An update for thunderbird is now available for openEuler-24.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3195 Final 1.0 1.0 2026-08-01 Initial 2026-08-01 2026-08-01 openEuler SA Tool V1.0 2026-08-01 thunderbird security update An update for thunderbird is now available for openEuler-24.03-LTS-SP4 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.(CVE-2026-14899) We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-15718) We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-15719) Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16349) Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16350) Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16351) Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16352) Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16353) Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16354) JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16355) Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16356) Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16357) Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16358) Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16359) Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16360) Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-16361) Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16362) JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16363) Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16368) Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16369) Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16371) Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16374) Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16375) Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16377) Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16379) Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16381) Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16383) Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16387) Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16390) Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16391) Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16396) Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16405) Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16412) An update for thunderbird is now available for openEuler-24.03-LTS-SP4/openEuler-24.03-LTS-SP2. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical thunderbird https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-14899 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-15718 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-15719 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16349 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16350 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16351 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16352 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16353 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16354 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16355 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16356 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16357 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16358 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16359 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16360 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16361 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16362 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16363 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16368 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16369 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16371 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16374 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16375 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16377 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16379 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16381 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16383 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16387 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16390 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16391 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16396 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16405 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16412 https://nvd.nist.gov/vuln/detail/CVE-2026-14899 https://nvd.nist.gov/vuln/detail/CVE-2026-15718 https://nvd.nist.gov/vuln/detail/CVE-2026-15719 https://nvd.nist.gov/vuln/detail/CVE-2026-16349 https://nvd.nist.gov/vuln/detail/CVE-2026-16350 https://nvd.nist.gov/vuln/detail/CVE-2026-16351 https://nvd.nist.gov/vuln/detail/CVE-2026-16352 https://nvd.nist.gov/vuln/detail/CVE-2026-16353 https://nvd.nist.gov/vuln/detail/CVE-2026-16354 https://nvd.nist.gov/vuln/detail/CVE-2026-16355 https://nvd.nist.gov/vuln/detail/CVE-2026-16356 https://nvd.nist.gov/vuln/detail/CVE-2026-16357 https://nvd.nist.gov/vuln/detail/CVE-2026-16358 https://nvd.nist.gov/vuln/detail/CVE-2026-16359 https://nvd.nist.gov/vuln/detail/CVE-2026-16360 https://nvd.nist.gov/vuln/detail/CVE-2026-16361 https://nvd.nist.gov/vuln/detail/CVE-2026-16362 https://nvd.nist.gov/vuln/detail/CVE-2026-16363 https://nvd.nist.gov/vuln/detail/CVE-2026-16368 https://nvd.nist.gov/vuln/detail/CVE-2026-16369 https://nvd.nist.gov/vuln/detail/CVE-2026-16371 https://nvd.nist.gov/vuln/detail/CVE-2026-16374 https://nvd.nist.gov/vuln/detail/CVE-2026-16375 https://nvd.nist.gov/vuln/detail/CVE-2026-16377 https://nvd.nist.gov/vuln/detail/CVE-2026-16379 https://nvd.nist.gov/vuln/detail/CVE-2026-16381 https://nvd.nist.gov/vuln/detail/CVE-2026-16383 https://nvd.nist.gov/vuln/detail/CVE-2026-16387 https://nvd.nist.gov/vuln/detail/CVE-2026-16390 https://nvd.nist.gov/vuln/detail/CVE-2026-16391 https://nvd.nist.gov/vuln/detail/CVE-2026-16396 https://nvd.nist.gov/vuln/detail/CVE-2026-16405 https://nvd.nist.gov/vuln/detail/CVE-2026-16412 openEuler-24.03-LTS-SP4 thunderbird-140.13.0-1.oe2403sp4.x86_64.rpm thunderbird-debuginfo-140.13.0-1.oe2403sp4.x86_64.rpm thunderbird-debugsource-140.13.0-1.oe2403sp4.x86_64.rpm thunderbird-librnp-rnp-140.13.0-1.oe2403sp4.x86_64.rpm thunderbird-wayland-140.13.0-1.oe2403sp4.x86_64.rpm thunderbird-140.13.0-1.oe2403sp4.aarch64.rpm thunderbird-debuginfo-140.13.0-1.oe2403sp4.aarch64.rpm thunderbird-debugsource-140.13.0-1.oe2403sp4.aarch64.rpm thunderbird-librnp-rnp-140.13.0-1.oe2403sp4.aarch64.rpm thunderbird-wayland-140.13.0-1.oe2403sp4.aarch64.rpm thunderbird-140.13.0-1.oe2403sp4.src.rpm The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13. 2026-08-01 CVE-2026-14899 openEuler-24.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13. 2026-08-01 CVE-2026-15718 openEuler-24.03-LTS-SP4 Medium 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13. 2026-08-01 CVE-2026-15719 openEuler-24.03-LTS-SP4 Medium 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16349 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16350 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16351 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16352 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16353 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16354 openEuler-24.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16355 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16356 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16357 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16358 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16359 openEuler-24.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16360 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13. 2026-08-01 CVE-2026-16361 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16362 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16363 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16368 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16369 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16371 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16374 openEuler-24.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16375 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16377 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16379 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16381 openEuler-24.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16383 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16387 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16390 openEuler-24.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16391 openEuler-24.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16396 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16405 openEuler-24.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195 Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. 2026-08-01 CVE-2026-16412 openEuler-24.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H thunderbird security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195