[DSA 6351-1] thunderbird security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-6351-1                   [email protected]
https://www.debian.org/security/                       Moritz Muehlenhoff
June 18, 2026                         https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : thunderbird
CVE ID         : CVE-2026-12289 CVE-2026-12290 CVE-2026-12291 CVE-2026-12292 
                 CVE-2026-12294 CVE-2026-12295 CVE-2026-12296 CVE-2026-12297 
                 CVE-2026-12298 CVE-2026-12299 CVE-2026-12302 CVE-2026-12304 
                 CVE-2026-12305 CVE-2026-12306 CVE-2026-12307 CVE-2026-12308 
                 CVE-2026-12309 CVE-2026-12310 CVE-2026-12311 CVE-2026-12312 
                 CVE-2026-12313 CVE-2026-12314 CVE-2026-12315 CVE-2026-12324 
                 CVE-2026-12325 CVE-2026-12327 CVE-2026-12328 CVE-2026-12329 
                 CVE-2026-12330

Multiple security issues were discovered in Thunderbird, which could
result in the execution of arbitrary code.

For the stable distribution (trixie), these problems have been fixed in
version 1:140.12.0esr-1~deb13u1.

We recommend that you upgrade your thunderbird packages.

For the detailed security status of thunderbird please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/thunderbird

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmo0PCQACgkQEMKTtsN8
TjZzcRAAsWv4DATxk5LskP2+ty7ZRaO+9PNwJBWU9+z5wqfL/5xIt+gaTH62HM/f
0olC9gBcB92r1u07i3dgeepv2/8B1EtIW+iu6HnAxhHYvaBgp/c/CTxz99CZ6w6S
LEfCGWgV6qnz04HKuj6Zd9ZLA5ZoQQ3ml/sc8CtKq77uGLRsEwnro36uyJKzxYVO
9FphHsKHHMUaBNFHr7W8QWZMLs56o/eU8pB75WsmX0osGkLjbpzkF+EmcxyWr/cv
s5/SjpZ7NTKfNpSHTiBHULblKe8VgBvyEgv+gt5VCVLlf2jQc7JxCkgBOU1ONyjF
PlgC5/oRPRG02nRDX2EnvNIzbcgyfQ3+nZh5nJdmbgxQJR0liN8tnM9tLIRE/92i
ZaghxpnjGZ+Nk9YOx3B56Uqak4IMF7JMp12JaJTjHnc17PTkr9/G3+oM5fKYcYep
blxCN+B+lZITE18r16/HKNpWrKmJku1god4dSc8xTYMMfiTbdi9W6pRWqK6m4W5t
Kcj/bxW2LYnF7sOxtYUHM9Aqj7NfQdkvCRqjKSPPuMDZqk0bntekez3mDgvS7Ctu
/7y/oaHkC3HS/NpHs/6pQD/H7c57lKOJQwKnYOVrveyFv9GoZbW7JUjeotitFRVC
ueNNny/o9fowMZM5O8n7DDzBFO3EX+q4GwRQ7x7gOj+1ielAGCw=
=WQZQ
-----END PGP SIGNATURE-----