DeutschShown in its original language — a full translation is planned for a future version.
Mozilla Produkte (Thunderbird, Firefox ESR und Firefox): Mehrere Schwachstellen
view advisory published 2026-10-20
Ein Angreifer kann mehrere Schwachstellen in Mozilla Thunderbird, Mozilla Firefox ESR und Mozilla Firefox ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen und um Daten zu manipulieren.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-113869US | — | — | ||
When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be… | ||||
| CVE-2026-113868US | — | — | ||
When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that c… | ||||
| CVE-2026-113867US | — | — | ||
Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user… | ||||
| CVE-2026-113866US | — | — | ||
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request includ… | ||||
| CVE-2026-113470US | — | — | ||
Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1,… | ||||
| CVE-2026-113401US | — | — | ||
Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. | ||||
| CVE-2026-113400US | — | — | ||
Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. | ||||
| CVE-2026-113399US | — | — | ||
Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2026-500449 vom 2026-10-21external
- Oracle Linux Security Advisory ELSA-2026-500450 vom 2026-10-21external
- Oracle Linux Security Advisory ELSA-2026-500451 vom 2026-10-21external
- Amazon Linux Security Advisory ALAS2-2026-4037 vom 2026-10-25external
- Amazon Linux Security Advisory ALAS2FIREFOX-2026-068 vom 2026-10-25external
- Oracle Linux Security Advisory ELSA-2026-500496 vom 2026-10-23external
- Debian Security Advisory DLA-4847 vom 2026-10-21external
- Debian Security Advisory DLA-4863 vom 2026-10-26external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan