RHSA-2026:70642

Vulnerability from csaf_redhat - Published: 2026-09-24 02:21 - Updated: 2026-09-24 18:16
Summary
Red Hat Security Advisory: thunderbird security update
Severity
Important
Notes
Topic: An update for thunderbird is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365) * firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874) * firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121) * firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145) * firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119) * firefox: Use-after-free in the Audio/Video component (CVE-2026-84120) * firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124) * firefox: Use-after-free in the Audio/Video component (CVE-2026-84122) * firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143) * thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639) * thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641) * thunderbird: One byte overflow read in mail parser (CVE-2026-84640) * firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024) * firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019) * firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026) * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031) * firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011) * firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028) * firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013) * firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012) * firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014) * firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018) * firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021) * firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005) * firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008) * firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92007) * firefox: thunderbird: Use-after-free in the DOM: Navigation component (CVE-2026-92025) * firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92029) * firefox: thunderbird: Use-after-free in the XML component (CVE-2026-92023) * thunderbird: Out-of-bounds read in IMAP response parser (CVE-2026-92240) * thunderbird: Thunderbird: Out-of-bounds read via maliciously constructed IMAP line (CVE-2026-92239) * thunderbird: Thunderbird: Memory safety violations via maliciously crafted mail headers (CVE-2026-92238) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-16365

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Workers component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-266 - Incorrect Privilege Assignment
Affected products
Product Identifier Version Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64 —
Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le —
Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x —
Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src —
Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64 —
Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64 —
Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le —
Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x —
Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64 —
Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64 —
Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le —
Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x —
Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64 —
Vendor Fix fix
Threats
Impact Important
CVE-2026-75874

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the Remote Settings Client component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-653 - Improper Isolation or Compartmentalization
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-84119

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Navigation component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-84120

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Audio/Video component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-84121

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Security component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-84122

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Audio/Video component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-84124

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-84131

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to invalid pointer in the Graphics component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Moderate
CVE-2026-84143

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Internally found bugs present in Firefox 154, Firefox ESR 153.1 and Firefox ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited.

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-84145

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Internally found bugs present in Firefox 154, Firefox ESR 153.1, Firefox ESR 140.14 and Firefox ESR 115.39. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited.

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-84639

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used.

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-824 - Access of Uninitialized Pointer
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-84640

A flaw was found in Thunderbird. A remote attacker could exploit this vulnerability by sending a maliciously constructed mail header. This could lead to a one-byte read past the end of a buffer, potentially resulting in information disclosure or other unpredictable behavior.

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-125 - Out-of-bounds Read
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Moderate
CVE-2026-84641

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js.

3.4 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Low
CVE-2026-92005

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Audio/Video: Web Codecs component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92006

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-653 - Improper Isolation or Compartmentalization
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92007

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92008

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92009

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92010

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92011

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92012

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-266 - Incorrect Privilege Assignment
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92013

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92014

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to incorrect boundary conditions in the Graphics component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92015

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the WebExtensions component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-266 - Incorrect Privilege Assignment
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92016

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Disability Access APIs component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92017

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Service Workers component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-266 - Incorrect Privilege Assignment
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92018

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the DOM: Core & HTML component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-791 - Incomplete Filtering of Special Elements
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92019

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Remote Settings Client component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-807 - Reliance on Untrusted Inputs in a Security Decision
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92020

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92021

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine: JIT component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92022

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: HTML Parser component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92023

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XML component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92024

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the SVG component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92025

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Navigation component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92026

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Networking component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92027

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Streams component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92028

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92029

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the SVG component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Important
CVE-2026-92030

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-807 - Reliance on Untrusted Inputs in a Security Decision
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Moderate
CVE-2026-92031

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Graphics: ImageLib component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Moderate
CVE-2026-92032

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to invalid pointer in the Graphics component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Moderate
CVE-2026-92238

A flaw was found in Thunderbird where a maliciously constructed mail header could lead to ambiguous parsing. This vulnerability could result in multiple mail header fields being incorrectly interpreted as one, or cause memory safety violations. A remote attacker could potentially exploit this to trigger unexpected application behavior or a denial of service.

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Moderate
CVE-2026-92239

A flaw was found in Thunderbird. A remote attacker could exploit this vulnerability by sending a maliciously constructed Internet Message Access Protocol (IMAP) line. This could lead to an out-of-bounds buffer read, potentially resulting in information disclosure or a denial of service.

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-125 - Out-of-bounds Read
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Moderate
CVE-2026-92240

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication.

3.4 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
CWE-125 - Out-of-bounds Read
Affected products
Fixed 13 products, the same list as for CVE-2026-16365
Threats
Impact Low
References
URL Category
https://access.redhat.com/errata/RHSA-2026:70642 self
https://access.redhat.com/security/updates/classi… external
https://bugzilla.redhat.com/show_bug.cgi?id=2503504 external
https://bugzilla.redhat.com/show_bug.cgi?id=2517832 external
https://bugzilla.redhat.com/show_bug.cgi?id=2526753 external
https://bugzilla.redhat.com/show_bug.cgi?id=2526760 external
https://bugzilla.redhat.com/show_bug.cgi?id=2526764 external
https://bugzilla.redhat.com/show_bug.cgi?id=2526765 external
https://bugzilla.redhat.com/show_bug.cgi?id=2526767 external
https://bugzilla.redhat.com/show_bug.cgi?id=2526778 external
https://bugzilla.redhat.com/show_bug.cgi?id=2526781 external
https://bugzilla.redhat.com/show_bug.cgi?id=2527113 external
https://bugzilla.redhat.com/show_bug.cgi?id=2527115 external
https://bugzilla.redhat.com/show_bug.cgi?id=2527116 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533737 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533740 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533741 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533742 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533743 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533747 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533751 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533753 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533757 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533758 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533760 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533762 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533764 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533769 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533770 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533771 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533773 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533774 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533778 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533779 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533781 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533786 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533790 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533791 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533792 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533793 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533797 external
https://bugzilla.redhat.com/show_bug.cgi?id=2533799 external
https://bugzilla.redhat.com/show_bug.cgi?id=2534187 external
https://bugzilla.redhat.com/show_bug.cgi?id=2534197 external
https://bugzilla.redhat.com/show_bug.cgi?id=2534199 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-16365 self
https://bugzilla.redhat.com/show_bug.cgi?id=2503504 external
https://www.cve.org/CVERecord?id=CVE-2026-16365 external
https://nvd.nist.gov/vuln/detail/CVE-2026-16365 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-75874 self
https://bugzilla.redhat.com/show_bug.cgi?id=2517832 external
https://www.cve.org/CVERecord?id=CVE-2026-75874 external
https://nvd.nist.gov/vuln/detail/CVE-2026-75874 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-84119 self
https://bugzilla.redhat.com/show_bug.cgi?id=2526764 external
https://www.cve.org/CVERecord?id=CVE-2026-84119 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84119 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-84120 self
https://bugzilla.redhat.com/show_bug.cgi?id=2526765 external
https://www.cve.org/CVERecord?id=CVE-2026-84120 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84120 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-84121 self
https://bugzilla.redhat.com/show_bug.cgi?id=2526753 external
https://www.cve.org/CVERecord?id=CVE-2026-84121 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84121 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-84122 self
https://bugzilla.redhat.com/show_bug.cgi?id=2526778 external
https://www.cve.org/CVERecord?id=CVE-2026-84122 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84122 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-84124 self
https://bugzilla.redhat.com/show_bug.cgi?id=2526773 external
https://www.cve.org/CVERecord?id=CVE-2026-84124 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84124 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-84131 self
https://bugzilla.redhat.com/show_bug.cgi?id=2526767 external
https://www.cve.org/CVERecord?id=CVE-2026-84131 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84131 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-84143 self
https://bugzilla.redhat.com/show_bug.cgi?id=2526781 external
https://www.cve.org/CVERecord?id=CVE-2026-84143 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84143 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-84145 self
https://bugzilla.redhat.com/show_bug.cgi?id=2526760 external
https://www.cve.org/CVERecord?id=CVE-2026-84145 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84145 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-84639 self
https://bugzilla.redhat.com/show_bug.cgi?id=2527113 external
https://www.cve.org/CVERecord?id=CVE-2026-84639 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84639 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-84640 self
https://bugzilla.redhat.com/show_bug.cgi?id=2527116 external
https://www.cve.org/CVERecord?id=CVE-2026-84640 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84640 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-84641 self
https://bugzilla.redhat.com/show_bug.cgi?id=2527115 external
https://www.cve.org/CVERecord?id=CVE-2026-84641 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84641 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92005 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533778 external
https://www.cve.org/CVERecord?id=CVE-2026-92005 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92005 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92006 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533751 external
https://www.cve.org/CVERecord?id=CVE-2026-92006 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92006 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92007 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533792 external
https://www.cve.org/CVERecord?id=CVE-2026-92007 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92007 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92008 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533790 external
https://www.cve.org/CVERecord?id=CVE-2026-92008 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92008 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92009 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533781 external
https://www.cve.org/CVERecord?id=CVE-2026-92009 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92009 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92010 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533747 external
https://www.cve.org/CVERecord?id=CVE-2026-92010 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92010 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92011 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533753 external
https://www.cve.org/CVERecord?id=CVE-2026-92011 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92011 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92012 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533769 external
https://www.cve.org/CVERecord?id=CVE-2026-92012 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92012 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92013 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533762 external
https://www.cve.org/CVERecord?id=CVE-2026-92013 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92013 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92014 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533771 external
https://www.cve.org/CVERecord?id=CVE-2026-92014 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92014 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92015 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533760 external
https://www.cve.org/CVERecord?id=CVE-2026-92015 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92015 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92016 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533764 external
https://www.cve.org/CVERecord?id=CVE-2026-92016 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92016 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92017 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533779 external
https://www.cve.org/CVERecord?id=CVE-2026-92017 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92017 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92018 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533773 external
https://www.cve.org/CVERecord?id=CVE-2026-92018 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92018 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92019 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533740 external
https://www.cve.org/CVERecord?id=CVE-2026-92019 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92019 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92020 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533786 external
https://www.cve.org/CVERecord?id=CVE-2026-92020 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92020 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92021 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533774 external
https://www.cve.org/CVERecord?id=CVE-2026-92021 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92021 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92022 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533770 external
https://www.cve.org/CVERecord?id=CVE-2026-92022 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92022 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92023 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533799 external
https://www.cve.org/CVERecord?id=CVE-2026-92023 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92023 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92024 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533737 external
https://www.cve.org/CVERecord?id=CVE-2026-92024 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92024 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92025 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533793 external
https://www.cve.org/CVERecord?id=CVE-2026-92025 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92025 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92026 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533741 external
https://www.cve.org/CVERecord?id=CVE-2026-92026 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92026 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92027 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533757 external
https://www.cve.org/CVERecord?id=CVE-2026-92027 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92027 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92028 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533758 external
https://www.cve.org/CVERecord?id=CVE-2026-92028 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92028 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92029 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533797 external
https://www.cve.org/CVERecord?id=CVE-2026-92029 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92029 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92030 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533791 external
https://www.cve.org/CVERecord?id=CVE-2026-92030 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92030 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92031 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533742 external
https://www.cve.org/CVERecord?id=CVE-2026-92031 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92031 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92032 self
https://bugzilla.redhat.com/show_bug.cgi?id=2533743 external
https://www.cve.org/CVERecord?id=CVE-2026-92032 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92032 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92238 self
https://bugzilla.redhat.com/show_bug.cgi?id=2534199 external
https://www.cve.org/CVERecord?id=CVE-2026-92238 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92238 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92239 self
https://bugzilla.redhat.com/show_bug.cgi?id=2534197 external
https://www.cve.org/CVERecord?id=CVE-2026-92239 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92239 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-92240 self
https://bugzilla.redhat.com/show_bug.cgi?id=2534187 external
https://www.cve.org/CVERecord?id=CVE-2026-92240 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92240 external
https://www.mozilla.org/security/advisories/mfsa2… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for thunderbird is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nSecurity Fix(es):\n\n* firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)\n\n* firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)\n\n* firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)\n\n* firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)\n\n* firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)\n\n* firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)\n\n* firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)\n\n* firefox: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-84124)\n\n* firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)\n\n* firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)\n\n* thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)\n\n* thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)\n\n* thunderbird: One byte overflow read in mail parser (CVE-2026-84640)\n\n* firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)\n\n* firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)\n\n* firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)\n\n* firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)\n\n* firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)\n\n* firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)\n\n* firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-92028)\n\n* firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)\n\n* firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)\n\n* firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)\n\n* firefox: thunderbird: Sandbox escape in the DOM: Core \u0026 HTML component (CVE-2026-92018)\n\n* firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)\n\n* firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)\n\n* firefox: thunderbird: Mitigation bypass in the DOM: Copy \u0026 Paste and Drag \u0026 Drop component (CVE-2026-92030)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92007)\n\n* firefox: thunderbird: Use-after-free in the DOM: Navigation component (CVE-2026-92025)\n\n* firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92029)\n\n* firefox: thunderbird: Use-after-free in the XML component (CVE-2026-92023)\n\n* thunderbird: Out-of-bounds read in IMAP response parser (CVE-2026-92240)\n\n* thunderbird: Thunderbird: Out-of-bounds read via maliciously constructed IMAP line (CVE-2026-92239)\n\n* thunderbird: Thunderbird: Memory safety violations via maliciously crafted mail headers (CVE-2026-92238)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:70642",
        "url": "https://access.redhat.com/errata/RHSA-2026:70642"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2503504",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503504"
      },
      {
        "category": "external",
        "summary": "2517832",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517832"
      },
      {
        "category": "external",
        "summary": "2526753",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526753"
      },
      {
        "category": "external",
        "summary": "2526760",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526760"
      },
      {
        "category": "external",
        "summary": "2526764",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526764"
      },
      {
        "category": "external",
        "summary": "2526765",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526765"
      },
      {
        "category": "external",
        "summary": "2526767",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526767"
      },
      {
        "category": "external",
        "summary": "2526778",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526778"
      },
      {
        "category": "external",
        "summary": "2526781",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526781"
      },
      {
        "category": "external",
        "summary": "2527113",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527113"
      },
      {
        "category": "external",
        "summary": "2527115",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527115"
      },
      {
        "category": "external",
        "summary": "2527116",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527116"
      },
      {
        "category": "external",
        "summary": "2533737",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533737"
      },
      {
        "category": "external",
        "summary": "2533740",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533740"
      },
      {
        "category": "external",
        "summary": "2533741",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533741"
      },
      {
        "category": "external",
        "summary": "2533742",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533742"
      },
      {
        "category": "external",
        "summary": "2533743",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533743"
      },
      {
        "category": "external",
        "summary": "2533747",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533747"
      },
      {
        "category": "external",
        "summary": "2533751",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533751"
      },
      {
        "category": "external",
        "summary": "2533753",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533753"
      },
      {
        "category": "external",
        "summary": "2533757",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533757"
      },
      {
        "category": "external",
        "summary": "2533758",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533758"
      },
      {
        "category": "external",
        "summary": "2533760",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533760"
      },
      {
        "category": "external",
        "summary": "2533762",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533762"
      },
      {
        "category": "external",
        "summary": "2533764",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533764"
      },
      {
        "category": "external",
        "summary": "2533769",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533769"
      },
      {
        "category": "external",
        "summary": "2533770",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533770"
      },
      {
        "category": "external",
        "summary": "2533771",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533771"
      },
      {
        "category": "external",
        "summary": "2533773",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533773"
      },
      {
        "category": "external",
        "summary": "2533774",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533774"
      },
      {
        "category": "external",
        "summary": "2533778",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533778"
      },
      {
        "category": "external",
        "summary": "2533779",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533779"
      },
      {
        "category": "external",
        "summary": "2533781",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533781"
      },
      {
        "category": "external",
        "summary": "2533786",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533786"
      },
      {
        "category": "external",
        "summary": "2533790",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533790"
      },
      {
        "category": "external",
        "summary": "2533791",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533791"
      },
      {
        "category": "external",
        "summary": "2533792",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533792"
      },
      {
        "category": "external",
        "summary": "2533793",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533793"
      },
      {
        "category": "external",
        "summary": "2533797",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533797"
      },
      {
        "category": "external",
        "summary": "2533799",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533799"
      },
      {
        "category": "external",
        "summary": "2534187",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2534187"
      },
      {
        "category": "external",
        "summary": "2534197",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2534197"
      },
      {
        "category": "external",
        "summary": "2534199",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2534199"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70642.json"
      }
    ],
    "title": "Red Hat Security Advisory: thunderbird security update",
    "tracking": {
      "current_release_date": "2026-09-24T18:16:58+00:00",
      "generator": {
        "date": "2026-09-24T18:16:58+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:70642",
      "initial_release_date": "2026-09-24T02:21:38+00:00",
      "revision_history": [
        {
          "date": "2026-09-24T02:21:38+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-24T02:21:38+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-24T18:16:58+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.8.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "thunderbird-0:140.16.0-1.el9_8.src",
                "product": {
                  "name": "thunderbird-0:140.16.0-1.el9_8.src",
                  "product_id": "thunderbird-0:140.16.0-1.el9_8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird@140.16.0-1.el9_8?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "thunderbird-0:140.16.0-1.el9_8.aarch64",
                "product": {
                  "name": "thunderbird-0:140.16.0-1.el9_8.aarch64",
                  "product_id": "thunderbird-0:140.16.0-1.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird@140.16.0-1.el9_8?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
                "product": {
                  "name": "thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
                  "product_id": "thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debugsource@140.16.0-1.el9_8?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
                "product": {
                  "name": "thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
                  "product_id": "thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.16.0-1.el9_8?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "thunderbird-0:140.16.0-1.el9_8.ppc64le",
                "product": {
                  "name": "thunderbird-0:140.16.0-1.el9_8.ppc64le",
                  "product_id": "thunderbird-0:140.16.0-1.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird@140.16.0-1.el9_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
                "product": {
                  "name": "thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
                  "product_id": "thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debugsource@140.16.0-1.el9_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
                "product": {
                  "name": "thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
                  "product_id": "thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.16.0-1.el9_8?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "thunderbird-0:140.16.0-1.el9_8.s390x",
                "product": {
                  "name": "thunderbird-0:140.16.0-1.el9_8.s390x",
                  "product_id": "thunderbird-0:140.16.0-1.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird@140.16.0-1.el9_8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
                "product": {
                  "name": "thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
                  "product_id": "thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debugsource@140.16.0-1.el9_8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
                "product": {
                  "name": "thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
                  "product_id": "thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.16.0-1.el9_8?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "thunderbird-0:140.16.0-1.el9_8.x86_64",
                "product": {
                  "name": "thunderbird-0:140.16.0-1.el9_8.x86_64",
                  "product_id": "thunderbird-0:140.16.0-1.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird@140.16.0-1.el9_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64",
                "product": {
                  "name": "thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64",
                  "product_id": "thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debugsource@140.16.0-1.el9_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
                "product": {
                  "name": "thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
                  "product_id": "thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.16.0-1.el9_8?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-0:140.16.0-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64"
        },
        "product_reference": "thunderbird-0:140.16.0-1.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-0:140.16.0-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le"
        },
        "product_reference": "thunderbird-0:140.16.0-1.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-0:140.16.0-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x"
        },
        "product_reference": "thunderbird-0:140.16.0-1.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-0:140.16.0-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src"
        },
        "product_reference": "thunderbird-0:140.16.0-1.el9_8.src",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-0:140.16.0-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64"
        },
        "product_reference": "thunderbird-0:140.16.0-1.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64"
        },
        "product_reference": "thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le"
        },
        "product_reference": "thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x"
        },
        "product_reference": "thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64"
        },
        "product_reference": "thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64"
        },
        "product_reference": "thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le"
        },
        "product_reference": "thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debugsource-0:140.16.0-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x"
        },
        "product_reference": "thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        },
        "product_reference": "thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-16365",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-07-21T13:04:26.479804+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503504"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the DOM: Workers component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation in the DOM: Workers component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16365"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503504",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503504"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16365",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16365"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16365",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16365"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-68/#CVE-2026-16365",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/#CVE-2026-16365"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-71/#CVE-2026-16365",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/#CVE-2026-16365"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-84/#CVE-2026-16365",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-84/#CVE-2026-16365"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-16365",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-16365"
        }
      ],
      "release_date": "2026-07-21T12:37:37.777000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation in the DOM: Workers component"
    },
    {
      "cve": "CVE-2026-75874",
      "cwe": {
        "id": "CWE-653",
        "name": "Improper Isolation or Compartmentalization"
      },
      "discovery_date": "2026-08-18T12:43:15.752857+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517832"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape in the Remote Settings Client component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Sandbox escape in the Remote Settings Client component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-75874"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517832",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517832"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-75874",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-75874"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75874",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75874"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-74/#CVE-2026-75874",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-74/#CVE-2026-75874"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-78/#CVE-2026-75874",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-78/#CVE-2026-75874"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-84/#CVE-2026-75874",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-84/#CVE-2026-75874"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-75874",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-75874"
        }
      ],
      "release_date": "2026-08-18T12:23:35.478000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Sandbox escape in the Remote Settings Client component"
    },
    {
      "cve": "CVE-2026-84119",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-01T12:43:28.620426+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2526764"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape due to use-after-free in the DOM: Navigation component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Sandbox escape due to use-after-free in the DOM: Navigation component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84119"
        },
        {
          "category": "external",
          "summary": "RHBZ#2526764",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526764"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84119",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84119"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84119",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84119"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-84/#CVE-2026-84119",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-84/#CVE-2026-84119"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84119",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84119"
        }
      ],
      "release_date": "2026-09-01T12:18:39.358000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: Sandbox escape due to use-after-free in the DOM: Navigation component"
    },
    {
      "cve": "CVE-2026-84120",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-01T12:43:14.575017+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2526765"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the Audio/Video component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Use-after-free in the Audio/Video component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84120"
        },
        {
          "category": "external",
          "summary": "RHBZ#2526765",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526765"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84120",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84120"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84120",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84120"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-84/#CVE-2026-84120",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-84/#CVE-2026-84120"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84120",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84120"
        }
      ],
      "release_date": "2026-09-01T12:18:40.455000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: Use-after-free in the Audio/Video component"
    },
    {
      "cve": "CVE-2026-84121",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-01T12:41:01.830919+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2526753"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape due to use-after-free in the DOM: Security component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Sandbox escape due to use-after-free in the DOM: Security component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84121"
        },
        {
          "category": "external",
          "summary": "RHBZ#2526753",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526753"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84121",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84121"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84121",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84121"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-84/#CVE-2026-84121",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-84/#CVE-2026-84121"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84121",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84121"
        }
      ],
      "release_date": "2026-09-01T12:18:41.535000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: Sandbox escape due to use-after-free in the DOM: Security component"
    },
    {
      "cve": "CVE-2026-84122",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-01T12:47:01.391072+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2526778"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the Audio/Video component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Use-after-free in the Audio/Video component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84122"
        },
        {
          "category": "external",
          "summary": "RHBZ#2526778",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526778"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84122",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84122"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84122",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84122"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-84/#CVE-2026-84122",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-84/#CVE-2026-84122"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84122",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84122"
        }
      ],
      "release_date": "2026-09-01T12:18:49.637000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: Use-after-free in the Audio/Video component"
    },
    {
      "cve": "CVE-2026-84124",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-01T12:45:22.505644+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2526773"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Use-after-free in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84124"
        },
        {
          "category": "external",
          "summary": "RHBZ#2526773",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526773"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84124",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84124"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84124",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84124"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-82/#CVE-2026-84124",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-82/#CVE-2026-84124"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-84/#CVE-2026-84124",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-84/#CVE-2026-84124"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84124",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84124"
        }
      ],
      "release_date": "2026-09-01T12:18:51.705000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: Use-after-free in the DOM: Core \u0026 HTML component"
    },
    {
      "cve": "CVE-2026-84131",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-01T12:43:55.232756+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2526767"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation due to invalid pointer in the Graphics component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Privilege escalation due to invalid pointer in the Graphics component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84131"
        },
        {
          "category": "external",
          "summary": "RHBZ#2526767",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526767"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84131",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84131"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84131",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84131"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-84/#CVE-2026-84131",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-84/#CVE-2026-84131"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84131",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84131"
        }
      ],
      "release_date": "2026-09-01T12:18:42.768000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: Privilege escalation due to invalid pointer in the Graphics component"
    },
    {
      "cve": "CVE-2026-84143",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-09-01T12:47:28.592903+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2526781"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInternally found bugs present in Firefox 154, Firefox ESR 153.1 and Firefox ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84143"
        },
        {
          "category": "external",
          "summary": "RHBZ#2526781",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526781"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84143",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84143"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84143",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84143"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-84/#CVE-2026-84143",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-84/#CVE-2026-84143"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84143",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84143"
        }
      ],
      "release_date": "2026-09-01T12:19:10.109000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15"
    },
    {
      "cve": "CVE-2026-84145",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-01T12:42:33.455531+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2526760"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInternally found bugs present in Firefox 154, Firefox ESR 153.1, Firefox ESR 140.14 and Firefox ESR 115.39. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84145"
        },
        {
          "category": "external",
          "summary": "RHBZ#2526760",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526760"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84145",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84145"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84145",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84145"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-84/#CVE-2026-84145",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-84/#CVE-2026-84145"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84145",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84145"
        }
      ],
      "release_date": "2026-09-01T12:18:43.808000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40"
    },
    {
      "cve": "CVE-2026-84639",
      "cwe": {
        "id": "CWE-824",
        "name": "Access of Uninitialized Pointer"
      },
      "discovery_date": "2026-09-01T21:41:05.621268+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2527113"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nTriggering an error condition in certain MIME bodies would cause uninitialized\nmemory to be used.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "thunderbird: Uninitialized memory in MIME parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84639"
        },
        {
          "category": "external",
          "summary": "RHBZ#2527113",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527113"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84639",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84639"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84639",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84639"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84639",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84639"
        }
      ],
      "release_date": "2026-09-01T21:33:06.251000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "thunderbird: Uninitialized memory in MIME parsing"
    },
    {
      "cve": "CVE-2026-84640",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-09-01T21:41:18.016580+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2527116"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Thunderbird. A remote attacker could exploit this vulnerability by sending a maliciously constructed mail header. This could lead to a one-byte read past the end of a buffer, potentially resulting in information disclosure or other unpredictable behavior.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "thunderbird: One byte overflow read in mail parser",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84640"
        },
        {
          "category": "external",
          "summary": "RHBZ#2527116",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527116"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84640",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84640"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84640",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84640"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84640",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84640"
        }
      ],
      "release_date": "2026-09-01T21:33:06.832000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "thunderbird: One byte overflow read in mail parser"
    },
    {
      "cve": "CVE-2026-84641",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-01T21:41:48.975643+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2527115"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nA malicious IMAP server can trigger use-after-free and heap-memory disclosure\nby sending a crafted ID response. Heap contents can ultimately be persisted\nto prefs.js.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "thunderbird: Information disclosure due to malicious IMAP server response",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84641"
        },
        {
          "category": "external",
          "summary": "RHBZ#2527115",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527115"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84641",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84641"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84641",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84641"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84641",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84641"
        }
      ],
      "release_date": "2026-09-01T21:33:07.410000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.4,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "thunderbird: Information disclosure due to malicious IMAP server response"
    },
    {
      "cve": "CVE-2026-92005",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-15T12:55:21.959142+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533778"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the Audio/Video: Web Codecs component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92005"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533778",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533778"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92005",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92005"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92005",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92005"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92005",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92005"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92005",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92005"
        }
      ],
      "release_date": "2026-09-15T12:33:24.503000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component"
    },
    {
      "cve": "CVE-2026-92006",
      "cwe": {
        "id": "CWE-653",
        "name": "Improper Isolation or Compartmentalization"
      },
      "discovery_date": "2026-09-15T12:47:51.202612+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533751"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92006"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533751",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533751"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92006",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92006"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92006",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92006"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92006",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92006"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92006",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92006"
        }
      ],
      "release_date": "2026-09-15T12:33:25.605000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component"
    },
    {
      "cve": "CVE-2026-92007",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-09-15T13:00:05.750680+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533792"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92007"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533792",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533792"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92007",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92007"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92007",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92007"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92007",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92007"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92007",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92007"
        }
      ],
      "release_date": "2026-09-15T12:33:26.646000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component"
    },
    {
      "cve": "CVE-2026-92008",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-09-15T12:59:46.460598+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533790"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92008"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533790",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533790"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92008",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92008"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92008",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92008"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92008",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92008"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92008",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92008"
        }
      ],
      "release_date": "2026-09-15T12:33:27.684000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component"
    },
    {
      "cve": "CVE-2026-92009",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-09-15T12:56:01.316710+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533781"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92009"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533781",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533781"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92009",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92009"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92009",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92009"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92009",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92009"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92009",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92009"
        }
      ],
      "release_date": "2026-09-15T12:33:28.728000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component"
    },
    {
      "cve": "CVE-2026-92010",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-09-15T12:46:38.868486+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533747"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92010"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533747",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533747"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92010",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92010"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92010",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92010"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92010",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92010"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92010",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92010"
        }
      ],
      "release_date": "2026-09-15T12:33:29.788000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component"
    },
    {
      "cve": "CVE-2026-92011",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-09-15T12:48:41.123329+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533753"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92011"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533753",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533753"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92011",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92011"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92011",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92011"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92011",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92011"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92011",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92011"
        }
      ],
      "release_date": "2026-09-15T12:33:30.851000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component"
    },
    {
      "cve": "CVE-2026-92012",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-09-15T12:52:58.995110+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533769"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92012"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533769",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533769"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92012",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92012"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92012",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92012"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92012",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92012"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92012",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92012"
        }
      ],
      "release_date": "2026-09-15T12:33:31.909000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component"
    },
    {
      "cve": "CVE-2026-92013",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-09-15T12:50:27.459983+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533762"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92013"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533762",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533762"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92013",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92013"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92013",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92013"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92013",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92013"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92013",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92013"
        }
      ],
      "release_date": "2026-09-15T12:33:32.932000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component"
    },
    {
      "cve": "CVE-2026-92014",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-09-15T12:54:00.642463+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533771"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation due to incorrect boundary conditions in the Graphics component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92014"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533771",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533771"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92014",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92014"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92014",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92014"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92014",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92014"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92014",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92014"
        }
      ],
      "release_date": "2026-09-15T12:33:33.939000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component"
    },
    {
      "cve": "CVE-2026-92015",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-09-15T12:49:52.692625+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533760"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the WebExtensions component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation in the WebExtensions component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92015"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533760",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533760"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92015",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92015"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92015",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92015"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92015",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92015"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92015",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92015"
        }
      ],
      "release_date": "2026-09-15T12:33:34.965000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation in the WebExtensions component"
    },
    {
      "cve": "CVE-2026-92016",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-15T12:51:05.456167+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533764"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the Disability Access APIs component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the Disability Access APIs component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92016"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533764",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533764"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92016",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92016"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92016",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92016"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92016",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92016"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92016",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92016"
        }
      ],
      "release_date": "2026-09-15T12:33:35.999000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the Disability Access APIs component"
    },
    {
      "cve": "CVE-2026-92017",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-09-15T12:56:21.401738+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533779"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the DOM: Service Workers component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation in the DOM: Service Workers component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92017"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533779",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533779"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92017",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92017"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92017",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92017"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92017",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92017"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92017",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92017"
        }
      ],
      "release_date": "2026-09-15T12:33:37.035000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation in the DOM: Service Workers component"
    },
    {
      "cve": "CVE-2026-92018",
      "cwe": {
        "id": "CWE-791",
        "name": "Incomplete Filtering of Special Elements"
      },
      "discovery_date": "2026-09-15T12:53:20.240091+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533773"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Sandbox escape in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92018"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533773",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533773"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92018",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92018"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92018",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92018"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92018",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92018"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92018",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92018"
        }
      ],
      "release_date": "2026-09-15T12:33:38.091000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Sandbox escape in the DOM: Core \u0026 HTML component"
    },
    {
      "cve": "CVE-2026-92019",
      "cwe": {
        "id": "CWE-807",
        "name": "Reliance on Untrusted Inputs in a Security Decision"
      },
      "discovery_date": "2026-09-15T12:44:13.484273+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533740"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMitigation bypass in the Remote Settings Client component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Mitigation bypass in the Remote Settings Client component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92019"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533740",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533740"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92019",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92019"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92019",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92019"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92019",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92019"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92019",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92019"
        }
      ],
      "release_date": "2026-09-15T12:33:39.132000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Mitigation bypass in the Remote Settings Client component"
    },
    {
      "cve": "CVE-2026-92020",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-09-15T12:58:34.770127+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533786"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation due to incorrect boundary conditions in the Graphics: WebRender component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92020"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533786",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533786"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92020",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92020"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92020",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92020"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92020",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92020"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92020",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92020"
        }
      ],
      "release_date": "2026-09-15T12:33:40.137000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component"
    },
    {
      "cve": "CVE-2026-92021",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-15T12:55:01.959339+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533774"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the JavaScript Engine: JIT component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92021"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533774",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533774"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92021",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92021"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92021",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92021"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92021",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92021"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92021",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92021"
        }
      ],
      "release_date": "2026-09-15T12:33:41.163000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component"
    },
    {
      "cve": "CVE-2026-92022",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-15T12:52:18.043642+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533770"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the DOM: HTML Parser component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the DOM: HTML Parser component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92022"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533770",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533770"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92022",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92022"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92022",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92022"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92022",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92022"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92022",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92022"
        }
      ],
      "release_date": "2026-09-15T12:33:42.587000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the DOM: HTML Parser component"
    },
    {
      "cve": "CVE-2026-92023",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-15T13:02:32.520737+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533799"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the XML component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the XML component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92023"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533799",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533799"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92023",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92023"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92023",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92023"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92023",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92023"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92023",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92023"
        }
      ],
      "release_date": "2026-09-15T12:33:43.613000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the XML component"
    },
    {
      "cve": "CVE-2026-92024",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-15T12:42:52.299594+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533737"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the SVG component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the SVG component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92024"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533737",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533737"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92024",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92024"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92024",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92024"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92024",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92024"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92024",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92024"
        }
      ],
      "release_date": "2026-09-15T12:33:44.665000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the SVG component"
    },
    {
      "cve": "CVE-2026-92025",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-15T13:00:48.700248+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533793"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the DOM: Navigation component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the DOM: Navigation component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92025"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533793",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533793"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92025",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92025"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92025",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92025"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92025",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92025"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92025",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92025"
        }
      ],
      "release_date": "2026-09-15T12:33:45.712000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the DOM: Navigation component"
    },
    {
      "cve": "CVE-2026-92026",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-15T12:43:33.275615+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533741"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the Networking component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the Networking component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92026"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533741",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533741"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92026",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92026"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92026",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92026"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92026",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92026"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92026",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92026"
        }
      ],
      "release_date": "2026-09-15T12:33:46.700000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the Networking component"
    },
    {
      "cve": "CVE-2026-92027",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-15T12:46:22.170590+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533757"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the DOM: Streams component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the DOM: Streams component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92027"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533757",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533757"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92027",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92027"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92027",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92027"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92027",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92027"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92027",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92027"
        }
      ],
      "release_date": "2026-09-15T12:33:47.810000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the DOM: Streams component"
    },
    {
      "cve": "CVE-2026-92028",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-15T12:49:32.316908+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533758"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92028"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533758",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533758"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92028",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92028"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92028",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92028"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92028",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92028"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92028",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92028"
        }
      ],
      "release_date": "2026-09-15T12:33:48.824000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component"
    },
    {
      "cve": "CVE-2026-92029",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-15T13:02:11.980281+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533797"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the SVG component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the SVG component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92029"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533797",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533797"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92029",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92029"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92029",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92029"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92029",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92029"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92029",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92029"
        }
      ],
      "release_date": "2026-09-15T12:33:49.859000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the SVG component"
    },
    {
      "cve": "CVE-2026-92030",
      "cwe": {
        "id": "CWE-807",
        "name": "Reliance on Untrusted Inputs in a Security Decision"
      },
      "discovery_date": "2026-09-15T12:59:11.175898+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533791"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMitigation bypass in the DOM: Copy \u0026 Paste and Drag \u0026 Drop component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Mitigation bypass in the DOM: Copy \u0026 Paste and Drag \u0026 Drop component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92030"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533791",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533791"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92030",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92030"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92030",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92030"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92030",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92030"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92030",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92030"
        }
      ],
      "release_date": "2026-09-15T12:33:50.891000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Mitigation bypass in the DOM: Copy \u0026 Paste and Drag \u0026 Drop component"
    },
    {
      "cve": "CVE-2026-92031",
      "cwe": {
        "id": "CWE-497",
        "name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere"
      },
      "discovery_date": "2026-09-15T12:44:47.990509+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533742"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInformation disclosure in the Graphics: ImageLib component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Information disclosure in the Graphics: ImageLib component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92031"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533742",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533742"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92031",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92031"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92031",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92031"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92031",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92031"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92031",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92031"
        }
      ],
      "release_date": "2026-09-15T12:33:51.922000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Information disclosure in the Graphics: ImageLib component"
    },
    {
      "cve": "CVE-2026-92032",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-09-15T12:45:07.307553+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533743"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape due to invalid pointer in the Graphics component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92032"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533743",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533743"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92032",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92032"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92032",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92032"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92032",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-92/#CVE-2026-92032"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92032",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92032"
        }
      ],
      "release_date": "2026-09-15T12:33:52.921000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component"
    },
    {
      "cve": "CVE-2026-92238",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "discovery_date": "2026-09-15T20:05:27.109864+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2534199"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Thunderbird where a maliciously constructed mail header could lead to ambiguous parsing. This vulnerability could result in multiple mail header fields being incorrectly interpreted as one, or cause memory safety violations. A remote attacker could potentially exploit this to trigger unexpected application behavior or a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "thunderbird: Thunderbird: Memory safety violations via maliciously crafted mail headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92238"
        },
        {
          "category": "external",
          "summary": "RHBZ#2534199",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2534199"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92238",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92238"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92238",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92238"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92238",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92238"
        }
      ],
      "release_date": "2026-09-15T19:42:51.331000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "thunderbird: Thunderbird: Memory safety violations via maliciously crafted mail headers"
    },
    {
      "cve": "CVE-2026-92239",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-09-15T20:05:53.583144+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2534197"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Thunderbird. A remote attacker could exploit this vulnerability by sending a maliciously constructed Internet Message Access Protocol (IMAP) line. This could lead to an out-of-bounds buffer read, potentially resulting in information disclosure or a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "thunderbird: Thunderbird: Out-of-bounds read via maliciously constructed IMAP line",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92239"
        },
        {
          "category": "external",
          "summary": "RHBZ#2534197",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2534197"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92239",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92239"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92239",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92239"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92239",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92239"
        }
      ],
      "release_date": "2026-09-15T19:42:52.416000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "thunderbird: Thunderbird: Out-of-bounds read via maliciously constructed IMAP line"
    },
    {
      "cve": "CVE-2026-92240",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-09-15T20:01:37.216577+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2534187"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nA malicious or compromised IMAP server can trigger an out-of-bounds read in\nthe IMAP response parser by sending an untagged \u0027* ID\u0027 response, crashing\nThunderbird. The affected parsing path is reachable before authentication.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "thunderbird: Out-of-bounds read in IMAP response parser",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92240"
        },
        {
          "category": "external",
          "summary": "RHBZ#2534187",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2534187"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92240",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92240"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92240",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92240"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92240",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-95/#CVE-2026-92240"
        }
      ],
      "release_date": "2026-09-15T19:42:53.494000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T02:21:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70642"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.4,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.16.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.16.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "thunderbird: Out-of-bounds read in IMAP response parser"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.