use-after-free in the JavaScript Engine component

Summary

Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416 - Use After Free

Assigner

mozilla

References

URL

Tags

	https://bugzilla.mozilla.org/show_bug.cgi?id=2003588
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

Vendor

Product

Version

Mozilla

Firefox

Affected: unspecified , < 147 (custom)

Mozilla	Firefox ESR	Affected: unspecified , < 140.7 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 147 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 140.7 (custom)

Credits

Gary Kwong and Nan Wang

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-0884",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-13T15:35:44.298477Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-13T15:37:27.838Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Gary Kwong and Nan Wang"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
            }
          ],
          "value": "Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T09:31:12.864Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2003588"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-01/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-03/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-04/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-05/"
        }
      ],
      "title": "Use-after-free in the JavaScript Engine component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-0884",
    "datePublished": "2026-01-13T13:30:56.543Z",
    "dateReserved": "2026-01-13T13:30:56.343Z",
    "dateUpdated": "2026-01-15T09:31:12.864Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0883 (GCVE-0-2026-0883)

Vulnerability from cvelistv5 – Published: 2026-01-13 13:30 – Updated: 2026-01-15 09:31

Title

Information disclosure in the Networking component

Summary

Information disclosure in the Networking component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

mozilla

References

URL

Tags

	https://bugzilla.mozilla.org/show_bug.cgi?id=1989340
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…
	https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

Vendor

Product

Version

Mozilla

Firefox

Affected: unspecified , < 147 (custom)

Mozilla	Firefox ESR	Affected: unspecified , < 140.7 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 147 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 140.7 (custom)

Credits

Vladislav Plyatsok

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-0883",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-13T15:46:59.917737Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-13T15:47:56.126Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "147",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "140.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Vladislav Plyatsok"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Information disclosure in the Networking component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
            }
          ],
          "value": "Information disclosure in the Networking component. This vulnerability affects Firefox \u003c 147, Firefox ESR \u003c 140.7, Thunderbird \u003c 147, and Thunderbird \u003c 140.7."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T09:31:12.339Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1989340"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-01/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-03/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-04/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-05/"
        }
      ],
      "title": "Information disclosure in the Networking component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-0883",
    "datePublished": "2026-01-13T13:30:56.043Z",
    "dateReserved": "2026-01-13T13:30:55.877Z",
    "dateUpdated": "2026-01-15T09:31:12.339Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

SUSE-SU-2026:0153-1

CVE-2026-0880 (GCVE-0-2026-0880)

CVE-2026-0885 (GCVE-0-2026-0885)

CVE-2026-0887 (GCVE-0-2026-0887)

CVE-2026-0891 (GCVE-0-2026-0891)

CVE-2025-14327 (GCVE-0-2025-14327)

CVE-2026-0879 (GCVE-0-2026-0879)

CVE-2026-0886 (GCVE-0-2026-0886)

CVE-2026-0890 (GCVE-0-2026-0890)

CVE-2026-0882 (GCVE-0-2026-0882)

CVE-2026-0877 (GCVE-0-2026-0877)

CVE-2026-0878 (GCVE-0-2026-0878)

CVE-2026-0884 (GCVE-0-2026-0884)

CVE-2026-0883 (GCVE-0-2026-0883)

Tags

Sightings

Nomenclature