[DSA 6103-1] thunderbird security update

Moritz Muehlenhoff <[email protected]> Sat, 17 Jan 2026 16:51:37 +0000
Newsgroups	gmane.linux.debian.user.security.announce
Message-ID	<[email protected]>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-6103-1                   [email protected]
https://www.debian.org/security/                       Moritz Muehlenhoff
January 17, 2026                      https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : thunderbird
CVE ID         : CVE-2025-14327 CVE-2026-0877 CVE-2026-0878 CVE-2026-0879 
                 CVE-2026-0880 CVE-2026-0882 CVE-2026-0883 CVE-2026-0884 
                 CVE-2026-0885 CVE-2026-0886 CVE-2026-0887 CVE-2026-0890 
                 CVE-2026-0891

Multiple security issues were discovered in Thunderbird, which could
result in the execution of arbitrary code.

For the oldstable distribution (bookworm), these problems have been fixed
in version 1:140.7.0esr-1~deb12u1.

For the stable distribution (trixie), these problems have been fixed in
version 1:140.7.0esr-1~deb13u1.

We recommend that you upgrade your thunderbird packages.

For the detailed security status of thunderbird please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/thunderbird

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmlrlnIACgkQEMKTtsN8
TjaKsg/8Diq9q/E90MtkjWEtBxi96VD1BhdDoAhXIqlYK5orombKFNOtFXULoEmS
vjPoskr9ydiFUpXO/Kg1aAsPgUfhjP+++xM9ZHal/08QDhlRi9oV232wkbMnAl7d
hCDxmoENSdMdi/tvkED5vfgc5eUTI0b5938TImlPOzIbSO9+F2j/mJXWeMFrmkbg
JhFAq5E/mMvILBhhRYErUkwdInANRMHXeGcEoryrbRKMwUISEoAsm+2sR7yrBOwD
/QlgL1Y2rdSnzCkOUxKWBNk9TxBgVJKq2LknpEQTDDal9RVIzfIabOxuebG1FsM0
HrT5tVBXQMzLrt9WfVTOu4a3AKHw7pgs5C7OQK7CFyIKcdAcx52I+M5CWcmILEHd
pKaqOWavoaXPvjW2qwBmWokZWydVRqDQlEuIcL6AMtOZ1dBsVjJUtC3Vc8MeY4ec
dHsEhl9a/h8HFk2/Kl02pdpa1IuMELCKhY6YaVZsb29+haJ7rdZ3hM+e3ly1pbFN
8Pl3aMTBd/vu9B8BpDnjFsqc+I2nnSWNY8ykFB0z23uQIViBvcQ4riHaiMG4bzt4
JxTISnVwevbpVjsMZLEn15tWJ/nSr/wMHDbHsEajgRvQTMWUTyCh9jBhAE2z/1Kp
nQoXmnG//1mIEhbxJ5SxAn6Y4w/bD2SpMDRXC9pB7vlBdrxkfWA=
=0qRk
-----END PGP SIGNATURE-----