Description:
Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)
* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)
* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Updated packages listed below:
| Architecture |
Package |
Checksum |
| aarch64 |
thunderbird-140.9.1-1.el10_1.alma.1.aarch64.rpm |
05cc41815a960b0ee99a6263cacc490946f9503f94b8d841bac007fcbc1e1de5 |
| ppc64le |
thunderbird-140.9.1-1.el10_1.alma.1.ppc64le.rpm |
4afea41b45bd735fb46773cfb8ed9d9706d05ae957c7d348fc9579014a3ab0f0 |
| s390x |
thunderbird-140.9.1-1.el10_1.alma.1.s390x.rpm |
6b083b1e64eb1c155815ff418e163d77a866d6937d614b519d90330637875f11 |
| x86_64 |
thunderbird-140.9.1-1.el10_1.alma.1.x86_64.rpm |
14260fe206ba94a6d22980da9209fe7e60d5c04991066f19b8aae68cc5faebd8 |
| x86_64_v2 |
thunderbird-140.9.1-1.el10_1.alma.1.x86_64_v2.rpm |
5a43c4fa323708d4ab8e4509b29ef8bdaec03655479a482fb6324952fa5c60fb |
