Description:
Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component (CVE-2025-9182)
* thunderbird: firefox: Sandbox escape due to invalid pointer in the Audio/Video: GMP component (CVE-2025-9179)
* thunderbird: firefox: Same-origin policy bypass in the Graphics: Canvas2D component (CVE-2025-9180)
* thunderbird: firefox: Uninitialized memory in the JavaScript Engine component (CVE-2025-9181)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 (CVE-2025-9185)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Updated packages listed below:
| Architecture |
Package |
Checksum |
| aarch64 |
thunderbird-128.14.0-3.el10_0.alma.1.aarch64.rpm |
4d0b39a8f14d2ed027fbabf00b0e862fa276ece1b04b6fad90047d6da0f519c9 |
| ppc64le |
thunderbird-128.14.0-3.el10_0.alma.1.ppc64le.rpm |
fdcdf7129b65cab3c125903abfadaef1a2c6f19b04e1b85dae3971126bcc4f9f |
| s390x |
thunderbird-128.14.0-3.el10_0.alma.1.s390x.rpm |
e17f2ef33dec0871dedd1d3612df86bdf5e69e64f9ac81b9519715144578d3ff |
| x86_64 |
thunderbird-128.14.0-3.el10_0.alma.1.x86_64.rpm |
cba7af3a59bb48df23f7fb6267b4dde55cb914f953f7ff12ec7bc84d9beb3114 |
| x86_64_v2 |
thunderbird-128.14.0-3.el10_0.alma.1.x86_64_v2.rpm |
1cd24d221c83af3f24a609f151e05c30de2a22622a9855faa1f5a4660c1f435c |
