Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-5732 (GCVE-0-2026-5732)
Vulnerability from cvelistv5 – Published: 2026-04-07 12:43 – Updated: 2026-06-30 03:18
VLAI
EPSS
Title
Incorrect boundary conditions, integer overflow in the Graphics: Text component
Summary
Incorrect boundary conditions, integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
32 references
Impacted products
22 products
Credits
Sajeeb Lohani
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-5732",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-07T14:28:39.207668Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T18:07:30.209Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux Server (v. 7 ELS)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.1"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream (v. 10)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream (v. 8)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.2::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.6::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_tus:8.6::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.0::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.4::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream (v. 9)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
}
],
"datePublic": "2026-04-07T12:43:12.829Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions, integer overflow in the Graphics: Text component"
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T03:18:39.691Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-5732"
},
{
"name": "RHBZ#2455908",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455908"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5732.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13977"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13665"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11813"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7672"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9638"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8052"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9345"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11805"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13600"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:14303"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13683"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:15889"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13682"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:14223"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13596"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:12264"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13922"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13412"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13582"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13533"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13583"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13342"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7671"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8459"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:13977: Red Hat Enterprise Linux Server (v. 7 ELS)"
},
{
"lang": "en",
"value": "RHSA-2026:13665: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:11813: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:7672: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:9638: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:8052: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:9345: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:11805: Red Hat Enterprise Linux AppStream AUS (v. 8.2)"
},
{
"lang": "en",
"value": "RHSA-2026:13600: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:14303: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:13683: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:15889: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:13682: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:14223: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:13596: Red Hat Enterprise Linux AppStream E4S (v.9.0)"
},
{
"lang": "en",
"value": "RHSA-2026:12264: Red Hat Enterprise Linux AppStream E4S (v.9.0)"
},
{
"lang": "en",
"value": "RHSA-2026:13922: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:13412: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:13582: Red Hat Enterprise Linux AppStream EUS (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:13533: Red Hat Enterprise Linux AppStream EUS (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:13583: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:13342: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:7671: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:8459: Red Hat Enterprise Linux AppStream (v. 9)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-07T13:01:39.095Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-07T12:43:12.829Z",
"value": "Made public."
}
],
"title": "firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.9.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "149.0.2",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.9.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "149.0.2",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Sajeeb Lohani"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect boundary conditions, integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1."
}
],
"value": "Incorrect boundary conditions, integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-04-13T13:51:28.140Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2017867"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-25/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-28/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/"
}
],
"title": "Incorrect boundary conditions, integer overflow in the Graphics: Text component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-5732",
"datePublished": "2026-04-07T12:43:12.829Z",
"dateReserved": "2026-04-07T12:43:12.349Z",
"dateUpdated": "2026-06-30T03:18:39.691Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-5732",
"date": "2026-07-01",
"epss": "0.0035",
"percentile": "0.27001"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-5732\",\"sourceIdentifier\":\"security@mozilla.org\",\"published\":\"2026-04-07T13:16:47.463\",\"lastModified\":\"2026-06-30T03:21:09.030\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Incorrect boundary conditions, integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.\"}],\"affected\":[{\"source\":\"security@mozilla.org\",\"affectedData\":[{\"vendor\":\"Mozilla\",\"product\":\"Firefox\",\"versions\":[{\"version\":\"140.9.1\",\"lessThanOrEqual\":\"140.*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"149.0.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Mozilla\",\"product\":\"Thunderbird\",\"versions\":[{\"version\":\"140.9.1\",\"lessThanOrEqual\":\"140.*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"149.0.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux Server (v. 7 ELS)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:rhel_els:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream EUS (v. 10.0)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux_eus:10.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream (v. 10)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream (v. 8)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream AUS (v. 8.2)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.2::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream AUS (v.8.4)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.4::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream AUS (v.8.6)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.6::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream E4S (v.8.6)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:8.6::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream TUS (v.8.6)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_tus:8.6::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream E4S (v.8.8)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:8.8::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream TUS (v.8.8)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_tus:8.8::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream E4S (v.9.0)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:9.0::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream E4S (v.9.2)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:9.2::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream EUS (v.9.4)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_eus:9.4::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream EUS (v.9.6)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_eus:9.6::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream (v. 9)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-07T14:28:39.207668Z\",\"id\":\"CVE-2026-5732\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*\",\"versionEndExcluding\":\"140.9.1\",\"matchCriteriaId\":\"68770777-CF92-4F1C-A7FB-874344D23D39\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*\",\"versionEndExcluding\":\"149.0.2\",\"matchCriteriaId\":\"CF910B3C-C241-48B5-9066-260750E8E7ED\"}]}]}],\"references\":[{\"url\":\"https://bugzilla.mozilla.org/show_bug.cgi?id=2017867\",\"source\":\"security@mozilla.org\",\"tags\":[\"Issue Tracking\",\"Permissions Required\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2026-25/\",\"source\":\"security@mozilla.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2026-27/\",\"source\":\"security@mozilla.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2026-28/\",\"source\":\"security@mozilla.org\"},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2026-29/\",\"source\":\"security@mozilla.org\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11805\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11813\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:12264\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13342\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13412\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13533\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13582\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13583\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13596\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13600\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13665\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13682\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13683\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13922\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13977\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:14223\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:14303\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:15889\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7671\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7672\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8052\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8459\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9345\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9638\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-5732\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2455908\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5732.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/o:redhat:rhel_els:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux Server (v. 7 ELS)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux_eus:10.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream EUS (v. 10.0)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream (v. 10)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream (v. 8)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.2::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream AUS (v. 8.2)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.4::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream AUS (v.8.4)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.6::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream AUS (v.8.6)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:8.6::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream E4S (v.8.6)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_tus:8.6::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream TUS (v.8.6)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:8.8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream E4S (v.8.8)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_tus:8.8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream TUS (v.8.8)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:9.0::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream E4S (v.9.0)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:9.2::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream E4S (v.9.2)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus:9.4::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream EUS (v.9.4)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus:9.6::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream EUS (v.9.6)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream (v. 9)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-04-07T13:01:39.095Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-04-07T12:43:12.829Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:13977: Red Hat Enterprise Linux Server (v. 7 ELS)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13665: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11813: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7672: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9638: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8052: Red Hat Enterprise Linux AppStream (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9345: Red Hat Enterprise Linux AppStream (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11805: Red Hat Enterprise Linux AppStream AUS (v. 8.2)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13600: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:14303: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13683: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:15889: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13682: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:14223: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13596: Red Hat Enterprise Linux AppStream E4S (v.9.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:12264: Red Hat Enterprise Linux AppStream E4S (v.9.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13922: Red Hat Enterprise Linux AppStream E4S (v.9.2)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13412: Red Hat Enterprise Linux AppStream E4S (v.9.2)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13582: Red Hat Enterprise Linux AppStream EUS (v.9.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13533: Red Hat Enterprise Linux AppStream EUS (v.9.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13583: Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13342: Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7671: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8459: Red Hat Enterprise Linux AppStream (v. 9)\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-04-07T12:43:12.829Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-5732\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2455908\", \"name\": \"RHBZ#2455908\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5732.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13977\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13665\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11813\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7672\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9638\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8052\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9345\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11805\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13600\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14303\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13683\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:15889\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13682\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14223\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13596\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:12264\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13922\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13412\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13582\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13533\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13583\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13342\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7671\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8459\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\\nIncorrect boundary conditions, integer overflow in the Graphics: Text component\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-190\", \"description\": \"Integer Overflow or Wraparound\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-06-30T03:18:39.691Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-5732\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-07T14:28:39.207668Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-190\", \"description\": \"CWE-190 Integer Overflow or Wraparound\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-07T14:27:50.789Z\"}}], \"cna\": {\"title\": \"Incorrect boundary conditions, integer overflow in the Graphics: Text component\", \"credits\": [{\"lang\": \"en\", \"value\": \"Sajeeb Lohani\"}], \"affected\": [{\"vendor\": \"Mozilla\", \"product\": \"Firefox\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"140.9.1\", \"versionType\": \"rpm\", \"lessThanOrEqual\": \"140.*\"}, {\"status\": \"unaffected\", \"version\": \"149.0.2\", \"versionType\": \"rpm\", \"lessThanOrEqual\": \"*\"}]}, {\"vendor\": \"Mozilla\", \"product\": \"Thunderbird\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"140.9.1\", \"versionType\": \"rpm\", \"lessThanOrEqual\": \"140.*\"}, {\"status\": \"unaffected\", \"version\": \"149.0.2\", \"versionType\": \"rpm\", \"lessThanOrEqual\": \"*\"}]}], \"references\": [{\"url\": \"https://bugzilla.mozilla.org/show_bug.cgi?id=2017867\"}, {\"url\": \"https://www.mozilla.org/security/advisories/mfsa2026-25/\"}, {\"url\": \"https://www.mozilla.org/security/advisories/mfsa2026-27/\"}, {\"url\": \"https://www.mozilla.org/security/advisories/mfsa2026-28/\"}, {\"url\": \"https://www.mozilla.org/security/advisories/mfsa2026-29/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Incorrect boundary conditions, integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Incorrect boundary conditions, integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"f16b083a-5664-49f3-a51e-8d479e5ed7fe\", \"shortName\": \"mozilla\", \"dateUpdated\": \"2026-04-13T13:51:28.140Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-5732\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-30T03:18:39.691Z\", \"dateReserved\": \"2026-04-07T12:43:12.349Z\", \"assignerOrgId\": \"f16b083a-5664-49f3-a51e-8d479e5ed7fe\", \"datePublished\": \"2026-04-07T12:43:12.829Z\", \"assignerShortName\": \"mozilla\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:14303
Vulnerability from csaf_redhat - Published: 2026-05-06 19:20 - Updated: 2026-06-30 04:18Summary
Red Hat Security Advisory: thunderbird security update
Severity
Important
Notes
Topic: An update for thunderbird is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)
* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)
* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
8.8 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions, integer overflow in the Graphics: Text component
8.8 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
8.8 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can still be referenced, leading to a use-after-free condition. An attacker could potentially exploit this to achieve arbitrary code execution or cause a denial of service.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to dereferencing pointers before the start of the row buffer and writing expanded pixel data to underflowed positions. This flaw can result in information disclosure and denial of service.
7.6 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
43 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for thunderbird is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nSecurity Fix(es):\n\n* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)\n\n* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)\n\n* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)\n\n* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)\n\n* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:14303",
"url": "https://access.redhat.com/errata/RHSA-2026:14303"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2451805",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451805"
},
{
"category": "external",
"summary": "2451819",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451819"
},
{
"category": "external",
"summary": "2455897",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455897"
},
{
"category": "external",
"summary": "2455901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455901"
},
{
"category": "external",
"summary": "2455908",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455908"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_14303.json"
}
],
"title": "Red Hat Security Advisory: thunderbird security update",
"tracking": {
"current_release_date": "2026-06-30T04:18:33+00:00",
"generator": {
"date": "2026-06-30T04:18:33+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.0"
}
},
"id": "RHSA-2026:14303",
"initial_release_date": "2026-05-06T19:20:17+00:00",
"revision_history": [
{
"date": "2026-05-06T19:20:17+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-05-06T19:20:17+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-30T04:18:33+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product": {
"name": "Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_aus:8.4::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:140.9.1-1.el8_4.src",
"product": {
"name": "thunderbird-0:140.9.1-1.el8_4.src",
"product_id": "thunderbird-0:140.9.1-1.el8_4.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird@140.9.1-1.el8_4?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:140.9.1-1.el8_4.x86_64",
"product": {
"name": "thunderbird-0:140.9.1-1.el8_4.x86_64",
"product_id": "thunderbird-0:140.9.1-1.el8_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird@140.9.1-1.el8_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64",
"product": {
"name": "thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64",
"product_id": "thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debugsource@140.9.1-1.el8_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"product": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"product_id": "thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.9.1-1.el8_4?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el8_4.src as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src"
},
"product_reference": "thunderbird-0:140.9.1-1.el8_4.src",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64"
},
"product_reference": "thunderbird-0:140.9.1-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64"
},
"product_reference": "thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64"
},
"product_reference": "thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el8_4.src as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src"
},
"product_reference": "thunderbird-0:140.9.1-1.el8_4.src",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64"
},
"product_reference": "thunderbird-0:140.9.1-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64"
},
"product_reference": "thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64"
},
"product_reference": "thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-5731",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-07T13:01:15.389776+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455901"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5731"
},
{
"category": "external",
"summary": "RHBZ#2455901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455901"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5731",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5731"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5731",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5731"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5731",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5731"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5731",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5731"
}
],
"release_date": "2026-04-07T12:43:11.895000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-06T19:20:17+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:14303"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2"
},
{
"cve": "CVE-2026-5732",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-07T13:01:39.095775+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455908"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions, integer overflow in the Graphics: Text component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5732"
},
{
"category": "external",
"summary": "RHBZ#2455908",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455908"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5732",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5732"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5732",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5732"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5732",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5732"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5732",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5732"
}
],
"release_date": "2026-04-07T12:43:12.829000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-06T19:20:17+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:14303"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component"
},
{
"cve": "CVE-2026-5734",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-07T13:01:01.022958+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455897"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5734"
},
{
"category": "external",
"summary": "RHBZ#2455897",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455897"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5734",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5734"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5734",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5734"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5734",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5734"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5734",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5734"
}
],
"release_date": "2026-04-07T12:43:14.833000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-06T19:20:17+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:14303"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2"
},
{
"cve": "CVE-2026-33416",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-03-26T18:01:55.592413+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451805"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can still be referenced, leading to a use-after-free condition. An attacker could potentially exploit this to achieve arbitrary code execution or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Arbitrary code execution due to use-after-free vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33416"
},
{
"category": "external",
"summary": "RHBZ#2451805",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451805"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33416"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33416",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33416"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb",
"url": "https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667",
"url": "https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25",
"url": "https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1",
"url": "https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/pull/824",
"url": "https://github.com/pnggroup/libpng/pull/824"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j"
}
],
"release_date": "2026-03-26T16:48:54.174000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-06T19:20:17+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:14303"
},
{
"category": "workaround",
"details": "To reduce exposure, avoid processing untrusted PNG image files with applications that utilize libpng. Restricting the source of PNG images to trusted origins can limit the attack surface.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Arbitrary code execution due to use-after-free vulnerability"
},
{
"cve": "CVE-2026-33636",
"cwe": {
"id": "CWE-124",
"name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
},
"discovery_date": "2026-03-26T18:02:51.339603+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451819"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to dereferencing pointers before the start of the row buffer and writing expanded pixel data to underflowed positions. This flaw can result in information disclosure and denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33636"
},
{
"category": "external",
"summary": "RHBZ#2451819",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451819"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33636"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869",
"url": "https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3",
"url": "https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2"
}
],
"release_date": "2026-03-26T16:51:58.289000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-06T19:20:17+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:14303"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debuginfo-0:140.9.1-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:thunderbird-debugsource-0:140.9.1-1.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion"
}
]
}
RHSA-2026:15889
Vulnerability from csaf_redhat - Published: 2026-05-11 01:38 - Updated: 2026-06-30 04:18Summary
Red Hat Security Advisory: thunderbird security update
Severity
Important
Notes
Topic: An update for thunderbird is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)
* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)
* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
8.8 (High)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions, integer overflow in the Graphics: Text component
8.8 (High)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
8.8 (High)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can still be referenced, leading to a use-after-free condition. An attacker could potentially exploit this to achieve arbitrary code execution or cause a denial of service.
7.5 (High)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to dereferencing pointers before the start of the row buffer and writing expanded pixel data to underflowed positions. This flaw can result in information disclosure and denial of service.
7.6 (High)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
43 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for thunderbird is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nSecurity Fix(es):\n\n* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)\n\n* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)\n\n* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)\n\n* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)\n\n* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:15889",
"url": "https://access.redhat.com/errata/RHSA-2026:15889"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2451805",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451805"
},
{
"category": "external",
"summary": "2451819",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451819"
},
{
"category": "external",
"summary": "2455897",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455897"
},
{
"category": "external",
"summary": "2455901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455901"
},
{
"category": "external",
"summary": "2455908",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455908"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_15889.json"
}
],
"title": "Red Hat Security Advisory: thunderbird security update",
"tracking": {
"current_release_date": "2026-06-30T04:18:35+00:00",
"generator": {
"date": "2026-06-30T04:18:35+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.0"
}
},
"id": "RHSA-2026:15889",
"initial_release_date": "2026-05-11T01:38:09+00:00",
"revision_history": [
{
"date": "2026-05-11T01:38:09+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-05-11T01:38:09+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-30T04:18:35+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product": {
"name": "Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_aus:8.6::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product": {
"name": "Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_e4s:8.6::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product": {
"name": "Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_tus:8.6::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:140.9.1-1.el8_6.src",
"product": {
"name": "thunderbird-0:140.9.1-1.el8_6.src",
"product_id": "thunderbird-0:140.9.1-1.el8_6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird@140.9.1-1.el8_6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:140.9.1-1.el8_6.x86_64",
"product": {
"name": "thunderbird-0:140.9.1-1.el8_6.x86_64",
"product_id": "thunderbird-0:140.9.1-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird@140.9.1-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"product": {
"name": "thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"product_id": "thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debugsource@140.9.1-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"product": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"product_id": "thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.9.1-1.el8_6?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:140.9.1-1.el8_6.aarch64",
"product": {
"name": "thunderbird-0:140.9.1-1.el8_6.aarch64",
"product_id": "thunderbird-0:140.9.1-1.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird@140.9.1-1.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64",
"product": {
"name": "thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64",
"product_id": "thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debugsource@140.9.1-1.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64",
"product": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64",
"product_id": "thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.9.1-1.el8_6?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:140.9.1-1.el8_6.ppc64le",
"product": {
"name": "thunderbird-0:140.9.1-1.el8_6.ppc64le",
"product_id": "thunderbird-0:140.9.1-1.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird@140.9.1-1.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le",
"product": {
"name": "thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le",
"product_id": "thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debugsource@140.9.1-1.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le",
"product": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le",
"product_id": "thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.9.1-1.el8_6?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:140.9.1-1.el8_6.s390x",
"product": {
"name": "thunderbird-0:140.9.1-1.el8_6.s390x",
"product_id": "thunderbird-0:140.9.1-1.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird@140.9.1-1.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debugsource-0:140.9.1-1.el8_6.s390x",
"product": {
"name": "thunderbird-debugsource-0:140.9.1-1.el8_6.s390x",
"product_id": "thunderbird-debugsource-0:140.9.1-1.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debugsource@140.9.1-1.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x",
"product": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x",
"product_id": "thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.9.1-1.el8_6?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el8_6.src as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src"
},
"product_reference": "thunderbird-0:140.9.1-1.el8_6.src",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64"
},
"product_reference": "thunderbird-0:140.9.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64"
},
"product_reference": "thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64"
},
"product_reference": "thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64"
},
"product_reference": "thunderbird-0:140.9.1-1.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le"
},
"product_reference": "thunderbird-0:140.9.1-1.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x"
},
"product_reference": "thunderbird-0:140.9.1-1.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el8_6.src as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src"
},
"product_reference": "thunderbird-0:140.9.1-1.el8_6.src",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64"
},
"product_reference": "thunderbird-0:140.9.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64"
},
"product_reference": "thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le"
},
"product_reference": "thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x"
},
"product_reference": "thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64"
},
"product_reference": "thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64"
},
"product_reference": "thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le"
},
"product_reference": "thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debugsource-0:140.9.1-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x"
},
"product_reference": "thunderbird-debugsource-0:140.9.1-1.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64"
},
"product_reference": "thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el8_6.src as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src"
},
"product_reference": "thunderbird-0:140.9.1-1.el8_6.src",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64"
},
"product_reference": "thunderbird-0:140.9.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64"
},
"product_reference": "thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64"
},
"product_reference": "thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-5731",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-07T13:01:15.389776+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455901"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5731"
},
{
"category": "external",
"summary": "RHBZ#2455901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455901"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5731",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5731"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5731",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5731"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5731",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5731"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5731",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5731"
}
],
"release_date": "2026-04-07T12:43:11.895000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-11T01:38:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:15889"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2"
},
{
"cve": "CVE-2026-5732",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-07T13:01:39.095775+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455908"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions, integer overflow in the Graphics: Text component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5732"
},
{
"category": "external",
"summary": "RHBZ#2455908",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455908"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5732",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5732"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5732",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5732"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5732",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5732"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5732",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5732"
}
],
"release_date": "2026-04-07T12:43:12.829000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-11T01:38:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:15889"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component"
},
{
"cve": "CVE-2026-5734",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-07T13:01:01.022958+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455897"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5734"
},
{
"category": "external",
"summary": "RHBZ#2455897",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455897"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5734",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5734"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5734",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5734"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5734",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5734"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5734",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5734"
}
],
"release_date": "2026-04-07T12:43:14.833000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-11T01:38:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:15889"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2"
},
{
"cve": "CVE-2026-33416",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-03-26T18:01:55.592413+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451805"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can still be referenced, leading to a use-after-free condition. An attacker could potentially exploit this to achieve arbitrary code execution or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Arbitrary code execution due to use-after-free vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33416"
},
{
"category": "external",
"summary": "RHBZ#2451805",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451805"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33416"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33416",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33416"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb",
"url": "https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667",
"url": "https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25",
"url": "https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1",
"url": "https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/pull/824",
"url": "https://github.com/pnggroup/libpng/pull/824"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j"
}
],
"release_date": "2026-03-26T16:48:54.174000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-11T01:38:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:15889"
},
{
"category": "workaround",
"details": "To reduce exposure, avoid processing untrusted PNG image files with applications that utilize libpng. Restricting the source of PNG images to trusted origins can limit the attack surface.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Arbitrary code execution due to use-after-free vulnerability"
},
{
"cve": "CVE-2026-33636",
"cwe": {
"id": "CWE-124",
"name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
},
"discovery_date": "2026-03-26T18:02:51.339603+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451819"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to dereferencing pointers before the start of the row buffer and writing expanded pixel data to underflowed positions. This flaw can result in information disclosure and denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33636"
},
{
"category": "external",
"summary": "RHBZ#2451819",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451819"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33636"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869",
"url": "https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3",
"url": "https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2"
}
],
"release_date": "2026-03-26T16:51:58.289000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-11T01:38:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:15889"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:thunderbird-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debuginfo-0:140.9.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:thunderbird-debugsource-0:140.9.1-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion"
}
]
}
RHSA-2026:7671
Vulnerability from csaf_redhat - Published: 2026-04-13 02:29 - Updated: 2026-06-30 04:20Summary
Red Hat Security Advisory: firefox security update
Severity
Important
Notes
Topic: An update for firefox is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)
* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)
* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
8.8 (High)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions, integer overflow in the Graphics: Text component
8.8 (High)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
8.8 (High)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can still be referenced, leading to a use-after-free condition. An attacker could potentially exploit this to achieve arbitrary code execution or cause a denial of service.
7.5 (High)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to dereferencing pointers before the start of the row buffer and writing expanded pixel data to underflowed positions. This flaw can result in information disclosure and denial of service.
7.6 (High)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
43 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for firefox is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nSecurity Fix(es):\n\n* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)\n\n* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)\n\n* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)\n\n* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)\n\n* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:7671",
"url": "https://access.redhat.com/errata/RHSA-2026:7671"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2451805",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451805"
},
{
"category": "external",
"summary": "2451819",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451819"
},
{
"category": "external",
"summary": "2455897",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455897"
},
{
"category": "external",
"summary": "2455901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455901"
},
{
"category": "external",
"summary": "2455908",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455908"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7671.json"
}
],
"title": "Red Hat Security Advisory: firefox security update",
"tracking": {
"current_release_date": "2026-06-30T04:20:21+00:00",
"generator": {
"date": "2026-06-30T04:20:21+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.0"
}
},
"id": "RHSA-2026:7671",
"initial_release_date": "2026-04-13T02:29:51+00:00",
"revision_history": [
{
"date": "2026-04-13T02:29:51+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-13T02:29:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-30T04:20:21+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:140.9.1-1.el9_7.src",
"product": {
"name": "firefox-0:140.9.1-1.el9_7.src",
"product_id": "firefox-0:140.9.1-1.el9_7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@140.9.1-1.el9_7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:140.9.1-1.el9_7.aarch64",
"product": {
"name": "firefox-0:140.9.1-1.el9_7.aarch64",
"product_id": "firefox-0:140.9.1-1.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@140.9.1-1.el9_7?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "firefox-x11-0:140.9.1-1.el9_7.aarch64",
"product": {
"name": "firefox-x11-0:140.9.1-1.el9_7.aarch64",
"product_id": "firefox-x11-0:140.9.1-1.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-x11@140.9.1-1.el9_7?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "firefox-debugsource-0:140.9.1-1.el9_7.aarch64",
"product": {
"name": "firefox-debugsource-0:140.9.1-1.el9_7.aarch64",
"product_id": "firefox-debugsource-0:140.9.1-1.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debugsource@140.9.1-1.el9_7?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "firefox-debuginfo-0:140.9.1-1.el9_7.aarch64",
"product": {
"name": "firefox-debuginfo-0:140.9.1-1.el9_7.aarch64",
"product_id": "firefox-debuginfo-0:140.9.1-1.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debuginfo@140.9.1-1.el9_7?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:140.9.1-1.el9_7.ppc64le",
"product": {
"name": "firefox-0:140.9.1-1.el9_7.ppc64le",
"product_id": "firefox-0:140.9.1-1.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@140.9.1-1.el9_7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "firefox-x11-0:140.9.1-1.el9_7.ppc64le",
"product": {
"name": "firefox-x11-0:140.9.1-1.el9_7.ppc64le",
"product_id": "firefox-x11-0:140.9.1-1.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-x11@140.9.1-1.el9_7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "firefox-debugsource-0:140.9.1-1.el9_7.ppc64le",
"product": {
"name": "firefox-debugsource-0:140.9.1-1.el9_7.ppc64le",
"product_id": "firefox-debugsource-0:140.9.1-1.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debugsource@140.9.1-1.el9_7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"product": {
"name": "firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"product_id": "firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debuginfo@140.9.1-1.el9_7?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:140.9.1-1.el9_7.x86_64",
"product": {
"name": "firefox-0:140.9.1-1.el9_7.x86_64",
"product_id": "firefox-0:140.9.1-1.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@140.9.1-1.el9_7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "firefox-x11-0:140.9.1-1.el9_7.x86_64",
"product": {
"name": "firefox-x11-0:140.9.1-1.el9_7.x86_64",
"product_id": "firefox-x11-0:140.9.1-1.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-x11@140.9.1-1.el9_7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "firefox-debugsource-0:140.9.1-1.el9_7.x86_64",
"product": {
"name": "firefox-debugsource-0:140.9.1-1.el9_7.x86_64",
"product_id": "firefox-debugsource-0:140.9.1-1.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debugsource@140.9.1-1.el9_7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "firefox-debuginfo-0:140.9.1-1.el9_7.x86_64",
"product": {
"name": "firefox-debuginfo-0:140.9.1-1.el9_7.x86_64",
"product_id": "firefox-debuginfo-0:140.9.1-1.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debuginfo@140.9.1-1.el9_7?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:140.9.1-1.el9_7.s390x",
"product": {
"name": "firefox-0:140.9.1-1.el9_7.s390x",
"product_id": "firefox-0:140.9.1-1.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@140.9.1-1.el9_7?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "firefox-x11-0:140.9.1-1.el9_7.s390x",
"product": {
"name": "firefox-x11-0:140.9.1-1.el9_7.s390x",
"product_id": "firefox-x11-0:140.9.1-1.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-x11@140.9.1-1.el9_7?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "firefox-debugsource-0:140.9.1-1.el9_7.s390x",
"product": {
"name": "firefox-debugsource-0:140.9.1-1.el9_7.s390x",
"product_id": "firefox-debugsource-0:140.9.1-1.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debugsource@140.9.1-1.el9_7?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "firefox-debuginfo-0:140.9.1-1.el9_7.s390x",
"product": {
"name": "firefox-debuginfo-0:140.9.1-1.el9_7.s390x",
"product_id": "firefox-debuginfo-0:140.9.1-1.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debuginfo@140.9.1-1.el9_7?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:140.9.1-1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64"
},
"product_reference": "firefox-0:140.9.1-1.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:140.9.1-1.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le"
},
"product_reference": "firefox-0:140.9.1-1.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:140.9.1-1.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x"
},
"product_reference": "firefox-0:140.9.1-1.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:140.9.1-1.el9_7.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src"
},
"product_reference": "firefox-0:140.9.1-1.el9_7.src",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:140.9.1-1.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64"
},
"product_reference": "firefox-0:140.9.1-1.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debuginfo-0:140.9.1-1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64"
},
"product_reference": "firefox-debuginfo-0:140.9.1-1.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le"
},
"product_reference": "firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debuginfo-0:140.9.1-1.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x"
},
"product_reference": "firefox-debuginfo-0:140.9.1-1.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debuginfo-0:140.9.1-1.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64"
},
"product_reference": "firefox-debuginfo-0:140.9.1-1.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debugsource-0:140.9.1-1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64"
},
"product_reference": "firefox-debugsource-0:140.9.1-1.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debugsource-0:140.9.1-1.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le"
},
"product_reference": "firefox-debugsource-0:140.9.1-1.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debugsource-0:140.9.1-1.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x"
},
"product_reference": "firefox-debugsource-0:140.9.1-1.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debugsource-0:140.9.1-1.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64"
},
"product_reference": "firefox-debugsource-0:140.9.1-1.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-x11-0:140.9.1-1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64"
},
"product_reference": "firefox-x11-0:140.9.1-1.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-x11-0:140.9.1-1.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le"
},
"product_reference": "firefox-x11-0:140.9.1-1.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-x11-0:140.9.1-1.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x"
},
"product_reference": "firefox-x11-0:140.9.1-1.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-x11-0:140.9.1-1.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64"
},
"product_reference": "firefox-x11-0:140.9.1-1.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-5731",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-07T13:01:15.389776+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455901"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5731"
},
{
"category": "external",
"summary": "RHBZ#2455901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455901"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5731",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5731"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5731",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5731"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5731",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5731"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5731",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5731"
}
],
"release_date": "2026-04-07T12:43:11.895000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-13T02:29:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7671"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2"
},
{
"cve": "CVE-2026-5732",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-07T13:01:39.095775+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455908"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions, integer overflow in the Graphics: Text component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5732"
},
{
"category": "external",
"summary": "RHBZ#2455908",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455908"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5732",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5732"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5732",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5732"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5732",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5732"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5732",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5732"
}
],
"release_date": "2026-04-07T12:43:12.829000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-13T02:29:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7671"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component"
},
{
"cve": "CVE-2026-5734",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-07T13:01:01.022958+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455897"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5734"
},
{
"category": "external",
"summary": "RHBZ#2455897",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455897"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5734",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5734"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5734",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5734"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5734",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5734"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5734",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5734"
}
],
"release_date": "2026-04-07T12:43:14.833000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-13T02:29:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7671"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2"
},
{
"cve": "CVE-2026-33416",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-03-26T18:01:55.592413+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451805"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can still be referenced, leading to a use-after-free condition. An attacker could potentially exploit this to achieve arbitrary code execution or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Arbitrary code execution due to use-after-free vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33416"
},
{
"category": "external",
"summary": "RHBZ#2451805",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451805"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33416"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33416",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33416"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb",
"url": "https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667",
"url": "https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25",
"url": "https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1",
"url": "https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/pull/824",
"url": "https://github.com/pnggroup/libpng/pull/824"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j"
}
],
"release_date": "2026-03-26T16:48:54.174000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-13T02:29:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7671"
},
{
"category": "workaround",
"details": "To reduce exposure, avoid processing untrusted PNG image files with applications that utilize libpng. Restricting the source of PNG images to trusted origins can limit the attack surface.",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Arbitrary code execution due to use-after-free vulnerability"
},
{
"cve": "CVE-2026-33636",
"cwe": {
"id": "CWE-124",
"name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
},
"discovery_date": "2026-03-26T18:02:51.339603+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451819"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to dereferencing pointers before the start of the row buffer and writing expanded pixel data to underflowed positions. This flaw can result in information disclosure and denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33636"
},
{
"category": "external",
"summary": "RHBZ#2451819",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451819"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33636"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869",
"url": "https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3",
"url": "https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2"
}
],
"release_date": "2026-03-26T16:51:58.289000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-13T02:29:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7671"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:firefox-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.9.1-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion"
}
]
}
RHSA-2026:7672
Vulnerability from csaf_redhat - Published: 2026-04-13 02:23 - Updated: 2026-06-30 04:20Summary
Red Hat Security Advisory: firefox security update
Severity
Important
Notes
Topic: An update for firefox is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)
* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)
* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
8.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions, integer overflow in the Graphics: Text component
8.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
8.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can still be referenced, leading to a use-after-free condition. An attacker could potentially exploit this to achieve arbitrary code execution or cause a denial of service.
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to dereferencing pointers before the start of the row buffer and writing expanded pixel data to underflowed positions. This flaw can result in information disclosure and denial of service.
7.6 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
43 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for firefox is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nSecurity Fix(es):\n\n* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)\n\n* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)\n\n* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)\n\n* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)\n\n* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:7672",
"url": "https://access.redhat.com/errata/RHSA-2026:7672"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2451805",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451805"
},
{
"category": "external",
"summary": "2451819",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451819"
},
{
"category": "external",
"summary": "2455897",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455897"
},
{
"category": "external",
"summary": "2455901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455901"
},
{
"category": "external",
"summary": "2455908",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455908"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7672.json"
}
],
"title": "Red Hat Security Advisory: firefox security update",
"tracking": {
"current_release_date": "2026-06-30T04:20:21+00:00",
"generator": {
"date": "2026-06-30T04:20:21+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.0"
}
},
"id": "RHSA-2026:7672",
"initial_release_date": "2026-04-13T02:23:37+00:00",
"revision_history": [
{
"date": "2026-04-13T02:23:37+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-13T02:23:37+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-30T04:20:21+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:140.9.1-1.el10_1.src",
"product": {
"name": "firefox-0:140.9.1-1.el10_1.src",
"product_id": "firefox-0:140.9.1-1.el10_1.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@140.9.1-1.el10_1?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:140.9.1-1.el10_1.aarch64",
"product": {
"name": "firefox-0:140.9.1-1.el10_1.aarch64",
"product_id": "firefox-0:140.9.1-1.el10_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@140.9.1-1.el10_1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "firefox-debugsource-0:140.9.1-1.el10_1.aarch64",
"product": {
"name": "firefox-debugsource-0:140.9.1-1.el10_1.aarch64",
"product_id": "firefox-debugsource-0:140.9.1-1.el10_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debugsource@140.9.1-1.el10_1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "firefox-debuginfo-0:140.9.1-1.el10_1.aarch64",
"product": {
"name": "firefox-debuginfo-0:140.9.1-1.el10_1.aarch64",
"product_id": "firefox-debuginfo-0:140.9.1-1.el10_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debuginfo@140.9.1-1.el10_1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:140.9.1-1.el10_1.ppc64le",
"product": {
"name": "firefox-0:140.9.1-1.el10_1.ppc64le",
"product_id": "firefox-0:140.9.1-1.el10_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@140.9.1-1.el10_1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "firefox-debugsource-0:140.9.1-1.el10_1.ppc64le",
"product": {
"name": "firefox-debugsource-0:140.9.1-1.el10_1.ppc64le",
"product_id": "firefox-debugsource-0:140.9.1-1.el10_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debugsource@140.9.1-1.el10_1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"product": {
"name": "firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"product_id": "firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debuginfo@140.9.1-1.el10_1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:140.9.1-1.el10_1.s390x",
"product": {
"name": "firefox-0:140.9.1-1.el10_1.s390x",
"product_id": "firefox-0:140.9.1-1.el10_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@140.9.1-1.el10_1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "firefox-debugsource-0:140.9.1-1.el10_1.s390x",
"product": {
"name": "firefox-debugsource-0:140.9.1-1.el10_1.s390x",
"product_id": "firefox-debugsource-0:140.9.1-1.el10_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debugsource@140.9.1-1.el10_1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "firefox-debuginfo-0:140.9.1-1.el10_1.s390x",
"product": {
"name": "firefox-debuginfo-0:140.9.1-1.el10_1.s390x",
"product_id": "firefox-debuginfo-0:140.9.1-1.el10_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debuginfo@140.9.1-1.el10_1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:140.9.1-1.el10_1.x86_64",
"product": {
"name": "firefox-0:140.9.1-1.el10_1.x86_64",
"product_id": "firefox-0:140.9.1-1.el10_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@140.9.1-1.el10_1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "firefox-debugsource-0:140.9.1-1.el10_1.x86_64",
"product": {
"name": "firefox-debugsource-0:140.9.1-1.el10_1.x86_64",
"product_id": "firefox-debugsource-0:140.9.1-1.el10_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debugsource@140.9.1-1.el10_1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "firefox-debuginfo-0:140.9.1-1.el10_1.x86_64",
"product": {
"name": "firefox-debuginfo-0:140.9.1-1.el10_1.x86_64",
"product_id": "firefox-debuginfo-0:140.9.1-1.el10_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debuginfo@140.9.1-1.el10_1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:140.9.1-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64"
},
"product_reference": "firefox-0:140.9.1-1.el10_1.aarch64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:140.9.1-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le"
},
"product_reference": "firefox-0:140.9.1-1.el10_1.ppc64le",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:140.9.1-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x"
},
"product_reference": "firefox-0:140.9.1-1.el10_1.s390x",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:140.9.1-1.el10_1.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src"
},
"product_reference": "firefox-0:140.9.1-1.el10_1.src",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:140.9.1-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64"
},
"product_reference": "firefox-0:140.9.1-1.el10_1.x86_64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debuginfo-0:140.9.1-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64"
},
"product_reference": "firefox-debuginfo-0:140.9.1-1.el10_1.aarch64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le"
},
"product_reference": "firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debuginfo-0:140.9.1-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x"
},
"product_reference": "firefox-debuginfo-0:140.9.1-1.el10_1.s390x",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debuginfo-0:140.9.1-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64"
},
"product_reference": "firefox-debuginfo-0:140.9.1-1.el10_1.x86_64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debugsource-0:140.9.1-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64"
},
"product_reference": "firefox-debugsource-0:140.9.1-1.el10_1.aarch64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debugsource-0:140.9.1-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le"
},
"product_reference": "firefox-debugsource-0:140.9.1-1.el10_1.ppc64le",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debugsource-0:140.9.1-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x"
},
"product_reference": "firefox-debugsource-0:140.9.1-1.el10_1.s390x",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debugsource-0:140.9.1-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64"
},
"product_reference": "firefox-debugsource-0:140.9.1-1.el10_1.x86_64",
"relates_to_product_reference": "AppStream-10.1.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-5731",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-07T13:01:15.389776+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455901"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5731"
},
{
"category": "external",
"summary": "RHBZ#2455901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455901"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5731",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5731"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5731",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5731"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5731",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5731"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5731",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5731"
}
],
"release_date": "2026-04-07T12:43:11.895000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-13T02:23:37+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7672"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2"
},
{
"cve": "CVE-2026-5732",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-07T13:01:39.095775+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455908"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions, integer overflow in the Graphics: Text component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5732"
},
{
"category": "external",
"summary": "RHBZ#2455908",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455908"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5732",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5732"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5732",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5732"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5732",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5732"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5732",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5732"
}
],
"release_date": "2026-04-07T12:43:12.829000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-13T02:23:37+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7672"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component"
},
{
"cve": "CVE-2026-5734",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-07T13:01:01.022958+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455897"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5734"
},
{
"category": "external",
"summary": "RHBZ#2455897",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455897"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5734",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5734"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5734",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5734"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5734",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5734"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5734",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5734"
}
],
"release_date": "2026-04-07T12:43:14.833000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-13T02:23:37+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7672"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2"
},
{
"cve": "CVE-2026-33416",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-03-26T18:01:55.592413+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451805"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can still be referenced, leading to a use-after-free condition. An attacker could potentially exploit this to achieve arbitrary code execution or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Arbitrary code execution due to use-after-free vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33416"
},
{
"category": "external",
"summary": "RHBZ#2451805",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451805"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33416"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33416",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33416"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb",
"url": "https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667",
"url": "https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25",
"url": "https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1",
"url": "https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/pull/824",
"url": "https://github.com/pnggroup/libpng/pull/824"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j"
}
],
"release_date": "2026-03-26T16:48:54.174000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-13T02:23:37+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7672"
},
{
"category": "workaround",
"details": "To reduce exposure, avoid processing untrusted PNG image files with applications that utilize libpng. Restricting the source of PNG images to trusted origins can limit the attack surface.",
"product_ids": [
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Arbitrary code execution due to use-after-free vulnerability"
},
{
"cve": "CVE-2026-33636",
"cwe": {
"id": "CWE-124",
"name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
},
"discovery_date": "2026-03-26T18:02:51.339603+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451819"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to dereferencing pointers before the start of the row buffer and writing expanded pixel data to underflowed positions. This flaw can result in information disclosure and denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33636"
},
{
"category": "external",
"summary": "RHBZ#2451819",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451819"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33636"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869",
"url": "https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3",
"url": "https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2"
}
],
"release_date": "2026-03-26T16:51:58.289000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-13T02:23:37+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7672"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:firefox-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:firefox-debugsource-0:140.9.1-1.el10_1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion"
}
]
}
RHSA-2026:8052
Vulnerability from csaf_redhat - Published: 2026-04-14 11:50 - Updated: 2026-06-30 04:20Summary
Red Hat Security Advisory: firefox security update
Severity
Important
Notes
Topic: An update for firefox is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)
* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)
* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
8.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions, integer overflow in the Graphics: Text component
8.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
8.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can still be referenced, leading to a use-after-free condition. An attacker could potentially exploit this to achieve arbitrary code execution or cause a denial of service.
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to dereferencing pointers before the start of the row buffer and writing expanded pixel data to underflowed positions. This flaw can result in information disclosure and denial of service.
7.6 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
43 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for firefox is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nSecurity Fix(es):\n\n* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)\n\n* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)\n\n* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)\n\n* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)\n\n* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:8052",
"url": "https://access.redhat.com/errata/RHSA-2026:8052"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2451805",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451805"
},
{
"category": "external",
"summary": "2451819",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451819"
},
{
"category": "external",
"summary": "2455897",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455897"
},
{
"category": "external",
"summary": "2455901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455901"
},
{
"category": "external",
"summary": "2455908",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455908"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8052.json"
}
],
"title": "Red Hat Security Advisory: firefox security update",
"tracking": {
"current_release_date": "2026-06-30T04:20:22+00:00",
"generator": {
"date": "2026-06-30T04:20:22+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.0"
}
},
"id": "RHSA-2026:8052",
"initial_release_date": "2026-04-14T11:50:27+00:00",
"revision_history": [
{
"date": "2026-04-14T11:50:27+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-14T11:50:27+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-30T04:20:22+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:140.9.1-1.el8_10.src",
"product": {
"name": "firefox-0:140.9.1-1.el8_10.src",
"product_id": "firefox-0:140.9.1-1.el8_10.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@140.9.1-1.el8_10?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:140.9.1-1.el8_10.aarch64",
"product": {
"name": "firefox-0:140.9.1-1.el8_10.aarch64",
"product_id": "firefox-0:140.9.1-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@140.9.1-1.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "firefox-debugsource-0:140.9.1-1.el8_10.aarch64",
"product": {
"name": "firefox-debugsource-0:140.9.1-1.el8_10.aarch64",
"product_id": "firefox-debugsource-0:140.9.1-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debugsource@140.9.1-1.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "firefox-debuginfo-0:140.9.1-1.el8_10.aarch64",
"product": {
"name": "firefox-debuginfo-0:140.9.1-1.el8_10.aarch64",
"product_id": "firefox-debuginfo-0:140.9.1-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debuginfo@140.9.1-1.el8_10?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:140.9.1-1.el8_10.ppc64le",
"product": {
"name": "firefox-0:140.9.1-1.el8_10.ppc64le",
"product_id": "firefox-0:140.9.1-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@140.9.1-1.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "firefox-debugsource-0:140.9.1-1.el8_10.ppc64le",
"product": {
"name": "firefox-debugsource-0:140.9.1-1.el8_10.ppc64le",
"product_id": "firefox-debugsource-0:140.9.1-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debugsource@140.9.1-1.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"product": {
"name": "firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"product_id": "firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debuginfo@140.9.1-1.el8_10?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:140.9.1-1.el8_10.x86_64",
"product": {
"name": "firefox-0:140.9.1-1.el8_10.x86_64",
"product_id": "firefox-0:140.9.1-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@140.9.1-1.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "firefox-debugsource-0:140.9.1-1.el8_10.x86_64",
"product": {
"name": "firefox-debugsource-0:140.9.1-1.el8_10.x86_64",
"product_id": "firefox-debugsource-0:140.9.1-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debugsource@140.9.1-1.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "firefox-debuginfo-0:140.9.1-1.el8_10.x86_64",
"product": {
"name": "firefox-debuginfo-0:140.9.1-1.el8_10.x86_64",
"product_id": "firefox-debuginfo-0:140.9.1-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debuginfo@140.9.1-1.el8_10?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:140.9.1-1.el8_10.s390x",
"product": {
"name": "firefox-0:140.9.1-1.el8_10.s390x",
"product_id": "firefox-0:140.9.1-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@140.9.1-1.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "firefox-debugsource-0:140.9.1-1.el8_10.s390x",
"product": {
"name": "firefox-debugsource-0:140.9.1-1.el8_10.s390x",
"product_id": "firefox-debugsource-0:140.9.1-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debugsource@140.9.1-1.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "firefox-debuginfo-0:140.9.1-1.el8_10.s390x",
"product": {
"name": "firefox-debuginfo-0:140.9.1-1.el8_10.s390x",
"product_id": "firefox-debuginfo-0:140.9.1-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debuginfo@140.9.1-1.el8_10?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:140.9.1-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64"
},
"product_reference": "firefox-0:140.9.1-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:140.9.1-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le"
},
"product_reference": "firefox-0:140.9.1-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:140.9.1-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x"
},
"product_reference": "firefox-0:140.9.1-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:140.9.1-1.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src"
},
"product_reference": "firefox-0:140.9.1-1.el8_10.src",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:140.9.1-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64"
},
"product_reference": "firefox-0:140.9.1-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debuginfo-0:140.9.1-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64"
},
"product_reference": "firefox-debuginfo-0:140.9.1-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le"
},
"product_reference": "firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debuginfo-0:140.9.1-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x"
},
"product_reference": "firefox-debuginfo-0:140.9.1-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debuginfo-0:140.9.1-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64"
},
"product_reference": "firefox-debuginfo-0:140.9.1-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debugsource-0:140.9.1-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64"
},
"product_reference": "firefox-debugsource-0:140.9.1-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debugsource-0:140.9.1-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le"
},
"product_reference": "firefox-debugsource-0:140.9.1-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debugsource-0:140.9.1-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x"
},
"product_reference": "firefox-debugsource-0:140.9.1-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debugsource-0:140.9.1-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64"
},
"product_reference": "firefox-debugsource-0:140.9.1-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-5731",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-07T13:01:15.389776+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455901"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5731"
},
{
"category": "external",
"summary": "RHBZ#2455901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455901"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5731",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5731"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5731",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5731"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5731",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5731"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5731",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5731"
}
],
"release_date": "2026-04-07T12:43:11.895000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-14T11:50:27+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8052"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2"
},
{
"cve": "CVE-2026-5732",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-07T13:01:39.095775+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455908"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions, integer overflow in the Graphics: Text component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5732"
},
{
"category": "external",
"summary": "RHBZ#2455908",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455908"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5732",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5732"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5732",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5732"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5732",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5732"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5732",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5732"
}
],
"release_date": "2026-04-07T12:43:12.829000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-14T11:50:27+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8052"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component"
},
{
"cve": "CVE-2026-5734",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-07T13:01:01.022958+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455897"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5734"
},
{
"category": "external",
"summary": "RHBZ#2455897",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455897"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5734",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5734"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5734",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5734"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5734",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5734"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5734",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5734"
}
],
"release_date": "2026-04-07T12:43:14.833000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-14T11:50:27+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8052"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2"
},
{
"cve": "CVE-2026-33416",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-03-26T18:01:55.592413+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451805"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can still be referenced, leading to a use-after-free condition. An attacker could potentially exploit this to achieve arbitrary code execution or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Arbitrary code execution due to use-after-free vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33416"
},
{
"category": "external",
"summary": "RHBZ#2451805",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451805"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33416"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33416",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33416"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb",
"url": "https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667",
"url": "https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25",
"url": "https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1",
"url": "https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/pull/824",
"url": "https://github.com/pnggroup/libpng/pull/824"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j"
}
],
"release_date": "2026-03-26T16:48:54.174000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-14T11:50:27+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8052"
},
{
"category": "workaround",
"details": "To reduce exposure, avoid processing untrusted PNG image files with applications that utilize libpng. Restricting the source of PNG images to trusted origins can limit the attack surface.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Arbitrary code execution due to use-after-free vulnerability"
},
{
"cve": "CVE-2026-33636",
"cwe": {
"id": "CWE-124",
"name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
},
"discovery_date": "2026-03-26T18:02:51.339603+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451819"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to dereferencing pointers before the start of the row buffer and writing expanded pixel data to underflowed positions. This flaw can result in information disclosure and denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33636"
},
{
"category": "external",
"summary": "RHBZ#2451819",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451819"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33636"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869",
"url": "https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3",
"url": "https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2"
}
],
"release_date": "2026-03-26T16:51:58.289000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-14T11:50:27+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8052"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.9.1-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion"
}
]
}
RHSA-2026:8459
Vulnerability from csaf_redhat - Published: 2026-04-16 12:56 - Updated: 2026-06-30 04:20Summary
Red Hat Security Advisory: thunderbird security update
Severity
Important
Notes
Topic: An update for thunderbird is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)
* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)
* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
8.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions, integer overflow in the Graphics: Text component
8.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
8.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can still be referenced, leading to a use-after-free condition. An attacker could potentially exploit this to achieve arbitrary code execution or cause a denial of service.
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to dereferencing pointers before the start of the row buffer and writing expanded pixel data to underflowed positions. This flaw can result in information disclosure and denial of service.
7.6 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
43 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for thunderbird is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nSecurity Fix(es):\n\n* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)\n\n* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)\n\n* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)\n\n* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)\n\n* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:8459",
"url": "https://access.redhat.com/errata/RHSA-2026:8459"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2451805",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451805"
},
{
"category": "external",
"summary": "2451819",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451819"
},
{
"category": "external",
"summary": "2455897",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455897"
},
{
"category": "external",
"summary": "2455901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455901"
},
{
"category": "external",
"summary": "2455908",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455908"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8459.json"
}
],
"title": "Red Hat Security Advisory: thunderbird security update",
"tracking": {
"current_release_date": "2026-06-30T04:20:22+00:00",
"generator": {
"date": "2026-06-30T04:20:22+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.0"
}
},
"id": "RHSA-2026:8459",
"initial_release_date": "2026-04-16T12:56:50+00:00",
"revision_history": [
{
"date": "2026-04-16T12:56:50+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-16T12:56:50+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-30T04:20:22+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:140.9.1-1.el9_7.src",
"product": {
"name": "thunderbird-0:140.9.1-1.el9_7.src",
"product_id": "thunderbird-0:140.9.1-1.el9_7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird@140.9.1-1.el9_7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:140.9.1-1.el9_7.aarch64",
"product": {
"name": "thunderbird-0:140.9.1-1.el9_7.aarch64",
"product_id": "thunderbird-0:140.9.1-1.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird@140.9.1-1.el9_7?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64",
"product": {
"name": "thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64",
"product_id": "thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debugsource@140.9.1-1.el9_7?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64",
"product": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64",
"product_id": "thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.9.1-1.el9_7?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:140.9.1-1.el9_7.ppc64le",
"product": {
"name": "thunderbird-0:140.9.1-1.el9_7.ppc64le",
"product_id": "thunderbird-0:140.9.1-1.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird@140.9.1-1.el9_7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le",
"product": {
"name": "thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le",
"product_id": "thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debugsource@140.9.1-1.el9_7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"product": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"product_id": "thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.9.1-1.el9_7?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:140.9.1-1.el9_7.x86_64",
"product": {
"name": "thunderbird-0:140.9.1-1.el9_7.x86_64",
"product_id": "thunderbird-0:140.9.1-1.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird@140.9.1-1.el9_7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64",
"product": {
"name": "thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64",
"product_id": "thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debugsource@140.9.1-1.el9_7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64",
"product": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64",
"product_id": "thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.9.1-1.el9_7?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:140.9.1-1.el9_7.s390x",
"product": {
"name": "thunderbird-0:140.9.1-1.el9_7.s390x",
"product_id": "thunderbird-0:140.9.1-1.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird@140.9.1-1.el9_7?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debugsource-0:140.9.1-1.el9_7.s390x",
"product": {
"name": "thunderbird-debugsource-0:140.9.1-1.el9_7.s390x",
"product_id": "thunderbird-debugsource-0:140.9.1-1.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debugsource@140.9.1-1.el9_7?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x",
"product": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x",
"product_id": "thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.9.1-1.el9_7?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64"
},
"product_reference": "thunderbird-0:140.9.1-1.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le"
},
"product_reference": "thunderbird-0:140.9.1-1.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x"
},
"product_reference": "thunderbird-0:140.9.1-1.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el9_7.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src"
},
"product_reference": "thunderbird-0:140.9.1-1.el9_7.src",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64"
},
"product_reference": "thunderbird-0:140.9.1-1.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64"
},
"product_reference": "thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le"
},
"product_reference": "thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x"
},
"product_reference": "thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64"
},
"product_reference": "thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64"
},
"product_reference": "thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le"
},
"product_reference": "thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debugsource-0:140.9.1-1.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x"
},
"product_reference": "thunderbird-debugsource-0:140.9.1-1.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64"
},
"product_reference": "thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-5731",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-07T13:01:15.389776+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455901"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5731"
},
{
"category": "external",
"summary": "RHBZ#2455901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455901"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5731",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5731"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5731",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5731"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5731",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5731"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5731",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5731"
}
],
"release_date": "2026-04-07T12:43:11.895000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T12:56:50+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8459"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2"
},
{
"cve": "CVE-2026-5732",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-07T13:01:39.095775+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455908"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions, integer overflow in the Graphics: Text component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5732"
},
{
"category": "external",
"summary": "RHBZ#2455908",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455908"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5732",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5732"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5732",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5732"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5732",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5732"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5732",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5732"
}
],
"release_date": "2026-04-07T12:43:12.829000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T12:56:50+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8459"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component"
},
{
"cve": "CVE-2026-5734",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-07T13:01:01.022958+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455897"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5734"
},
{
"category": "external",
"summary": "RHBZ#2455897",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455897"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5734",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5734"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5734",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5734"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5734",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5734"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5734",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5734"
}
],
"release_date": "2026-04-07T12:43:14.833000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T12:56:50+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8459"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2"
},
{
"cve": "CVE-2026-33416",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-03-26T18:01:55.592413+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451805"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can still be referenced, leading to a use-after-free condition. An attacker could potentially exploit this to achieve arbitrary code execution or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Arbitrary code execution due to use-after-free vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33416"
},
{
"category": "external",
"summary": "RHBZ#2451805",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451805"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33416"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33416",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33416"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb",
"url": "https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667",
"url": "https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25",
"url": "https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1",
"url": "https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/pull/824",
"url": "https://github.com/pnggroup/libpng/pull/824"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j"
}
],
"release_date": "2026-03-26T16:48:54.174000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T12:56:50+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8459"
},
{
"category": "workaround",
"details": "To reduce exposure, avoid processing untrusted PNG image files with applications that utilize libpng. Restricting the source of PNG images to trusted origins can limit the attack surface.",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Arbitrary code execution due to use-after-free vulnerability"
},
{
"cve": "CVE-2026-33636",
"cwe": {
"id": "CWE-124",
"name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
},
"discovery_date": "2026-03-26T18:02:51.339603+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451819"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to dereferencing pointers before the start of the row buffer and writing expanded pixel data to underflowed positions. This flaw can result in information disclosure and denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33636"
},
{
"category": "external",
"summary": "RHBZ#2451819",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451819"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33636"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869",
"url": "https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3",
"url": "https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2"
}
],
"release_date": "2026-03-26T16:51:58.289000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T12:56:50+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8459"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:thunderbird-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debuginfo-0:140.9.1-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:thunderbird-debugsource-0:140.9.1-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion"
}
]
}
RHSA-2026:9345
Vulnerability from csaf_redhat - Published: 2026-04-21 15:10 - Updated: 2026-06-30 04:20Summary
Red Hat Security Advisory: thunderbird security update
Severity
Important
Notes
Topic: An update for thunderbird is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)
* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)
* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
8.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions, integer overflow in the Graphics: Text component
8.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
8.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can still be referenced, leading to a use-after-free condition. An attacker could potentially exploit this to achieve arbitrary code execution or cause a denial of service.
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to dereferencing pointers before the start of the row buffer and writing expanded pixel data to underflowed positions. This flaw can result in information disclosure and denial of service.
7.6 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
43 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for thunderbird is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nSecurity Fix(es):\n\n* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)\n\n* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)\n\n* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)\n\n* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)\n\n* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:9345",
"url": "https://access.redhat.com/errata/RHSA-2026:9345"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2451805",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451805"
},
{
"category": "external",
"summary": "2451819",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451819"
},
{
"category": "external",
"summary": "2455897",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455897"
},
{
"category": "external",
"summary": "2455901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455901"
},
{
"category": "external",
"summary": "2455908",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455908"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9345.json"
}
],
"title": "Red Hat Security Advisory: thunderbird security update",
"tracking": {
"current_release_date": "2026-06-30T04:20:23+00:00",
"generator": {
"date": "2026-06-30T04:20:23+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.0"
}
},
"id": "RHSA-2026:9345",
"initial_release_date": "2026-04-21T15:10:45+00:00",
"revision_history": [
{
"date": "2026-04-21T15:10:45+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-21T15:10:45+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-30T04:20:23+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:140.9.1-1.el8_10.src",
"product": {
"name": "thunderbird-0:140.9.1-1.el8_10.src",
"product_id": "thunderbird-0:140.9.1-1.el8_10.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird@140.9.1-1.el8_10?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:140.9.1-1.el8_10.aarch64",
"product": {
"name": "thunderbird-0:140.9.1-1.el8_10.aarch64",
"product_id": "thunderbird-0:140.9.1-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird@140.9.1-1.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64",
"product": {
"name": "thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64",
"product_id": "thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debugsource@140.9.1-1.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64",
"product": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64",
"product_id": "thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.9.1-1.el8_10?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:140.9.1-1.el8_10.ppc64le",
"product": {
"name": "thunderbird-0:140.9.1-1.el8_10.ppc64le",
"product_id": "thunderbird-0:140.9.1-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird@140.9.1-1.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le",
"product": {
"name": "thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le",
"product_id": "thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debugsource@140.9.1-1.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"product": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"product_id": "thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.9.1-1.el8_10?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:140.9.1-1.el8_10.x86_64",
"product": {
"name": "thunderbird-0:140.9.1-1.el8_10.x86_64",
"product_id": "thunderbird-0:140.9.1-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird@140.9.1-1.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64",
"product": {
"name": "thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64",
"product_id": "thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debugsource@140.9.1-1.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64",
"product": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64",
"product_id": "thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.9.1-1.el8_10?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:140.9.1-1.el8_10.s390x",
"product": {
"name": "thunderbird-0:140.9.1-1.el8_10.s390x",
"product_id": "thunderbird-0:140.9.1-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird@140.9.1-1.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debugsource-0:140.9.1-1.el8_10.s390x",
"product": {
"name": "thunderbird-debugsource-0:140.9.1-1.el8_10.s390x",
"product_id": "thunderbird-debugsource-0:140.9.1-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debugsource@140.9.1-1.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x",
"product": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x",
"product_id": "thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.9.1-1.el8_10?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64"
},
"product_reference": "thunderbird-0:140.9.1-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le"
},
"product_reference": "thunderbird-0:140.9.1-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x"
},
"product_reference": "thunderbird-0:140.9.1-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src"
},
"product_reference": "thunderbird-0:140.9.1-1.el8_10.src",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64"
},
"product_reference": "thunderbird-0:140.9.1-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64"
},
"product_reference": "thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le"
},
"product_reference": "thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x"
},
"product_reference": "thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64"
},
"product_reference": "thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64"
},
"product_reference": "thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le"
},
"product_reference": "thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debugsource-0:140.9.1-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x"
},
"product_reference": "thunderbird-debugsource-0:140.9.1-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64"
},
"product_reference": "thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-5731",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-07T13:01:15.389776+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455901"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5731"
},
{
"category": "external",
"summary": "RHBZ#2455901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455901"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5731",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5731"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5731",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5731"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5731",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5731"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5731",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5731"
}
],
"release_date": "2026-04-07T12:43:11.895000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:10:45+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2"
},
{
"cve": "CVE-2026-5732",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-07T13:01:39.095775+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455908"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions, integer overflow in the Graphics: Text component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5732"
},
{
"category": "external",
"summary": "RHBZ#2455908",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455908"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5732",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5732"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5732",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5732"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5732",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5732"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5732",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5732"
}
],
"release_date": "2026-04-07T12:43:12.829000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:10:45+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component"
},
{
"cve": "CVE-2026-5734",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-07T13:01:01.022958+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455897"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5734"
},
{
"category": "external",
"summary": "RHBZ#2455897",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455897"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5734",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5734"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5734",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5734"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5734",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5734"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5734",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5734"
}
],
"release_date": "2026-04-07T12:43:14.833000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:10:45+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2"
},
{
"cve": "CVE-2026-33416",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-03-26T18:01:55.592413+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451805"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can still be referenced, leading to a use-after-free condition. An attacker could potentially exploit this to achieve arbitrary code execution or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Arbitrary code execution due to use-after-free vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33416"
},
{
"category": "external",
"summary": "RHBZ#2451805",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451805"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33416"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33416",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33416"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb",
"url": "https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667",
"url": "https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25",
"url": "https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1",
"url": "https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/pull/824",
"url": "https://github.com/pnggroup/libpng/pull/824"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j"
}
],
"release_date": "2026-03-26T16:48:54.174000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:10:45+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9345"
},
{
"category": "workaround",
"details": "To reduce exposure, avoid processing untrusted PNG image files with applications that utilize libpng. Restricting the source of PNG images to trusted origins can limit the attack surface.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Arbitrary code execution due to use-after-free vulnerability"
},
{
"cve": "CVE-2026-33636",
"cwe": {
"id": "CWE-124",
"name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
},
"discovery_date": "2026-03-26T18:02:51.339603+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451819"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to dereferencing pointers before the start of the row buffer and writing expanded pixel data to underflowed positions. This flaw can result in information disclosure and denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33636"
},
{
"category": "external",
"summary": "RHBZ#2451819",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451819"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33636"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869",
"url": "https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3",
"url": "https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2"
}
],
"release_date": "2026-03-26T16:51:58.289000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:10:45+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debuginfo-0:140.9.1-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:thunderbird-debugsource-0:140.9.1-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion"
}
]
}
RHSA-2026:9638
Vulnerability from csaf_redhat - Published: 2026-04-22 07:39 - Updated: 2026-06-30 04:20Summary
Red Hat Security Advisory: thunderbird security update
Severity
Important
Notes
Topic: An update for thunderbird is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)
* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)
* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
8.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions, integer overflow in the Graphics: Text component
8.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
8.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can still be referenced, leading to a use-after-free condition. An attacker could potentially exploit this to achieve arbitrary code execution or cause a denial of service.
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to dereferencing pointers before the start of the row buffer and writing expanded pixel data to underflowed positions. This flaw can result in information disclosure and denial of service.
7.6 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
43 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for thunderbird is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nSecurity Fix(es):\n\n* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)\n\n* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)\n\n* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)\n\n* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)\n\n* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:9638",
"url": "https://access.redhat.com/errata/RHSA-2026:9638"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2451805",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451805"
},
{
"category": "external",
"summary": "2451819",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451819"
},
{
"category": "external",
"summary": "2455897",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455897"
},
{
"category": "external",
"summary": "2455901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455901"
},
{
"category": "external",
"summary": "2455908",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455908"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9638.json"
}
],
"title": "Red Hat Security Advisory: thunderbird security update",
"tracking": {
"current_release_date": "2026-06-30T04:20:24+00:00",
"generator": {
"date": "2026-06-30T04:20:24+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.0"
}
},
"id": "RHSA-2026:9638",
"initial_release_date": "2026-04-22T07:39:47+00:00",
"revision_history": [
{
"date": "2026-04-22T07:39:47+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-22T07:39:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-30T04:20:24+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:140.9.1-1.el10_1.src",
"product": {
"name": "thunderbird-0:140.9.1-1.el10_1.src",
"product_id": "thunderbird-0:140.9.1-1.el10_1.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird@140.9.1-1.el10_1?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:140.9.1-1.el10_1.x86_64",
"product": {
"name": "thunderbird-0:140.9.1-1.el10_1.x86_64",
"product_id": "thunderbird-0:140.9.1-1.el10_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird@140.9.1-1.el10_1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64",
"product": {
"name": "thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64",
"product_id": "thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debugsource@140.9.1-1.el10_1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64",
"product": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64",
"product_id": "thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.9.1-1.el10_1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:140.9.1-1.el10_1.aarch64",
"product": {
"name": "thunderbird-0:140.9.1-1.el10_1.aarch64",
"product_id": "thunderbird-0:140.9.1-1.el10_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird@140.9.1-1.el10_1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64",
"product": {
"name": "thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64",
"product_id": "thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debugsource@140.9.1-1.el10_1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64",
"product": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64",
"product_id": "thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.9.1-1.el10_1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:140.9.1-1.el10_1.ppc64le",
"product": {
"name": "thunderbird-0:140.9.1-1.el10_1.ppc64le",
"product_id": "thunderbird-0:140.9.1-1.el10_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird@140.9.1-1.el10_1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le",
"product": {
"name": "thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le",
"product_id": "thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debugsource@140.9.1-1.el10_1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"product": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"product_id": "thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.9.1-1.el10_1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-0:140.9.1-1.el10_1.s390x",
"product": {
"name": "thunderbird-0:140.9.1-1.el10_1.s390x",
"product_id": "thunderbird-0:140.9.1-1.el10_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird@140.9.1-1.el10_1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debugsource-0:140.9.1-1.el10_1.s390x",
"product": {
"name": "thunderbird-debugsource-0:140.9.1-1.el10_1.s390x",
"product_id": "thunderbird-debugsource-0:140.9.1-1.el10_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debugsource@140.9.1-1.el10_1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x",
"product": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x",
"product_id": "thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thunderbird-debuginfo@140.9.1-1.el10_1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64"
},
"product_reference": "thunderbird-0:140.9.1-1.el10_1.aarch64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le"
},
"product_reference": "thunderbird-0:140.9.1-1.el10_1.ppc64le",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x"
},
"product_reference": "thunderbird-0:140.9.1-1.el10_1.s390x",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el10_1.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src"
},
"product_reference": "thunderbird-0:140.9.1-1.el10_1.src",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-0:140.9.1-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64"
},
"product_reference": "thunderbird-0:140.9.1-1.el10_1.x86_64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64"
},
"product_reference": "thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le"
},
"product_reference": "thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x"
},
"product_reference": "thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64"
},
"product_reference": "thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64"
},
"product_reference": "thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le"
},
"product_reference": "thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debugsource-0:140.9.1-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x"
},
"product_reference": "thunderbird-debugsource-0:140.9.1-1.el10_1.s390x",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64"
},
"product_reference": "thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64",
"relates_to_product_reference": "AppStream-10.1.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-5731",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-07T13:01:15.389776+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455901"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5731"
},
{
"category": "external",
"summary": "RHBZ#2455901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455901"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5731",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5731"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5731",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5731"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5731",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5731"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5731",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5731"
}
],
"release_date": "2026-04-07T12:43:11.895000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T07:39:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9638"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2"
},
{
"cve": "CVE-2026-5732",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-07T13:01:39.095775+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455908"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions, integer overflow in the Graphics: Text component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5732"
},
{
"category": "external",
"summary": "RHBZ#2455908",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455908"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5732",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5732"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5732",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5732"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5732",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5732"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5732",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5732"
}
],
"release_date": "2026-04-07T12:43:12.829000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T07:39:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9638"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component"
},
{
"cve": "CVE-2026-5734",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-07T13:01:01.022958+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455897"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5734"
},
{
"category": "external",
"summary": "RHBZ#2455897",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455897"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5734",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5734"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5734",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5734"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5734",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5734"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5734",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5734"
}
],
"release_date": "2026-04-07T12:43:14.833000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T07:39:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9638"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2"
},
{
"cve": "CVE-2026-33416",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-03-26T18:01:55.592413+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451805"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can still be referenced, leading to a use-after-free condition. An attacker could potentially exploit this to achieve arbitrary code execution or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Arbitrary code execution due to use-after-free vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33416"
},
{
"category": "external",
"summary": "RHBZ#2451805",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451805"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33416"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33416",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33416"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb",
"url": "https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667",
"url": "https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25",
"url": "https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1",
"url": "https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/pull/824",
"url": "https://github.com/pnggroup/libpng/pull/824"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j"
}
],
"release_date": "2026-03-26T16:48:54.174000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T07:39:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9638"
},
{
"category": "workaround",
"details": "To reduce exposure, avoid processing untrusted PNG image files with applications that utilize libpng. Restricting the source of PNG images to trusted origins can limit the attack surface.",
"product_ids": [
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Arbitrary code execution due to use-after-free vulnerability"
},
{
"cve": "CVE-2026-33636",
"cwe": {
"id": "CWE-124",
"name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
},
"discovery_date": "2026-03-26T18:02:51.339603+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451819"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to dereferencing pointers before the start of the row buffer and writing expanded pixel data to underflowed positions. This flaw can result in information disclosure and denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33636"
},
{
"category": "external",
"summary": "RHBZ#2451819",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451819"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33636"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869",
"url": "https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3",
"url": "https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2"
}
],
"release_date": "2026-03-26T16:51:58.289000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T07:39:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9638"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.src",
"AppStream-10.1.Z:thunderbird-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debuginfo-0:140.9.1-1.el10_1.x86_64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.aarch64",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.ppc64le",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.s390x",
"AppStream-10.1.Z:thunderbird-debugsource-0:140.9.1-1.el10_1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion"
}
]
}
SUSE-SU-2026:1273-1
Vulnerability from csaf_suse - Published: 2026-04-11 19:04 - Updated: 2026-04-11 19:04Summary
Security update for MozillaFirefox
Severity
Important
Notes
Title of the patch: Security update for MozillaFirefox
Description of the patch: This update for MozillaFirefox fixes the following issues:
- Update to 149.0.2 and 140.9.1esr (bsc#1261663).
- CVE-2026-5731: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2.
- CVE-2026-5732: Incorrect boundary conditions, integer overflow in the Graphics: Text component.
- CVE-2026-5734: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2.
Patchnames: SUSE-2026-1273,SUSE-SLE-SERVER-12-SP5-LTSS-2026-1273,SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-1273
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-devel-140.9.1-112.307.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-140.9.1-112.307.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-devel-140.9.1-112.307.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.8 (High)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-devel-140.9.1-112.307.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-140.9.1-112.307.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-devel-140.9.1-112.307.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-devel-140.9.1-112.307.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-140.9.1-112.307.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-devel-140.9.1-112.307.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
14 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for MozillaFirefox",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for MozillaFirefox fixes the following issues:\n\n- Update to 149.0.2 and 140.9.1esr (bsc#1261663).\n- CVE-2026-5731: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2.\n- CVE-2026-5732: Incorrect boundary conditions, integer overflow in the Graphics: Text component.\n- CVE-2026-5734: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-1273,SUSE-SLE-SERVER-12-SP5-LTSS-2026-1273,SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-1273",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_1273-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:1273-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20261273-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:1273-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045420.html"
},
{
"category": "self",
"summary": "SUSE Bug 1261663",
"url": "https://bugzilla.suse.com/1261663"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-5731 page",
"url": "https://www.suse.com/security/cve/CVE-2026-5731/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-5732 page",
"url": "https://www.suse.com/security/cve/CVE-2026-5732/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-5734 page",
"url": "https://www.suse.com/security/cve/CVE-2026-5734/"
}
],
"title": "Security update for MozillaFirefox",
"tracking": {
"current_release_date": "2026-04-11T19:04:46Z",
"generator": {
"date": "2026-04-11T19:04:46Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:1273-1",
"initial_release_date": "2026-04-11T19:04:46Z",
"revision_history": [
{
"date": "2026-04-11T19:04:46Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "MozillaFirefox-140.9.1-112.307.1.aarch64",
"product": {
"name": "MozillaFirefox-140.9.1-112.307.1.aarch64",
"product_id": "MozillaFirefox-140.9.1-112.307.1.aarch64"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-branding-upstream-140.9.1-112.307.1.aarch64",
"product": {
"name": "MozillaFirefox-branding-upstream-140.9.1-112.307.1.aarch64",
"product_id": "MozillaFirefox-branding-upstream-140.9.1-112.307.1.aarch64"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-translations-common-140.9.1-112.307.1.aarch64",
"product": {
"name": "MozillaFirefox-translations-common-140.9.1-112.307.1.aarch64",
"product_id": "MozillaFirefox-translations-common-140.9.1-112.307.1.aarch64"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-translations-other-140.9.1-112.307.1.aarch64",
"product": {
"name": "MozillaFirefox-translations-other-140.9.1-112.307.1.aarch64",
"product_id": "MozillaFirefox-translations-other-140.9.1-112.307.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "MozillaFirefox-devel-140.9.1-112.307.1.noarch",
"product": {
"name": "MozillaFirefox-devel-140.9.1-112.307.1.noarch",
"product_id": "MozillaFirefox-devel-140.9.1-112.307.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "MozillaFirefox-140.9.1-112.307.1.ppc64le",
"product": {
"name": "MozillaFirefox-140.9.1-112.307.1.ppc64le",
"product_id": "MozillaFirefox-140.9.1-112.307.1.ppc64le"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-branding-upstream-140.9.1-112.307.1.ppc64le",
"product": {
"name": "MozillaFirefox-branding-upstream-140.9.1-112.307.1.ppc64le",
"product_id": "MozillaFirefox-branding-upstream-140.9.1-112.307.1.ppc64le"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-translations-common-140.9.1-112.307.1.ppc64le",
"product": {
"name": "MozillaFirefox-translations-common-140.9.1-112.307.1.ppc64le",
"product_id": "MozillaFirefox-translations-common-140.9.1-112.307.1.ppc64le"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-translations-other-140.9.1-112.307.1.ppc64le",
"product": {
"name": "MozillaFirefox-translations-other-140.9.1-112.307.1.ppc64le",
"product_id": "MozillaFirefox-translations-other-140.9.1-112.307.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "MozillaFirefox-140.9.1-112.307.1.s390x",
"product": {
"name": "MozillaFirefox-140.9.1-112.307.1.s390x",
"product_id": "MozillaFirefox-140.9.1-112.307.1.s390x"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-branding-upstream-140.9.1-112.307.1.s390x",
"product": {
"name": "MozillaFirefox-branding-upstream-140.9.1-112.307.1.s390x",
"product_id": "MozillaFirefox-branding-upstream-140.9.1-112.307.1.s390x"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-translations-common-140.9.1-112.307.1.s390x",
"product": {
"name": "MozillaFirefox-translations-common-140.9.1-112.307.1.s390x",
"product_id": "MozillaFirefox-translations-common-140.9.1-112.307.1.s390x"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-translations-other-140.9.1-112.307.1.s390x",
"product": {
"name": "MozillaFirefox-translations-other-140.9.1-112.307.1.s390x",
"product_id": "MozillaFirefox-translations-other-140.9.1-112.307.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "MozillaFirefox-140.9.1-112.307.1.x86_64",
"product": {
"name": "MozillaFirefox-140.9.1-112.307.1.x86_64",
"product_id": "MozillaFirefox-140.9.1-112.307.1.x86_64"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-branding-upstream-140.9.1-112.307.1.x86_64",
"product": {
"name": "MozillaFirefox-branding-upstream-140.9.1-112.307.1.x86_64",
"product_id": "MozillaFirefox-branding-upstream-140.9.1-112.307.1.x86_64"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64",
"product": {
"name": "MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64",
"product_id": "MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-translations-other-140.9.1-112.307.1.x86_64",
"product": {
"name": "MozillaFirefox-translations-other-140.9.1-112.307.1.x86_64",
"product_id": "MozillaFirefox-translations-other-140.9.1-112.307.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP5-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:12:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
"product": {
"name": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
"product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss-extended-security:12:sp5"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-112.307.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.aarch64"
},
"product_reference": "MozillaFirefox-140.9.1-112.307.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-112.307.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.ppc64le"
},
"product_reference": "MozillaFirefox-140.9.1-112.307.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-112.307.1.s390x as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.s390x"
},
"product_reference": "MozillaFirefox-140.9.1-112.307.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-112.307.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.x86_64"
},
"product_reference": "MozillaFirefox-140.9.1-112.307.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-devel-140.9.1-112.307.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-devel-140.9.1-112.307.1.noarch"
},
"product_reference": "MozillaFirefox-devel-140.9.1-112.307.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-112.307.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.aarch64"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-112.307.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-112.307.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.ppc64le"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-112.307.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-112.307.1.s390x as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.s390x"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-112.307.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-112.307.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
"product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-140.9.1-112.307.1.x86_64"
},
"product_reference": "MozillaFirefox-140.9.1-112.307.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-devel-140.9.1-112.307.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
"product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-devel-140.9.1-112.307.1.noarch"
},
"product_reference": "MozillaFirefox-devel-140.9.1-112.307.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
"product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-5731",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-5731"
}
],
"notes": [
{
"category": "general",
"text": "Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.s390x",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-devel-140.9.1-112.307.1.noarch",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.s390x",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-devel-140.9.1-112.307.1.noarch",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-5731",
"url": "https://www.suse.com/security/cve/CVE-2026-5731"
},
{
"category": "external",
"summary": "SUSE Bug 1261663 for CVE-2026-5731",
"url": "https://bugzilla.suse.com/1261663"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.s390x",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-devel-140.9.1-112.307.1.noarch",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.s390x",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-devel-140.9.1-112.307.1.noarch",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.s390x",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-devel-140.9.1-112.307.1.noarch",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.s390x",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-devel-140.9.1-112.307.1.noarch",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-11T19:04:46Z",
"details": "important"
}
],
"title": "CVE-2026-5731"
},
{
"cve": "CVE-2026-5732",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-5732"
}
],
"notes": [
{
"category": "general",
"text": "Incorrect boundary conditions, integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.s390x",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-devel-140.9.1-112.307.1.noarch",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.s390x",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-devel-140.9.1-112.307.1.noarch",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-5732",
"url": "https://www.suse.com/security/cve/CVE-2026-5732"
},
{
"category": "external",
"summary": "SUSE Bug 1261663 for CVE-2026-5732",
"url": "https://bugzilla.suse.com/1261663"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.s390x",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-devel-140.9.1-112.307.1.noarch",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.s390x",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-devel-140.9.1-112.307.1.noarch",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.s390x",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-devel-140.9.1-112.307.1.noarch",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.s390x",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-devel-140.9.1-112.307.1.noarch",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-11T19:04:46Z",
"details": "important"
}
],
"title": "CVE-2026-5732"
},
{
"cve": "CVE-2026-5734",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-5734"
}
],
"notes": [
{
"category": "general",
"text": "Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.s390x",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-devel-140.9.1-112.307.1.noarch",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.s390x",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-devel-140.9.1-112.307.1.noarch",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-5734",
"url": "https://www.suse.com/security/cve/CVE-2026-5734"
},
{
"category": "external",
"summary": "SUSE Bug 1261663 for CVE-2026-5734",
"url": "https://bugzilla.suse.com/1261663"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.s390x",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-devel-140.9.1-112.307.1.noarch",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.s390x",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-devel-140.9.1-112.307.1.noarch",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.s390x",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-devel-140.9.1-112.307.1.noarch",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.s390x",
"SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-140.9.1-112.307.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-devel-140.9.1-112.307.1.noarch",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:MozillaFirefox-translations-common-140.9.1-112.307.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-11T19:04:46Z",
"details": "important"
}
],
"title": "CVE-2026-5734"
}
]
}
SUSE-SU-2026:1322-1
Vulnerability from csaf_suse - Published: 2026-04-14 12:42 - Updated: 2026-04-14 12:42Summary
Security update for MozillaFirefox
Severity
Important
Notes
Title of the patch: Security update for MozillaFirefox
Description of the patch: This update for MozillaFirefox fixes the following issues:
- Update to 149.0.2 and 140.9.1esr (bsc#1261663).
- CVE-2026-5731: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2.
- CVE-2026-5732: Incorrect boundary conditions, integer overflow in the Graphics: Text component.
- CVE-2026-5734: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2.
Patchnames: SUSE-2026-1322,SUSE-SLE-Module-Desktop-Applications-15-SP7-2026-1322,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1322,SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1322,SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-1322,SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-1322,SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1322,SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-1322,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1322,SUSE-SLE-Product-SLES_SAP-15-SP4-2026-1322,SUSE-SLE-Product-SLES_SAP-15-SP5-2026-1322,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1322
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.8 (High)
Affected products
Recommended
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
101 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
14 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for MozillaFirefox",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for MozillaFirefox fixes the following issues:\n\n- Update to 149.0.2 and 140.9.1esr (bsc#1261663).\n- CVE-2026-5731: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2.\n- CVE-2026-5732: Incorrect boundary conditions, integer overflow in the Graphics: Text component.\n- CVE-2026-5734: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-1322,SUSE-SLE-Module-Desktop-Applications-15-SP7-2026-1322,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1322,SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1322,SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-1322,SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-1322,SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1322,SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-1322,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1322,SUSE-SLE-Product-SLES_SAP-15-SP4-2026-1322,SUSE-SLE-Product-SLES_SAP-15-SP5-2026-1322,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1322",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_1322-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:1322-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20261322-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:1322-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045525.html"
},
{
"category": "self",
"summary": "SUSE Bug 1261663",
"url": "https://bugzilla.suse.com/1261663"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-5731 page",
"url": "https://www.suse.com/security/cve/CVE-2026-5731/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-5732 page",
"url": "https://www.suse.com/security/cve/CVE-2026-5732/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-5734 page",
"url": "https://www.suse.com/security/cve/CVE-2026-5734/"
}
],
"title": "Security update for MozillaFirefox",
"tracking": {
"current_release_date": "2026-04-14T12:42:11Z",
"generator": {
"date": "2026-04-14T12:42:11Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:1322-1",
"initial_release_date": "2026-04-14T12:42:11Z",
"revision_history": [
{
"date": "2026-04-14T12:42:11Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"product": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"product_id": "MozillaFirefox-140.9.1-150200.152.228.1.aarch64"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-branding-upstream-140.9.1-150200.152.228.1.aarch64",
"product": {
"name": "MozillaFirefox-branding-upstream-140.9.1-150200.152.228.1.aarch64",
"product_id": "MozillaFirefox-branding-upstream-140.9.1-150200.152.228.1.aarch64"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"product": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"product_id": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"product": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"product_id": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"product": {
"name": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"product_id": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"product": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"product_id": "MozillaFirefox-140.9.1-150200.152.228.1.ppc64le"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-branding-upstream-140.9.1-150200.152.228.1.ppc64le",
"product": {
"name": "MozillaFirefox-branding-upstream-140.9.1-150200.152.228.1.ppc64le",
"product_id": "MozillaFirefox-branding-upstream-140.9.1-150200.152.228.1.ppc64le"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"product": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"product_id": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"product": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"product_id": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"product": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"product_id": "MozillaFirefox-140.9.1-150200.152.228.1.s390x"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-branding-upstream-140.9.1-150200.152.228.1.s390x",
"product": {
"name": "MozillaFirefox-branding-upstream-140.9.1-150200.152.228.1.s390x",
"product_id": "MozillaFirefox-branding-upstream-140.9.1-150200.152.228.1.s390x"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"product": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"product_id": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"product": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"product_id": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"product": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"product_id": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-branding-upstream-140.9.1-150200.152.228.1.x86_64",
"product": {
"name": "MozillaFirefox-branding-upstream-140.9.1-150200.152.228.1.x86_64",
"product_id": "MozillaFirefox-branding-upstream-140.9.1-150200.152.228.1.x86_64"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"product": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"product_id": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64"
}
},
{
"category": "product_version",
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"product": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"product_id": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-desktop-applications:15:sp7"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-espos:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-espos:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp6"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.ppc64le as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.s390x as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.s390x"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch"
},
"product_reference": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch"
},
"product_reference": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch"
},
"product_reference": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch"
},
"product_reference": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch"
},
"product_reference": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.s390x as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch"
},
"product_reference": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.s390x as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch"
},
"product_reference": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.s390x as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch"
},
"product_reference": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch"
},
"product_reference": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch"
},
"product_reference": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch"
},
"product_reference": "MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64"
},
"product_reference": "MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-5731",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-5731"
}
],
"notes": [
{
"category": "general",
"text": "Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-5731",
"url": "https://www.suse.com/security/cve/CVE-2026-5731"
},
{
"category": "external",
"summary": "SUSE Bug 1261663 for CVE-2026-5731",
"url": "https://bugzilla.suse.com/1261663"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-14T12:42:11Z",
"details": "important"
}
],
"title": "CVE-2026-5731"
},
{
"cve": "CVE-2026-5732",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-5732"
}
],
"notes": [
{
"category": "general",
"text": "Incorrect boundary conditions, integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-5732",
"url": "https://www.suse.com/security/cve/CVE-2026-5732"
},
{
"category": "external",
"summary": "SUSE Bug 1261663 for CVE-2026-5732",
"url": "https://bugzilla.suse.com/1261663"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-14T12:42:11Z",
"details": "important"
}
],
"title": "CVE-2026-5732"
},
{
"cve": "CVE-2026-5734",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-5734"
}
],
"notes": [
{
"category": "general",
"text": "Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-5734",
"url": "https://www.suse.com/security/cve/CVE-2026-5734"
},
{
"category": "external",
"summary": "SUSE Bug 1261663 for CVE-2026-5734",
"url": "https://bugzilla.suse.com/1261663"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.s390x",
"SUSE Linux Enterprise Server 15 SP6-LTSS:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-devel-140.9.1-150200.152.228.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-common-140.9.1-150200.152.228.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:MozillaFirefox-translations-other-140.9.1-150200.152.228.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-14T12:42:11Z",
"details": "important"
}
],
"title": "CVE-2026-5734"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…