DeutschShown in its original language — a full translation is planned for a future version.
Mozilla Firefox und Thunderbird: Mehrere Schwachstellen
view advisory published 2026-09-01
Ein Angreifer kann mehrere Schwachstellen in Mozilla Firefox und Thunderbird ausnutzen, um Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, sensible Informationen offenzulegen, Daten zu manipulieren, Spoofing-Angriffe durchzuführen, möglicherweise durch Speicherbeschädigungen beliebigen Code auszuführen oder Denial-of-Service-Zustände herbeizuführen.
01
describes (38)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-84642US | — | — | ||
The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow… | ||||
| CVE-2026-84641US | — | — | ||
A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerab… | ||||
| CVE-2026-84640US | — | — | ||
A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 1… | ||||
| CVE-2026-84639US | — | — | ||
Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbi… | ||||
| CVE-2026-84637US | — | — | ||
Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protect… | ||||
| CVE-2026-84145US | — | — | ||
Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-rele… | ||||
| CVE-2026-84144US | — | — | ||
Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presu… | ||||
| CVE-2026-84143US | critical9.8 | — | ||
Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-rele… | ||||
| CVE-2026-84142US | critical9.8 | — | ||
Internally found bugs present in Thunderbird 154. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort… | ||||
| CVE-2026-84141US | critical9.8 | — | ||
Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. | ||||
| CVE-2026-84140US | critical9.8 | — | ||
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. | ||||
| CVE-2026-84139US | medium6.1 | — | ||
Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. | ||||
| CVE-2026-84138US | medium6.5 | — | ||
Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155 and Thunderbird 155. | ||||
| CVE-2026-84137US | medium4.3 | — | ||
Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. | ||||
| CVE-2026-84136US | medium6.1 | — | ||
Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. | ||||
| CVE-2026-84135US | critical9.8 | — | ||
Other issue in Firefox Focus for Android. This vulnerability was fixed in Firefox 155. | ||||
| CVE-2026-84134US | — | — | ||
Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. | ||||
| CVE-2026-84133US | — | — | ||
Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. | ||||
| CVE-2026-84132US | — | — | ||
Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. | ||||
| CVE-2026-84131US | — | — | ||
Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thund… | ||||
showing 20 of 38
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:67129 vom 2026-09-14external
- Red Hat Security Advisory RHSA-2026:67133 vom 2026-09-14external
- Red Hat Security Advisory RHSA-2026:68549 vom 2026-09-17external
- Red Hat Security Advisory RHSA-2026:70642 vom 2026-09-23external
- Red Hat Security Advisory RHSA-2026:73130 vom 2026-09-29external
- Red Hat Security Advisory RHSA-2026:73971 vom 2026-09-30external
- Red Hat Security Advisory RHSA-2026:76740 vom 2026-10-06external
- Red Hat Security Advisory RHSA-2026:76741 vom 2026-10-06external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan