RHSA-2026:4260

Vulnerability from csaf_redhat - Published: 2026-03-11 05:56 - Updated: 2026-03-23 13:12
Summary
Red Hat Security Advisory: thunderbird security update
Severity
Important
Notes
Topic: An update for thunderbird is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * libvpx: Heap buffer overflow in libvpx (CVE-2026-2447) * firefox: Invalid pointer in the JavaScript Engine component (CVE-2026-2785) * firefox: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2793) * firefox: Undefined behavior in the DOM: Core & HTML component (CVE-2026-2771) * firefox: Integer overflow in the Audio/Video component (CVE-2026-2774) * firefox: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software (CVE-2026-2776) * firefox: Integer overflow in the Libraries component in NSS (CVE-2026-2781) * firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-2766) * firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-2769) * firefox: Use-after-free in the DOM: Window and Location component (CVE-2026-2787) * firefox: Sandbox escape in the Storage: IndexedDB component (CVE-2026-2768) * firefox: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-2783) * firefox: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-2788) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-2784) * firefox: Incorrect boundary conditions in the Graphics: ImageLib component (CVE-2026-2759) * firefox: Integer overflow in the JavaScript: Standard Library component (CVE-2026-2762) * firefox: Sandbox escape in the Graphics: WebRender component (CVE-2026-2761) * firefox: Privilege escalation in the Messaging System component (CVE-2026-2777) * firefox: Same-origin policy bypass in the Networking: JAR component (CVE-2026-2790) * firefox: Mitigation bypass in the DOM: HTML Parser component (CVE-2026-2775) * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2763) * firefox: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2792) * firefox: Incorrect boundary conditions in the Web Audio component (CVE-2026-2773) * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2786) * firefox: Use-after-free in the Graphics: ImageLib component (CVE-2026-2789) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Audio/Video component (CVE-2026-2757) * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-2760) * firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-2772) * firefox: Incorrect boundary conditions in the Networking: JAR component (CVE-2026-2779) * firefox: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-2767) * firefox: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component (CVE-2026-2764) * firefox: Privilege escalation in the Netmonitor component (CVE-2026-2782) * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2765) * firefox: Privilege escalation in the Netmonitor component (CVE-2026-2780) * firefox: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component (CVE-2026-2778) * firefox: Use-after-free in the JavaScript: GC component (CVE-2026-2758) * firefox: Mitigation bypass in the Networking: Cache component (CVE-2026-2791) * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-2770) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-2447

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Heap buffer overflow in libvpx.

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2026-2757

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the WebRTC: Audio/Video component.

7.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2758

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: GC component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2759

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Graphics: ImageLib component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2760

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2761

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the Graphics: WebRender component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2762

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Integer overflow in the JavaScript: Standard Library component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2763

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2764

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2765

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2766

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine: JIT component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2767

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: WebAssembly component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2768

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the Storage: IndexedDB component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2769

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Storage: IndexedDB component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2770

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Bindings (WebIDL) component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2771

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Undefined behavior in the DOM: Core & HTML component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2772

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Audio/Video: Playback component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2773

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Web Audio component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2774

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Integer overflow in the Audio/Video component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2775

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: HTML Parser component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2776

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2777

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Messaging System component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2778

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2779

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Networking: JAR component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2780

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Netmonitor component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2781

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Integer overflow in the Libraries component in NSS

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2782

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Netmonitor component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2783

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2784

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: Security component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2785

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Invalid pointer in the JavaScript Engine component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2786

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2787

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Window and Location component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2788

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Audio/Video: GMP component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2789

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Graphics: ImageLib component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2790

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: JAR component

3.4 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2791

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Networking: Cache component

3.4 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2792

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
CVE-2026-2793

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:4260
References
https://access.redhat.com/errata/RHSA-2026:4260 self
https://access.redhat.com/security/updates/classi… external
https://bugzilla.redhat.com/show_bug.cgi?id=2440219 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442284 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442287 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442288 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442290 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442291 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442292 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442294 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442295 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442297 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442298 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442300 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442302 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442304 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442307 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442308 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442309 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442312 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442313 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442314 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442316 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442318 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442319 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442320 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442322 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442324 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442325 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442326 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442327 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442328 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442329 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442331 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442333 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442334 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442335 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442337 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442342 external
https://bugzilla.redhat.com/show_bug.cgi?id=2442343 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-2447 self
https://bugzilla.redhat.com/show_bug.cgi?id=2440219 external
https://www.cve.org/CVERecord?id=CVE-2026-2447 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2447 external
https://bugzilla.mozilla.org/show_bug.cgi?id=2014390 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2757 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442324 external
https://www.cve.org/CVERecord?id=CVE-2026-2757 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2757 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2758 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442337 external
https://www.cve.org/CVERecord?id=CVE-2026-2758 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2758 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2759 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442307 external
https://www.cve.org/CVERecord?id=CVE-2026-2759 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2759 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2760 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442325 external
https://www.cve.org/CVERecord?id=CVE-2026-2760 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2760 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2761 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442309 external
https://www.cve.org/CVERecord?id=CVE-2026-2761 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2761 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2762 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442308 external
https://www.cve.org/CVERecord?id=CVE-2026-2762 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2762 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2763 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442316 external
https://www.cve.org/CVERecord?id=CVE-2026-2763 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2763 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2764 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442329 external
https://www.cve.org/CVERecord?id=CVE-2026-2764 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2764 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2765 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442333 external
https://www.cve.org/CVERecord?id=CVE-2026-2765 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2765 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2766 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442294 external
https://www.cve.org/CVERecord?id=CVE-2026-2766 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2766 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2767 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442328 external
https://www.cve.org/CVERecord?id=CVE-2026-2767 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2767 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2768 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442298 external
https://www.cve.org/CVERecord?id=CVE-2026-2768 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2768 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2769 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442295 external
https://www.cve.org/CVERecord?id=CVE-2026-2769 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2769 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2770 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442343 external
https://www.cve.org/CVERecord?id=CVE-2026-2770 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2770 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2771 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442288 external
https://www.cve.org/CVERecord?id=CVE-2026-2771 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2771 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2772 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442326 external
https://www.cve.org/CVERecord?id=CVE-2026-2772 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2772 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2773 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442319 external
https://www.cve.org/CVERecord?id=CVE-2026-2773 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2773 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2774 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442290 external
https://www.cve.org/CVERecord?id=CVE-2026-2774 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2774 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2775 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442314 external
https://www.cve.org/CVERecord?id=CVE-2026-2775 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2775 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2776 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442291 external
https://www.cve.org/CVERecord?id=CVE-2026-2776 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2776 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2777 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442312 external
https://www.cve.org/CVERecord?id=CVE-2026-2777 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2777 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2778 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442335 external
https://www.cve.org/CVERecord?id=CVE-2026-2778 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2778 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2779 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442327 external
https://www.cve.org/CVERecord?id=CVE-2026-2779 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2779 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2780 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442334 external
https://www.cve.org/CVERecord?id=CVE-2026-2780 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2780 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2781 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442292 external
https://www.cve.org/CVERecord?id=CVE-2026-2781 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2781 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2782 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442331 external
https://www.cve.org/CVERecord?id=CVE-2026-2782 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2782 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2783 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442300 external
https://www.cve.org/CVERecord?id=CVE-2026-2783 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2783 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2784 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442304 external
https://www.cve.org/CVERecord?id=CVE-2026-2784 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2784 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2785 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442284 external
https://www.cve.org/CVERecord?id=CVE-2026-2785 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2785 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2786 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442320 external
https://www.cve.org/CVERecord?id=CVE-2026-2786 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2786 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2787 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442297 external
https://www.cve.org/CVERecord?id=CVE-2026-2787 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2787 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2788 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442302 external
https://www.cve.org/CVERecord?id=CVE-2026-2788 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2788 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2789 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442322 external
https://www.cve.org/CVERecord?id=CVE-2026-2789 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2789 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2790 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442313 external
https://www.cve.org/CVERecord?id=CVE-2026-2790 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2790 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2791 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442342 external
https://www.cve.org/CVERecord?id=CVE-2026-2791 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2791 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2792 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442318 external
https://www.cve.org/CVERecord?id=CVE-2026-2792 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2792 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-2793 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442287 external
https://www.cve.org/CVERecord?id=CVE-2026-2793 external
https://nvd.nist.gov/vuln/detail/CVE-2026-2793 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for thunderbird is now available for Red Hat Enterprise Linux 10.0 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nSecurity Fix(es):\n\n* libvpx: Heap buffer overflow in libvpx (CVE-2026-2447)\n\n* firefox: Invalid pointer in the JavaScript Engine component (CVE-2026-2785)\n\n* firefox: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2793)\n\n* firefox: Undefined behavior in the DOM: Core \u0026 HTML component (CVE-2026-2771)\n\n* firefox: Integer overflow in the Audio/Video component (CVE-2026-2774)\n\n* firefox: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software (CVE-2026-2776)\n\n* firefox: Integer overflow in the Libraries component in NSS (CVE-2026-2781)\n\n* firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-2766)\n\n* firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-2769)\n\n* firefox: Use-after-free in the DOM: Window and Location component (CVE-2026-2787)\n\n* firefox: Sandbox escape in the Storage: IndexedDB component (CVE-2026-2768)\n\n* firefox: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-2783)\n\n* firefox: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-2788)\n\n* firefox: Mitigation bypass in the DOM: Security component (CVE-2026-2784)\n\n* firefox: Incorrect boundary conditions in the Graphics: ImageLib component (CVE-2026-2759)\n\n* firefox: Integer overflow in the JavaScript: Standard Library component (CVE-2026-2762)\n\n* firefox: Sandbox escape in the Graphics: WebRender component (CVE-2026-2761)\n\n* firefox: Privilege escalation in the Messaging System component (CVE-2026-2777)\n\n* firefox: Same-origin policy bypass in the Networking: JAR component (CVE-2026-2790)\n\n* firefox: Mitigation bypass in the DOM: HTML Parser component (CVE-2026-2775)\n\n* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2763)\n\n* firefox: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2792)\n\n* firefox: Incorrect boundary conditions in the Web Audio component (CVE-2026-2773)\n\n* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2786)\n\n* firefox: Use-after-free in the Graphics: ImageLib component (CVE-2026-2789)\n\n* firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Audio/Video component (CVE-2026-2757)\n\n* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-2760)\n\n* firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-2772)\n\n* firefox: Incorrect boundary conditions in the Networking: JAR component (CVE-2026-2779)\n\n* firefox: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-2767)\n\n* firefox: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component (CVE-2026-2764)\n\n* firefox: Privilege escalation in the Netmonitor component (CVE-2026-2782)\n\n* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2765)\n\n* firefox: Privilege escalation in the Netmonitor component (CVE-2026-2780)\n\n* firefox: Sandbox escape due to incorrect boundary conditions in the DOM: Core \u0026 HTML component (CVE-2026-2778)\n\n* firefox: Use-after-free in the JavaScript: GC component (CVE-2026-2758)\n\n* firefox: Mitigation bypass in the Networking: Cache component (CVE-2026-2791)\n\n* firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-2770)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:4260",
        "url": "https://access.redhat.com/errata/RHSA-2026:4260"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2440219",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440219"
      },
      {
        "category": "external",
        "summary": "2442284",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442284"
      },
      {
        "category": "external",
        "summary": "2442287",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442287"
      },
      {
        "category": "external",
        "summary": "2442288",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442288"
      },
      {
        "category": "external",
        "summary": "2442290",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442290"
      },
      {
        "category": "external",
        "summary": "2442291",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442291"
      },
      {
        "category": "external",
        "summary": "2442292",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442292"
      },
      {
        "category": "external",
        "summary": "2442294",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442294"
      },
      {
        "category": "external",
        "summary": "2442295",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442295"
      },
      {
        "category": "external",
        "summary": "2442297",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442297"
      },
      {
        "category": "external",
        "summary": "2442298",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442298"
      },
      {
        "category": "external",
        "summary": "2442300",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442300"
      },
      {
        "category": "external",
        "summary": "2442302",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442302"
      },
      {
        "category": "external",
        "summary": "2442304",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442304"
      },
      {
        "category": "external",
        "summary": "2442307",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442307"
      },
      {
        "category": "external",
        "summary": "2442308",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442308"
      },
      {
        "category": "external",
        "summary": "2442309",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442309"
      },
      {
        "category": "external",
        "summary": "2442312",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442312"
      },
      {
        "category": "external",
        "summary": "2442313",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442313"
      },
      {
        "category": "external",
        "summary": "2442314",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442314"
      },
      {
        "category": "external",
        "summary": "2442316",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442316"
      },
      {
        "category": "external",
        "summary": "2442318",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442318"
      },
      {
        "category": "external",
        "summary": "2442319",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442319"
      },
      {
        "category": "external",
        "summary": "2442320",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442320"
      },
      {
        "category": "external",
        "summary": "2442322",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442322"
      },
      {
        "category": "external",
        "summary": "2442324",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442324"
      },
      {
        "category": "external",
        "summary": "2442325",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442325"
      },
      {
        "category": "external",
        "summary": "2442326",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442326"
      },
      {
        "category": "external",
        "summary": "2442327",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442327"
      },
      {
        "category": "external",
        "summary": "2442328",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442328"
      },
      {
        "category": "external",
        "summary": "2442329",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442329"
      },
      {
        "category": "external",
        "summary": "2442331",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442331"
      },
      {
        "category": "external",
        "summary": "2442333",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442333"
      },
      {
        "category": "external",
        "summary": "2442334",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442334"
      },
      {
        "category": "external",
        "summary": "2442335",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442335"
      },
      {
        "category": "external",
        "summary": "2442337",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442337"
      },
      {
        "category": "external",
        "summary": "2442342",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442342"
      },
      {
        "category": "external",
        "summary": "2442343",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442343"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4260.json"
      }
    ],
    "title": "Red Hat Security Advisory: thunderbird security update",
    "tracking": {
      "current_release_date": "2026-03-23T13:12:13+00:00",
      "generator": {
        "date": "2026-03-23T13:12:13+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.3"
        }
      },
      "id": "RHSA-2026:4260",
      "initial_release_date": "2026-03-11T05:56:46+00:00",
      "revision_history": [
        {
          "date": "2026-03-11T05:56:46+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-03-11T05:56:46+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-03-23T13:12:13+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
                  "product_id": "AppStream-10.0.Z.E2S",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux_eus:10.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "thunderbird-0:140.8.0-2.el10_0.src",
                "product": {
                  "name": "thunderbird-0:140.8.0-2.el10_0.src",
                  "product_id": "thunderbird-0:140.8.0-2.el10_0.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird@140.8.0-2.el10_0?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "thunderbird-0:140.8.0-2.el10_0.aarch64",
                "product": {
                  "name": "thunderbird-0:140.8.0-2.el10_0.aarch64",
                  "product_id": "thunderbird-0:140.8.0-2.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird@140.8.0-2.el10_0?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
                "product": {
                  "name": "thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
                  "product_id": "thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debugsource@140.8.0-2.el10_0?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
                "product": {
                  "name": "thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
                  "product_id": "thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.8.0-2.el10_0?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "thunderbird-0:140.8.0-2.el10_0.ppc64le",
                "product": {
                  "name": "thunderbird-0:140.8.0-2.el10_0.ppc64le",
                  "product_id": "thunderbird-0:140.8.0-2.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird@140.8.0-2.el10_0?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
                "product": {
                  "name": "thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
                  "product_id": "thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debugsource@140.8.0-2.el10_0?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
                "product": {
                  "name": "thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
                  "product_id": "thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.8.0-2.el10_0?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "thunderbird-0:140.8.0-2.el10_0.s390x",
                "product": {
                  "name": "thunderbird-0:140.8.0-2.el10_0.s390x",
                  "product_id": "thunderbird-0:140.8.0-2.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird@140.8.0-2.el10_0?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
                "product": {
                  "name": "thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
                  "product_id": "thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debugsource@140.8.0-2.el10_0?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
                "product": {
                  "name": "thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
                  "product_id": "thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.8.0-2.el10_0?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "thunderbird-0:140.8.0-2.el10_0.x86_64",
                "product": {
                  "name": "thunderbird-0:140.8.0-2.el10_0.x86_64",
                  "product_id": "thunderbird-0:140.8.0-2.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird@140.8.0-2.el10_0?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64",
                "product": {
                  "name": "thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64",
                  "product_id": "thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debugsource@140.8.0-2.el10_0?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
                "product": {
                  "name": "thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
                  "product_id": "thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.8.0-2.el10_0?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-0:140.8.0-2.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64"
        },
        "product_reference": "thunderbird-0:140.8.0-2.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-0:140.8.0-2.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le"
        },
        "product_reference": "thunderbird-0:140.8.0-2.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-0:140.8.0-2.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x"
        },
        "product_reference": "thunderbird-0:140.8.0-2.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-0:140.8.0-2.el10_0.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src"
        },
        "product_reference": "thunderbird-0:140.8.0-2.el10_0.src",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-0:140.8.0-2.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64"
        },
        "product_reference": "thunderbird-0:140.8.0-2.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64"
        },
        "product_reference": "thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le"
        },
        "product_reference": "thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x"
        },
        "product_reference": "thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64"
        },
        "product_reference": "thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64"
        },
        "product_reference": "thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le"
        },
        "product_reference": "thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debugsource-0:140.8.0-2.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x"
        },
        "product_reference": "thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        },
        "product_reference": "thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-2447",
      "discovery_date": "2026-02-16T15:01:25.122593+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2440219"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue: Heap buffer overflow in libvpx.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libvpx: Heap buffer overflow in libvpx",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2447"
        },
        {
          "category": "external",
          "summary": "RHBZ#2440219",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440219"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2447",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2447"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2447",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2447"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014390",
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014390"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-10/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-10/"
        }
      ],
      "release_date": "2026-02-16T14:13:23.559000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libvpx: Heap buffer overflow in libvpx"
    },
    {
      "cve": "CVE-2026-2757",
      "discovery_date": "2026-02-24T14:04:32.278673+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442324"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions in the WebRTC: Audio/Video component.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Audio/Video component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2757"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442324",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442324"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2757",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2757"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2757",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2757"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2757",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2757"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2757",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2757"
        }
      ],
      "release_date": "2026-02-24T13:32:57.740000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Audio/Video component"
    },
    {
      "cve": "CVE-2026-2758",
      "discovery_date": "2026-02-24T14:05:22.802262+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the JavaScript: GC component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the JavaScript: GC component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2758"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2758",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2758"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2758",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2758"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2758",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2758"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2758",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2758"
        }
      ],
      "release_date": "2026-02-24T13:32:58.501000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the JavaScript: GC component"
    },
    {
      "cve": "CVE-2026-2759",
      "discovery_date": "2026-02-24T14:03:27.889599+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442307"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions in the Graphics: ImageLib component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Incorrect boundary conditions in the Graphics: ImageLib component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2759"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442307",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442307"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2759",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2759"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2759",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2759"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2759",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2759"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2759",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2759"
        }
      ],
      "release_date": "2026-02-24T13:32:59.173000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Incorrect boundary conditions in the Graphics: ImageLib component"
    },
    {
      "cve": "CVE-2026-2760",
      "discovery_date": "2026-02-24T14:04:36.459457+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442325"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape due to incorrect boundary conditions in the Graphics: WebRender component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2760"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442325",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442325"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2760",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2760"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2760",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2760"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2760",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2760"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2760",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2760"
        }
      ],
      "release_date": "2026-02-24T13:33:00.290000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component"
    },
    {
      "cve": "CVE-2026-2761",
      "discovery_date": "2026-02-24T14:03:35.826713+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442309"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape in the Graphics: WebRender component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Sandbox escape in the Graphics: WebRender component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2761"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442309",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442309"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2761",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2761"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2761",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2761"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2761",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2761"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2761",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2761"
        }
      ],
      "release_date": "2026-02-24T13:33:01.011000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Sandbox escape in the Graphics: WebRender component"
    },
    {
      "cve": "CVE-2026-2762",
      "discovery_date": "2026-02-24T14:03:31.898124+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442308"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInteger overflow in the JavaScript: Standard Library component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Integer overflow in the JavaScript: Standard Library component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2762"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442308",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442308"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2762",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2762"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2762",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2762"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2762",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2762"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2762",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2762"
        }
      ],
      "release_date": "2026-02-24T13:33:01.761000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Integer overflow in the JavaScript: Standard Library component"
    },
    {
      "cve": "CVE-2026-2763",
      "discovery_date": "2026-02-24T14:04:02.163309+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442316"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the JavaScript Engine component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the JavaScript Engine component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2763"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442316",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442316"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2763",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2763"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2763",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2763"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2763",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2763"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2763",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2763"
        }
      ],
      "release_date": "2026-02-24T13:33:02.514000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the JavaScript Engine component"
    },
    {
      "cve": "CVE-2026-2764",
      "discovery_date": "2026-02-24T14:04:49.869783+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442329"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nJIT miscompilation, use-after-free in the JavaScript Engine: JIT component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2764"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442329",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442329"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2764",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2764"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2764",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2764"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2764",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2764"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2764",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2764"
        }
      ],
      "release_date": "2026-02-24T13:33:03.207000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component"
    },
    {
      "cve": "CVE-2026-2765",
      "discovery_date": "2026-02-24T14:05:05.206703+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442333"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the JavaScript Engine component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the JavaScript Engine component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2765"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442333",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442333"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2765",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2765"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2765",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2765"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2765",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2765"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2765",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2765"
        }
      ],
      "release_date": "2026-02-24T13:33:03.943000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the JavaScript Engine component"
    },
    {
      "cve": "CVE-2026-2766",
      "discovery_date": "2026-02-24T14:02:36.100117+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442294"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the JavaScript Engine: JIT component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2766"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442294",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442294"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2766",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2766"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2766",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2766"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2766",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2766"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2766",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2766"
        }
      ],
      "release_date": "2026-02-24T13:33:04.946000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component"
    },
    {
      "cve": "CVE-2026-2767",
      "discovery_date": "2026-02-24T14:04:46.666135+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442328"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the JavaScript: WebAssembly component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2767"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442328",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442328"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2767",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2767"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2767",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2767"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2767",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2767"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2767",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2767"
        }
      ],
      "release_date": "2026-02-24T13:33:05.551000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component"
    },
    {
      "cve": "CVE-2026-2768",
      "discovery_date": "2026-02-24T14:02:52.794335+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442298"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape in the Storage: IndexedDB component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Sandbox escape in the Storage: IndexedDB component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2768"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442298",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442298"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2768",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2768"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2768",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2768"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2768",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2768"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2768",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2768"
        }
      ],
      "release_date": "2026-02-24T13:33:06.258000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Sandbox escape in the Storage: IndexedDB component"
    },
    {
      "cve": "CVE-2026-2769",
      "discovery_date": "2026-02-24T14:02:40.379633+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442295"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the Storage: IndexedDB component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the Storage: IndexedDB component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2769"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442295",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442295"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2769",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2769"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2769",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2769"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2769",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2769"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2769",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2769"
        }
      ],
      "release_date": "2026-02-24T13:33:06.912000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the Storage: IndexedDB component"
    },
    {
      "cve": "CVE-2026-2770",
      "discovery_date": "2026-02-24T14:05:45.874927+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442343"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the DOM: Bindings (WebIDL) component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the DOM: Bindings (WebIDL) component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2770"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442343",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442343"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2770",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2770"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2770",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2770"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2770",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2770"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2770",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2770"
        }
      ],
      "release_date": "2026-02-24T13:33:07.898000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the DOM: Bindings (WebIDL) component"
    },
    {
      "cve": "CVE-2026-2771",
      "discovery_date": "2026-02-24T14:02:11.872751+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442288"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUndefined behavior in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Undefined behavior in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2771"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442288",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442288"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2771",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2771"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2771",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2771"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2771",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2771"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2771",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2771"
        }
      ],
      "release_date": "2026-02-24T13:33:08.538000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Undefined behavior in the DOM: Core \u0026 HTML component"
    },
    {
      "cve": "CVE-2026-2772",
      "discovery_date": "2026-02-24T14:04:39.874629+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442326"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the Audio/Video: Playback component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the Audio/Video: Playback component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2772"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442326",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442326"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2772",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2772"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2772",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2772"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2772",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2772"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2772",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2772"
        }
      ],
      "release_date": "2026-02-24T13:33:09.181000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the Audio/Video: Playback component"
    },
    {
      "cve": "CVE-2026-2773",
      "discovery_date": "2026-02-24T14:04:12.678133+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442319"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions in the Web Audio component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Incorrect boundary conditions in the Web Audio component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2773"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442319",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442319"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2773",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2773"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2773",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2773"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2773",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2773"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2773",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2773"
        }
      ],
      "release_date": "2026-02-24T13:33:10.177000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Incorrect boundary conditions in the Web Audio component"
    },
    {
      "cve": "CVE-2026-2774",
      "discovery_date": "2026-02-24T14:02:20.295941+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442290"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInteger overflow in the Audio/Video component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Integer overflow in the Audio/Video component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2774"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442290",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442290"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2774",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2774"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2774",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2774"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2774",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2774"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2774",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2774"
        }
      ],
      "release_date": "2026-02-24T13:33:10.821000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Integer overflow in the Audio/Video component"
    },
    {
      "cve": "CVE-2026-2775",
      "discovery_date": "2026-02-24T14:03:55.469010+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442314"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMitigation bypass in the DOM: HTML Parser component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Mitigation bypass in the DOM: HTML Parser component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2775"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442314",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442314"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2775",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2775"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2775",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2775"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2775",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2775"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2775",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2775"
        }
      ],
      "release_date": "2026-02-24T13:33:11.553000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Mitigation bypass in the DOM: HTML Parser component"
    },
    {
      "cve": "CVE-2026-2776",
      "discovery_date": "2026-02-24T14:02:24.297740+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442291"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape due to incorrect boundary conditions in the Telemetry component in External Software",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2776"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442291",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442291"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2776",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2776"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2776",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2776"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2776",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2776"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2776",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2776"
        }
      ],
      "release_date": "2026-02-24T13:33:12.247000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software"
    },
    {
      "cve": "CVE-2026-2777",
      "discovery_date": "2026-02-24T14:03:46.784901+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442312"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the Messaging System component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation in the Messaging System component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2777"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442312",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442312"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2777",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2777"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2777",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2777"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2777",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2777"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2777",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2777"
        }
      ],
      "release_date": "2026-02-24T13:33:12.869000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation in the Messaging System component"
    },
    {
      "cve": "CVE-2026-2778",
      "discovery_date": "2026-02-24T14:05:18.491728+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442335"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape due to incorrect boundary conditions in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2778"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442335",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442335"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2778",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2778"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2778",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2778"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2778",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2778"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2778",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2778"
        }
      ],
      "release_date": "2026-02-24T13:33:13.564000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the DOM: Core \u0026 HTML component"
    },
    {
      "cve": "CVE-2026-2779",
      "discovery_date": "2026-02-24T14:04:43.211189+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442327"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions in the Networking: JAR component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Incorrect boundary conditions in the Networking: JAR component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2779"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442327",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442327"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2779",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2779"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2779",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2779"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2779",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2779"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2779",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2779"
        }
      ],
      "release_date": "2026-02-24T13:33:14.195000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Incorrect boundary conditions in the Networking: JAR component"
    },
    {
      "cve": "CVE-2026-2780",
      "discovery_date": "2026-02-24T14:05:09.476986+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442334"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the Netmonitor component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation in the Netmonitor component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2780"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442334",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442334"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2780",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2780"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2780",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2780"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2780",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2780"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2780",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2780"
        }
      ],
      "release_date": "2026-02-24T13:33:14.850000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation in the Netmonitor component"
    },
    {
      "cve": "CVE-2026-2781",
      "discovery_date": "2026-02-24T14:02:28.397688+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442292"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInteger overflow in the Libraries component in NSS",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Integer overflow in the Libraries component in NSS",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2781"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442292",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442292"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2781",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2781"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2781",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2781"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2781",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2781"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2781",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2781"
        }
      ],
      "release_date": "2026-02-24T13:33:15.551000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Integer overflow in the Libraries component in NSS"
    },
    {
      "cve": "CVE-2026-2782",
      "discovery_date": "2026-02-24T14:04:57.300999+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442331"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the Netmonitor component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation in the Netmonitor component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2782"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442331",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442331"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2782",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2782"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2782",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2782"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2782",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2782"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2782",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2782"
        }
      ],
      "release_date": "2026-02-24T13:33:16.262000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation in the Netmonitor component"
    },
    {
      "cve": "CVE-2026-2783",
      "discovery_date": "2026-02-24T14:03:00.481746+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442300"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInformation disclosure due to JIT miscompilation in the JavaScript Engine: JIT component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2783"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442300",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442300"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2783",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2783"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2783",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2783"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2783",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2783"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2783",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2783"
        }
      ],
      "release_date": "2026-02-24T13:33:16.921000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component"
    },
    {
      "cve": "CVE-2026-2784",
      "discovery_date": "2026-02-24T14:03:16.995878+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442304"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMitigation bypass in the DOM: Security component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Mitigation bypass in the DOM: Security component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2784"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442304",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442304"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2784",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2784"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2784",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2784"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2784",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2784"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2784",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2784"
        }
      ],
      "release_date": "2026-02-24T13:33:17.554000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Mitigation bypass in the DOM: Security component"
    },
    {
      "cve": "CVE-2026-2785",
      "discovery_date": "2026-02-24T14:01:55.995805+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442284"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInvalid pointer in the JavaScript Engine component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Invalid pointer in the JavaScript Engine component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2785"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442284",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442284"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2785",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2785"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2785",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2785"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2785",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2785"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2785",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2785"
        }
      ],
      "release_date": "2026-02-24T13:33:18.254000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Invalid pointer in the JavaScript Engine component"
    },
    {
      "cve": "CVE-2026-2786",
      "discovery_date": "2026-02-24T14:04:16.873943+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442320"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the JavaScript Engine component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the JavaScript Engine component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2786"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442320",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442320"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2786",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2786"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2786",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2786"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2786",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2786"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2786",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2786"
        }
      ],
      "release_date": "2026-02-24T13:33:18.980000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the JavaScript Engine component"
    },
    {
      "cve": "CVE-2026-2787",
      "discovery_date": "2026-02-24T14:02:48.190817+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442297"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the DOM: Window and Location component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the DOM: Window and Location component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2787"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442297",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442297"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2787",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2787"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2787",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2787"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2787",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2787"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2787",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2787"
        }
      ],
      "release_date": "2026-02-24T13:33:19.579000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the DOM: Window and Location component"
    },
    {
      "cve": "CVE-2026-2788",
      "discovery_date": "2026-02-24T14:03:09.383024+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442302"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions in the Audio/Video: GMP component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2788"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442302",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442302"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2788",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2788"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2788",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2788"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2788",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2788"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2788",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2788"
        }
      ],
      "release_date": "2026-02-24T13:33:20.287000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component"
    },
    {
      "cve": "CVE-2026-2789",
      "discovery_date": "2026-02-24T14:04:24.090704+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442322"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the Graphics: ImageLib component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the Graphics: ImageLib component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2789"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442322",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442322"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2789",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2789"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2789",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2789"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2789",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2789"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2789",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2789"
        }
      ],
      "release_date": "2026-02-24T13:33:20.961000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the Graphics: ImageLib component"
    },
    {
      "cve": "CVE-2026-2790",
      "discovery_date": "2026-02-24T14:03:51.798753+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442313"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSame-origin policy bypass in the Networking: JAR component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Same-origin policy bypass in the Networking: JAR component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2790"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442313",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442313"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2790",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2790"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2790",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2790"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2790",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2790"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2790",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2790"
        }
      ],
      "release_date": "2026-02-24T13:33:21.600000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.4,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "firefox: thunderbird: Same-origin policy bypass in the Networking: JAR component"
    },
    {
      "cve": "CVE-2026-2791",
      "discovery_date": "2026-02-24T14:05:40.978072+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442342"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMitigation bypass in the Networking: Cache component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Mitigation bypass in the Networking: Cache component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2791"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442342",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442342"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2791",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2791"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2791",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2791"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2791",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2791"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2791",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2791"
        }
      ],
      "release_date": "2026-02-24T13:33:22.237000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.4,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "firefox: thunderbird: Mitigation bypass in the Networking: Cache component"
    },
    {
      "cve": "CVE-2026-2792",
      "discovery_date": "2026-02-24T14:04:09.479081+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442318"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2792"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442318",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442318"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2792",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2792"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2792",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2792"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2792",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2792"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2792",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2792"
        }
      ],
      "release_date": "2026-02-24T13:33:22.842000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148"
    },
    {
      "cve": "CVE-2026-2793",
      "discovery_date": "2026-02-24T14:02:07.299540+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442287"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
          "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
          "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2793"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442287",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442287"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2793",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2793"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2793",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2793"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2793",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/#CVE-2026-2793"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2793",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/#CVE-2026-2793"
        }
      ],
      "release_date": "2026-02-24T13:33:23.571000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-11T05:56:46+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:4260"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.src",
            "AppStream-10.0.Z.E2S:thunderbird-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debuginfo-0:140.8.0-2.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.s390x",
            "AppStream-10.0.Z.E2S:thunderbird-debugsource-0:140.8.0-2.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.