DeutschShown in its original language — a full translation is planned for a future version.
Mozilla Firefox und Thunderbird: Mehrere Schwachstellen
view advisory published 2026-01-13
Ein Angreifer kann mehrere Schwachstellen in Mozilla Firefox und Thunderbird ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Spoofing-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, Speicherbeschädigungen zu verursachen, die möglicherweise zur Ausführung von beliebigem Code führen, oder andere nicht näher definierte Angriffe durchzuführen.
01
describes (17)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-0892US | — | — | ||
Memory safety bugs present in Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could ha… | ||||
| CVE-2026-0891US | — | — | ||
Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that… | ||||
| CVE-2026-0890US | — | — | ||
Spoofing issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. | ||||
| CVE-2026-0889US | — | — | ||
Denial-of-service in the DOM: Service Workers component. This vulnerability was fixed in Firefox 147 and Thunderbird 147. | ||||
| CVE-2026-0888US | — | — | ||
Information disclosure in the XML component. This vulnerability was fixed in Firefox 147 and Thunderbird 147. | ||||
| CVE-2026-0887US | — | — | ||
Clickjacking issue, information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. | ||||
| CVE-2026-0886US | — | — | ||
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. | ||||
| CVE-2026-0885US | — | — | ||
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. | ||||
| CVE-2026-0884US | — | — | ||
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. | ||||
| CVE-2026-0883US | — | — | ||
Information disclosure in the Networking component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. | ||||
| CVE-2026-0882US | — | — | ||
Use-after-free in the IPC component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. | ||||
| CVE-2026-0881US | — | — | ||
Sandbox escape in the Messaging System component. This vulnerability was fixed in Firefox 147 and Thunderbird 147. | ||||
| CVE-2026-0880US | — | — | ||
Sandbox escape due to integer overflow in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbi… | ||||
| CVE-2026-0879US | — | — | ||
Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147,… | ||||
| CVE-2026-0878US | — | — | ||
Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thu… | ||||
| CVE-2026-0877US | — | — | ||
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. | ||||
| CVE-2025-14327US | high7.5 | — | ||
Spoofing issue in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird 140.7. | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2026-2271 vom 2026-02-10external
- Oracle Linux Security Advisory ELSA-2026-2286 vom 2026-02-10external
- Red Hat Security Advisory RHSA-2026:0667 vom 2026-01-15external
- Red Hat Security Advisory RHSA-2026:0694 vom 2026-01-15external
- Red Hat Security Advisory RHSA-2026:0924 vom 2026-01-21external
- Red Hat Security Advisory RHSA-2026:1320 vom 2026-01-27external
- Red Hat Security Advisory RHSA-2026:1413 vom 2026-01-27external
- Red Hat Security Advisory RHSA-2026:1414 vom 2026-01-27external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan