thunderbird: Fix of 56 CVEs

{
  "id": "c73ca56ca785b2cba79fcf42bc01028967f91352e1c1f0f48aa9ed589af9bcd3",
  "url": "https://osv.dev/vulnerability/CLSA-2026-1792779937",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "thunderbird: Fix of 56 CVEs",
    "summary": "- update to 153.5.0 ESR (MFSA 2026-103 for 153.4, MFSA 2026-110 for 153.5) - drop CVE-2026-100779-CVE-2026-100785.patch and CVE-2026-100781.patch, their fixes are part of 153.5.0 - stop packaging rnp-cli and rnpkeys: upstream no longer installs them (bug 2068130); librnp.so is still shipped - regenerate langpacks from the 153.5.0esr release xpi set (66 languages, the same set as 153.3.1esr) - CVE-2026-103500: Heap buffer overflow opening large email - CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback component - CVE-2026-100757: Use-after-free in the Widget component - CVE-2026-100758: Sandbox escape in the DOM: Navigation component - CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager component - CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing component - CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content Processes component - CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component - CVE-2026-100766: Information disclosure in the Networking: JAR component - CVE-2026-100767: Use-after-free in the Networking: Cache component - CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component - CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content Processes component - CVE-2026-100771: Undefined behavior in the DOM: Streams component - CVE-2026-100772: Use-after-free in the DOM: Core & HTML component - CVE-2026-100773: Use-after-free in the Storage: I",
    "evidence": "osv:CLSA-2026-1792779937",
    "products": [
      {
        "name": {
          "value": "thunderbird",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "153.5.0-1.el9_2.alma.1.tuxcare.els1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CLSA-2026-1792779937",
      "aliases": [
        "CLSA-2026-1792779937"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "153.5.0-1.el9_2.alma.1.tuxcare.els1"
                }
              ]
            }
          ],
          "package": {
            "name": "thunderbird",
            "purl": "pkg:rpm/tuxcare/thunderbird?distro=almalinux-9.2",
            "ecosystem": "TuxCare:AlmaLinux:9.2"
          },
          "database_specific": {
            "source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792779937.json"
          }
        }
      ],
      "modified": "2026-10-26T09:43:19.875538635Z",
      "provider": "osv",
      "upstream": [
        "CVE-2026-100756",
        "CVE-2026-100757",
        "CVE-2026-100758",
        "CVE-2026-100759",
        "CVE-2026-100760",
        "CVE-2026-100762",
        "CVE-2026-100765",
        "CVE-2026-100766",
        "CVE-2026-100767",
        "CVE-2026-100769",
        "CVE-2026-100770",
        "CVE-2026-100771",
        "CVE-2026-100772",
        "CVE-2026-100773",
        "CVE-2026-100774",
        "CVE-2026-100775",
        "CVE-2026-100776",
        "CVE-2026-100777",
        "CVE-2026-100778",
        "CVE-2026-100779",
        "CVE-2026-100780",
        "CVE-2026-100781",
        "CVE-2026-100782",
        "CVE-2026-100783",
        "CVE-2026-100784",
        "CVE-2026-100785",
        "CVE-2026-100786",
        "CVE-2026-100787",
        "CVE-2026-100788",
        "CVE-2026-100789",
        "CVE-2026-100790",
        "CVE-2026-100791",
        "CVE-2026-100792",
        "CVE-2026-100794",
        "CVE-2026-100797",
        "CVE-2026-100798",
        "CVE-2026-100800",
        "CVE-2026-100801",
        "CVE-2026-100803",
        "CVE-2026-100806",
        "CVE-2026-100807",
        "CVE-2026-100808",
        "CVE-2026-100809",
        "CVE-2026-100811",
        "CVE-2026-100812",
        "CVE-2026-100814",
        "CVE-2026-100815",
        "CVE-2026-100816",
        "CVE-2026-100818",
        "CVE-2026-100819",
        "CVE-2026-100820",
        "CVE-2026-100821",
        "CVE-2026-100822",
        "CVE-2026-100824",
        "CVE-2026-100825",
        "CVE-2026-100826",
        "CVE-2026-100828",
        "CVE-2026-100829",
        "CVE-2026-100830",
        "CVE-2026-100831",
        "CVE-2026-100832",
        "CVE-2026-103500",
        "CVE-2026-109704",
        "CVE-2026-109705",
        "CVE-2026-109706",
        "CVE-2026-109707",
        "CVE-2026-109708",
        "CVE-2026-109709",
        "CVE-2026-109710",
        "CVE-2026-109711",
        "CVE-2026-109712",
        "CVE-2026-109713",
        "CVE-2026-109715",
        "CVE-2026-109716",
        "CVE-2026-109717",
        "CVE-2026-109718",
        "CVE-2026-109719",
        "CVE-2026-109720",
        "CVE-2026-109721",
        "CVE-2026-109722",
        "CVE-2026-109723",
        "CVE-2026-109724",
        "CVE-2026-109725",
        "CVE-2026-109726",
        "CVE-2026-109727",
        "CVE-2026-109728",
        "CVE-2026-109729",
        "CVE-2026-109730",
        "CVE-2026-109731",
        "CVE-2026-109732",
        "CVE-2026-109733",
        "CVE-2026-109734",
        "CVE-2026-109736",
        "CVE-2026-109737",
        "CVE-2026-109738",
        "CVE-2026-109740",
        "CVE-2026-109741",
        "CVE-2026-109742",
        "CVE-2026-109743",
        "CVE-2026-109744",
        "CVE-2026-109745",
        "CVE-2026-109751",
        "CVE-2026-109752",
        "CVE-2026-109753",
        "CVE-2026-109754",
        "CVE-2026-109756",
        "CVE-2026-109757",
        "CVE-2026-109759",
        "CVE-2026-109760",
        "CVE-2026-109762",
        "CVE-2026-109763",
        "CVE-2026-109764",
        "CVE-2026-109765",
        "CVE-2026-109766",
        "CVE-2026-109767",
        "CVE-2026-109770",
        "CVE-2026-109775",
        "CVE-2026-109776",
        "CVE-2026-109777",
        "CVE-2026-109778",
        "CVE-2026-109781",
        "CVE-2026-109782",
        "CVE-2026-109783",
        "CVE-2026-110249",
        "CVE-2026-96869"
      ],
      "references": [
        "https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792779937.html",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100756",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100757",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100758",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100759",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100760",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100762",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100765",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100766",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100767",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100769",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100770",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100771",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100772",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100773",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100774",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100775",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100776",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100777",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100778",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100780",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100782",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100783",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100785",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100787",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100788",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100789",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100790",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100791",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100792",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100794",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100797",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100801",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100803",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100807",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100808",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100809",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100811",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100812",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100814",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100815",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100816",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100818",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100819",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100820",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100821",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100822",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100824",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100825",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100826",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100828",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100829",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100830",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100831",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100832",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-103500",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-96869"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2026-100756",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100757",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100758",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100759",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100760",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100762",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100765",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100766",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100767",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100769",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100770",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100771",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100772",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100773",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100774",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100775",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100776",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100777",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100778",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100779",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100780",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100781",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100782",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100783",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100784",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100785",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100786",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100787",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100788",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100789",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100790",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100791",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100792",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100794",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100797",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100798",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100800",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100801",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100803",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100806",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100807",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100808",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100809",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100811",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100812",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100814",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100815",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100816",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100818",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100819",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100820",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100821",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100822",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100824",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100825",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100826",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100828",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100829",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100830",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100831",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-100832",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-103500",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109704",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109705",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109706",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109707",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109708",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109709",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109710",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109711",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109712",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109713",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109715",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109716",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109717",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109718",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109719",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109720",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109721",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109722",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109723",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109724",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109725",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109726",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109727",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109728",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109729",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109730",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109731",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109732",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109733",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109734",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109736",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109737",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109738",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109740",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109741",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109742",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109743",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109744",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109745",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109751",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109752",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109753",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109754",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109756",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109757",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109759",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109760",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109762",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109763",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109764",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109765",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109766",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109767",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109770",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109775",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109776",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109777",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109778",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109781",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109782",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-109783",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-110249",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-96869",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 449837,
  "published_at": "2026-10-23T18:27:45+00:00"
}