Multiple vulnerabilities in Mozilla Thunderbird

Descripción

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface.

Below is a complete list of vulnerabilities:

1. A remote code execution vulnerability in libmime buffer growth could lead to heap corruption can be exploited remotely to execute arbitrary code.
2. Denial of service vulnerability in the Exchange email component can be exploited remotely to cause denial of service.
3. Security vulnerability in the Application Update component can be exploited to bypass security restrictions.
4. A remote code execution vulnerability in the Networking component can be exploited remotely to execute arbitrary code.
5. A remote code execution vulnerability in the Storage: IndexedDB component can be exploited remotely to execute arbitrary code.
6. Denial of service vulnerability in the Networking component can be exploited remotely to cause denial of service.
7. Security vulnerability in the Security: Process Sandboxing component can be exploited to bypass security restrictions.
8. A remote code execution vulnerability in the Graphics: Text component can be exploited remotely to execute arbitrary code.
9. A remote code execution vulnerability in the Graphics: Canvas2D component can be exploited remotely to execute arbitrary code.
10. Denial of service vulnerability in the Graphics component can be exploited remotely to cause denial of service.
11. A remote code execution vulnerability in the Crash Reporting component can be exploited remotely to execute arbitrary code.
12. Denial of service vulnerability in the Layout component can be exploited remotely to cause denial of service.
13. Denial of service vulnerability in the JavaScript Engine component can be exploited remotely to cause denial of service.
14. A remote code execution vulnerability in the DOM: Bindings (WebIDL) component can be exploited remotely to execute arbitrary code.
15. A remote code execution vulnerability in the XML component can be exploited remotely to execute arbitrary code.
16. A remote code execution vulnerability in the Graphics: CanvasWebGL component can be exploited remotely to execute arbitrary code.
17. Security vulnerability can be exploited to bypass security restrictions.
18. Denial of service vulnerability in the JavaScript Engine: JIT component can be exploited remotely to cause denial of service.
19. A remote code execution vulnerability in the Layout: Text and Fonts component can be exploited remotely to execute arbitrary code.
20. A remote code execution vulnerability in the DOM: Core & HTML component can be exploited remotely to execute arbitrary code.
21. A remote code execution vulnerability in the SVG component can be exploited remotely to execute arbitrary code.
22. A remote code execution vulnerability in the Audio/Video component can be exploited remotely to execute arbitrary code.
23. A remote code execution vulnerability in the DOM: Animation component can be exploited remotely to execute arbitrary code.
24. A remote code execution vulnerability in the JavaScript Engine: JIT component can be exploited remotely to execute arbitrary code.
25. A remote code execution vulnerability in the Graphics component can be exploited remotely to execute arbitrary code.
26. Denial of service vulnerability in the Graphics: Canvas2D component can be exploited remotely to cause denial of service.
27. A remote code execution vulnerability in the DOM: Streams component can be exploited remotely to execute arbitrary code.
28. Security vulnerability in the File Handling component can be exploited to bypass security restrictions.
29. Security vulnerability in the DOM: Security component can be exploited to bypass security restrictions.
30. Security vulnerability in the Enterprise Policies component can be exploited to bypass security restrictions.
31. A remote code execution vulnerability in the Audio/Video: Playback component can be exploited remotely to execute arbitrary code.
32. Security vulnerability in the WebExtensions component can be exploited to bypass security restrictions.
33. Denial of service vulnerability in the Widget: Win32 component can be exploited remotely to cause denial of service.
34. A remote code execution vulnerability in the Storage: Bucket File System component can be exploited remotely to execute arbitrary code.
35. Information disclosure vulnerability in the PDF Viewer component can be exploited to obtain sensitive information.
36. Security vulnerability in the Panning and Zooming component can be exploited to bypass security restrictions.
37. Denial of service vulnerability in the DOM: File component can be exploited remotely to cause denial of service.
38. Denial of service vulnerability in the DOM: Web Serial component can be exploited remotely to cause denial of service.
39. Denial of service vulnerability in the Address Bar component can be exploited remotely to cause denial of service.
40. A remote code execution vulnerability in the JavaScript: WebAssembly component can be exploited remotely to execute arbitrary code.
41. Information disclosure vulnerability in the Networking component can be exploited to obtain sensitive information.
42. A remote code execution vulnerability in the DOM: Workers component can be exploited remotely to execute arbitrary code.
43. Denial of service vulnerability in the DOM: Editor component can be exploited remotely to cause denial of service.
44. Security vulnerability in the DOM: Content Processes component can be exploited to bypass security restrictions.
45. Security vulnerability in the DOM: Navigation component can be exploited to bypass security restrictions.
46. Security vulnerability in the Networking: HTTP component can be exploited to bypass security restrictions.
47. Denial of service vulnerability in the SVG component can be exploited remotely to cause denial of service.
48. Denial of service vulnerability in the Site Reports component can be exploited remotely to cause denial of service.
49. Information disclosure vulnerability in the Networking: Cache component can be exploited to obtain sensitive information.
50. Security UI vulnerability in the DOM: Web Serial component can be exploited to spoof user interface.
51. Information disclosure vulnerability in the WebRTC: Networking component can be exploited to obtain sensitive information.
52. Security vulnerability in the DevTools component can be exploited to bypass security restrictions.
53. Denial of service vulnerability in the Sync component can be exploited remotely to cause denial of service.
54. Denial of service vulnerability in the DOM: Notifications component can be exploited remotely to cause denial of service.
55. Denial of service vulnerability in the WebRTC component can be exploited remotely to cause denial of service.
56. A remote code execution vulnerability in the XPCOM component can be exploited remotely to execute arbitrary code.
57. Information disclosure vulnerability in the Storage: IndexedDB component can be exploited to obtain sensitive information.
58. A remote code execution vulnerability in the Networking: DNS component can be exploited remotely to execute arbitrary code.
59. Security vulnerability in the DOM: Core & HTML component can be exploited to bypass security restrictions.
60. Denial of service vulnerability in the Printing: Output component can be exploited remotely to cause denial of service.

Notas informativas originales

• MFSA2026-109

Explotación

Public exploits exist for this vulnerability.

Productos relacionados

• Mozilla-Thunderbird

Lista CVE

• CVE-2026-106016
  critical
• CVE-2026-109704
  critical
• CVE-2026-109705
  critical
• CVE-2026-109706
  high
• CVE-2026-109707
  critical
• CVE-2026-109708
  critical
• CVE-2026-109709
  critical
• CVE-2026-109710
  high
• CVE-2026-109711
  high
• CVE-2026-109712
  high
• CVE-2026-109713
  high
• CVE-2026-109714
  high
• CVE-2026-109715
  critical
• CVE-2026-109716
  critical
• CVE-2026-109717
  high
• CVE-2026-109718
  high
• CVE-2026-109719
  warning
• CVE-2026-109720
  high
• CVE-2026-109721
  high
• CVE-2026-109722
  critical
• CVE-2026-109723
  high
• CVE-2026-109724
  high
• CVE-2026-109725
  high
• CVE-2026-109726
  high
• CVE-2026-109727
  high
• CVE-2026-109728
  high
• CVE-2026-109729
  high
• CVE-2026-109730
  critical
• CVE-2026-109731
  high
• CVE-2026-109732
  high
• CVE-2026-109733
  critical
• CVE-2026-109734
  critical
• CVE-2026-109735
  high
• CVE-2026-109736
  critical
• CVE-2026-109737
  critical
• CVE-2026-109738
  high
• CVE-2026-109739
  critical
• CVE-2026-109740
  critical
• CVE-2026-109741
  high
• CVE-2026-109742
  warning
• CVE-2026-109743
  critical
• CVE-2026-109744
  critical
• CVE-2026-109745
  critical
• CVE-2026-109746
  high
• CVE-2026-109747
  high
• CVE-2026-109748
  high
• CVE-2026-109749
  high
• CVE-2026-109750
  critical
• CVE-2026-109751
  warning
• CVE-2026-109752
  high
• CVE-2026-109753
  critical
• CVE-2026-109754
  critical
• CVE-2026-109755
  critical
• CVE-2026-109756
  critical
• CVE-2026-109757
  critical
• CVE-2026-109759
  critical
• CVE-2026-109760
  critical
• CVE-2026-109761
  high
• CVE-2026-109762
  critical
• CVE-2026-109763
  unknown
• CVE-2026-109764
  high
• CVE-2026-109765
  warning
• CVE-2026-109766
  critical
• CVE-2026-109767
  warning
• CVE-2026-109768
  high
• CVE-2026-109769
  warning
• CVE-2026-109770
  high
• CVE-2026-109771
  warning
• CVE-2026-109772
  unknown
• CVE-2026-109773
  high
• CVE-2026-109774
  unknown
• CVE-2026-109775
  high
• CVE-2026-109776
  warning
• CVE-2026-109777
  warning
• CVE-2026-109778
  critical
• CVE-2026-109779
  warning
• CVE-2026-109780
  unknown
• CVE-2026-109781
  high
• CVE-2026-110247
  critical
• CVE-2026-110249
  critical

Leer más

Conozca las estadísticas de las vulnerabilidades que se propagan en su región statistics.securelist.com