Security update for MozillaThunderbird

{
  "id": "2fb721855ecced0073524d0eee0bb8784cf93f144b7d3d8205bac04a6fd92822",
  "url": "https://osv.dev/vulnerability/SUSE-SU-2026%3A4736-1",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Security update for MozillaThunderbird",
    "summary": "This update for MozillaThunderbird fixes the following issues: Update to Mozilla Thunderbird 153.5 (MFSA 2026-110, bsc#1284493): - CVE-2026-109704: Privilege escalation in the Application Update component. - CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. - CVE-2026-109706: Use-after-free in the Storage: IndexedDB component. - CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component. - CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component. - CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component. - CVE-2026-109710: Use-after-free in the Graphics: Text component. - CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component. - CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component. - CVE-2026-109713: Use-after-free in the Crash Reporting component. - CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component. - CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component. - CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component. - CVE-2026-109718: Use-after-free in the XML component. - CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component. - CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component. - CVE-2026-109721: Inco",
    "evidence": "osv:SUSE-SU-2026:4736-1",
    "products": [
      {
        "name": {
          "value": "MozillaThunderbird",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "153.5.0-150400.13.9.1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "MozillaThunderbird",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "153.5.0-150400.13.9.1",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "SUSE-SU-2026:4736-1",
      "aliases": [
        "SUSE-SU-2026:4736-1"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "153.5.0-150400.13.9.1"
                }
              ]
            }
          ],
          "package": {
            "name": "MozillaThunderbird",
            "purl": "pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7",
            "ecosystem": "SUSE:Linux Enterprise Module for Package Hub 15 SP7"
          },
          "database_specific": {
            "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4736-1.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "MozillaThunderbird": "153.5.0-150400.13.9.1",
                "MozillaThunderbird-translations-other": "153.5.0-150400.13.9.1",
                "MozillaThunderbird-translations-common": "153.5.0-150400.13.9.1"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "153.5.0-150400.13.9.1"
                }
              ]
            }
          ],
          "package": {
            "name": "MozillaThunderbird",
            "purl": "pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP7",
            "ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP7"
          },
          "database_specific": {
            "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4736-1.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "MozillaThunderbird": "153.5.0-150400.13.9.1",
                "MozillaThunderbird-translations-other": "153.5.0-150400.13.9.1",
                "MozillaThunderbird-translations-common": "153.5.0-150400.13.9.1"
              }
            ]
          }
        }
      ],
      "modified": "2026-10-20T10:45:04.190986882Z",
      "provider": "osv",
      "upstream": [
        "CVE-2026-109704",
        "CVE-2026-109705",
        "CVE-2026-109706",
        "CVE-2026-109707",
        "CVE-2026-109708",
        "CVE-2026-109709",
        "CVE-2026-109710",
        "CVE-2026-109711",
        "CVE-2026-109712",
        "CVE-2026-109713",
        "CVE-2026-109715",
        "CVE-2026-109716",
        "CVE-2026-109717",
        "CVE-2026-109718",
        "CVE-2026-109719",
        "CVE-2026-109720",
        "CVE-2026-109721",
        "CVE-2026-109722",
        "CVE-2026-109723",
        "CVE-2026-109724",
        "CVE-2026-109725",
        "CVE-2026-109726",
        "CVE-2026-109727",
        "CVE-2026-109728",
        "CVE-2026-109729",
        "CVE-2026-109730",
        "CVE-2026-109731",
        "CVE-2026-109732",
        "CVE-2026-109733",
        "CVE-2026-109734",
        "CVE-2026-109736",
        "CVE-2026-109737",
        "CVE-2026-109738",
        "CVE-2026-109740",
        "CVE-2026-109741",
        "CVE-2026-109742",
        "CVE-2026-109743",
        "CVE-2026-109744",
        "CVE-2026-109745",
        "CVE-2026-109751",
        "CVE-2026-109752",
        "CVE-2026-109753",
        "CVE-2026-109754",
        "CVE-2026-109756",
        "CVE-2026-109757",
        "CVE-2026-109759",
        "CVE-2026-109760",
        "CVE-2026-109762",
        "CVE-2026-109763",
        "CVE-2026-109764",
        "CVE-2026-109765",
        "CVE-2026-109766",
        "CVE-2026-109767",
        "CVE-2026-109770",
        "CVE-2026-109775",
        "CVE-2026-109776",
        "CVE-2026-109777",
        "CVE-2026-109778",
        "CVE-2026-109781",
        "CVE-2026-109782",
        "CVE-2026-109783",
        "CVE-2026-110249",
        "CVE-2026-32776",
        "CVE-2026-32777",
        "CVE-2026-32778",
        "CVE-2026-41080",
        "CVE-2026-45186",
        "CVE-2026-50219",
        "CVE-2026-56131",
        "CVE-2026-56132",
        "CVE-2026-56403",
        "CVE-2026-56404",
        "CVE-2026-56405",
        "CVE-2026-56406",
        "CVE-2026-56407",
        "CVE-2026-56408",
        "CVE-2026-56409",
        "CVE-2026-56410",
        "CVE-2026-56411",
        "CVE-2026-56412",
        "CVE-2026-66046",
        "CVE-2026-72522",
        "CVE-2026-76641",
        "CVE-2026-76956",
        "CVE-2026-76957",
        "CVE-2026-93990"
      ],
      "references": [
        "https://www.suse.com/support/update/announcement/2026/suse-su-20264736-1/",
        "https://bugzilla.suse.com/1259712",
        "https://bugzilla.suse.com/1259727",
        "https://bugzilla.suse.com/1259730",
        "https://bugzilla.suse.com/1262263",
        "https://bugzilla.suse.com/1264713",
        "https://bugzilla.suse.com/1275108",
        "https://bugzilla.suse.com/1275605",
        "https://bugzilla.suse.com/1275736",
        "https://bugzilla.suse.com/1282347",
        "https://bugzilla.suse.com/1284493",
        "https://www.suse.com/security/cve/CVE-2026-109704",
        "https://www.suse.com/security/cve/CVE-2026-109705",
        "https://www.suse.com/security/cve/CVE-2026-109706",
        "https://www.suse.com/security/cve/CVE-2026-109707",
        "https://www.suse.com/security/cve/CVE-2026-109708",
        "https://www.suse.com/security/cve/CVE-2026-109709",
        "https://www.suse.com/security/cve/CVE-2026-109710",
        "https://www.suse.com/security/cve/CVE-2026-109711",
        "https://www.suse.com/security/cve/CVE-2026-109712",
        "https://www.suse.com/security/cve/CVE-2026-109713",
        "https://www.suse.com/security/cve/CVE-2026-109715",
        "https://www.suse.com/security/cve/CVE-2026-109716",
        "https://www.suse.com/security/cve/CVE-2026-109717",
        "https://www.suse.com/security/cve/CVE-2026-109718",
        "https://www.suse.com/security/cve/CVE-2026-109719",
        "https://www.suse.com/security/cve/CVE-2026-109720",
        "https://www.suse.com/security/cve/CVE-2026-109721",
        "https://www.suse.com/security/cve/CVE-2026-109722",
        "https://www.suse.com/security/cve/CVE-2026-109723",
        "https://www.suse.com/security/cve/CVE-2026-109724",
        "https://www.suse.com/security/cve/CVE-2026-109725",
        "https://www.suse.com/security/cve/CVE-2026-109726",
        "https://www.suse.com/security/cve/CVE-2026-109727",
        "https://www.suse.com/security/cve/CVE-2026-109728",
        "https://www.suse.com/security/cve/CVE-2026-109729",
        "https://www.suse.com/security/cve/CVE-2026-109730",
        "https://www.suse.com/security/cve/CVE-2026-109731",
        "https://www.suse.com/security/cve/CVE-2026-109732",
        "https://www.suse.com/security/cve/CVE-2026-109733",
        "https://www.suse.com/security/cve/CVE-2026-109734",
        "https://www.suse.com/security/cve/CVE-2026-109736",
        "https://www.suse.com/security/cve/CVE-2026-109737",
        "https://www.suse.com/security/cve/CVE-2026-109738",
        "https://www.suse.com/security/cve/CVE-2026-109740",
        "https://www.suse.com/security/cve/CVE-2026-109741",
        "https://www.suse.com/security/cve/CVE-2026-109742",
        "https://www.suse.com/security/cve/CVE-2026-109743",
        "https://www.suse.com/security/cve/CVE-2026-109744",
        "https://www.suse.com/security/cve/CVE-2026-109745",
        "https://www.suse.com/security/cve/CVE-2026-109751",
        "https://www.suse.com/security/cve/CVE-2026-109752",
        "https://www.suse.com/security/cve/CVE-2026-109753",
        "https://www.suse.com/security/cve/CVE-2026-109754",
        "https://www.suse.com/security/cve/CVE-2026-109756",
        "https://www.suse.com/security/cve/CVE-2026-109757",
        "https://www.suse.com/security/cve/CVE-2026-109759",
        "https://www.suse.com/security/cve/CVE-2026-109760",
        "https://www.suse.com/security/cve/CVE-2026-109762",
        "https://www.suse.com/security/cve/CVE-2026-109763",
        "https://www.suse.com/security/cve/CVE-2026-109764",
        "https://www.suse.com/security/cve/CVE-2026-109765",
        "https://www.suse.com/security/cve/CVE-2026-109766",
        "https://www.suse.com/security/cve/CVE-2026-109767",
        "https://www.suse.com/security/cve/CVE-2026-109770",
        "https://www.suse.com/security/cve/CVE-2026-109775",
        "https://www.suse.com/security/cve/CVE-2026-109776",
        "https://www.suse.com/security/cve/CVE-2026-109777",
        "https://www.suse.com/security/cve/CVE-2026-109778",
        "https://www.suse.com/security/cve/CVE-2026-109781",
        "https://www.suse.com/security/cve/CVE-2026-109782",
        "https://www.suse.com/security/cve/CVE-2026-109783",
        "https://www.suse.com/security/cve/CVE-2026-110249",
        "https://www.suse.com/security/cve/CVE-2026-32776",
        "https://www.suse.com/security/cve/CVE-2026-32777",
        "https://www.suse.com/security/cve/CVE-2026-32778",
        "https://www.suse.com/security/cve/CVE-2026-41080",
        "https://www.suse.com/security/cve/CVE-2026-45186",
        "https://www.suse.com/security/cve/CVE-2026-50219",
        "https://www.suse.com/security/cve/CVE-2026-56131",
        "https://www.suse.com/security/cve/CVE-2026-56132",
        "https://www.suse.com/security/cve/CVE-2026-56403",
        "https://www.suse.com/security/cve/CVE-2026-56404",
        "https://www.suse.com/security/cve/CVE-2026-56405",
        "https://www.suse.com/security/cve/CVE-2026-56406",
        "https://www.suse.com/security/cve/CVE-2026-56407",
        "https://www.suse.com/security/cve/CVE-2026-56408",
        "https://www.suse.com/security/cve/CVE-2026-56409",
        "https://www.suse.com/security/cve/CVE-2026-56410",
        "https://www.suse.com/security/cve/CVE-2026-56411",
        "https://www.suse.com/security/cve/CVE-2026-56412",
        "https://www.suse.com/security/cve/CVE-2026-66046",
        "https://www.suse.com/security/cve/CVE-2026-72522",
        "https://www.suse.com/security/cve/CVE-2026-76641",
        "https://www.suse.com/security/cve/CVE-2026-76956",
        "https://www.suse.com/security/cve/CVE-2026-76957",
        "https://www.suse.com/security/cve/CVE-2026-93990"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2026-109704",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109705",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109706",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109707",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109708",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109709",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109710",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109711",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109712",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109713",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109715",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109716",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109717",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109718",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109719",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109720",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109721",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109722",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109723",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109724",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109725",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109726",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109727",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109728",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109729",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109730",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109731",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109732",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109733",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109734",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109736",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109737",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109738",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109740",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109741",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109742",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109743",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109744",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109745",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109751",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109752",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109753",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109754",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109756",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109757",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109759",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109760",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109762",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109763",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109764",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109765",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109766",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109767",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109770",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109775",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109776",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109777",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109778",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109781",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109782",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109783",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-110249",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-32776",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-32777",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-32778",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-41080",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-45186",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-50219",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56131",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56132",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56403",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56404",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56405",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56406",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56407",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56408",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56409",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56410",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56411",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56412",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-66046",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-72522",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-76641",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-76956",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-76957",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-93990",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 379270,
  "published_at": "2026-10-19T12:57:04+00:00"
}