Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package MozillaThunderbird for openSUSE:Factory checked in at 2026-10-29 16:09:46 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/MozillaThunderbird (Old) and /work/SRC/openSUSE:Factory/.MozillaThunderbird.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "MozillaThunderbird" Thu Oct 29 16:09:46 2026 rev:398 rq:1393557 version:153.6.0 Changes: -------- --- /work/SRC/openSUSE:Factory/MozillaThunderbird/MozillaThunderbird.changes 2026-10-22 15:55:45.943859302 +0200 +++ /work/SRC/openSUSE:Factory/.MozillaThunderbird.new.1255/MozillaThunderbird.changes 2026-10-29 16:12:05.873548926 +0100 @@ -1,0 +2,350 @@ +Wed Oct 28 21:58:09 UTC 2026 - Wolfgang Rosenauer <[email protected]> + +- Mozilla Thunderbird 153.6.0 ESR + * Sent messages could fail to save without displaying a warning + MFSA 2026-122 (bsc#1286955) + * CVE-2026-118174 (bmo#2080910) + Displaying a message could load an attacker-chosen URL + through an OpenPGP key attachment + * CVE-2026-118175 (bmo#2081720) + Content of other messages could be included when replying to + a crafted message + * CVE-2026-118176 (bmo#2081141) + Bypass of remote UNC path restriction in mailbox: URLs + * CVE-2026-118177 (bmo#2080924) + Calendar discovery accepted local file and remote network + share locations + * CVE-2026-118178 (bmo#2075772) + RSS feed could redirect its subscription to a local file or + network share + * CVE-2026-118179 (bmo#2077789) + Request forgery via news: links + * CVE-2026-118180 (bmo#2080939) + Matrix homeserver could redirect the chat session to a local + file or network share + * CVE-2026-110247 (bmo#2071621) + Integer overflow in libmime buffer growth could lead to heap + corruption + * CVE-2026-113869 (bmo#2075530) + Use-after-free in S/MIME decryption during a security device + password prompt + * CVE-2026-117860 (bmo#2046558) + Same-origin policy bypass in the DOM: Navigation component + * CVE-2026-117861 (bmo#2053240) + Sandbox escape in the DOM: Navigation component + * CVE-2026-117862 (bmo#2054644) + Privilege escalation due to incorrect boundary conditions in + the Networking component + * CVE-2026-117863 (bmo#2056783) + Information disclosure due to uninitialized memory in the + Audio/Video component + * CVE-2026-117864 (bmo#2058614) + Sandbox escape in the Form Manager component + * CVE-2026-117865 (bmo#2058653) + Use-after-free in the JavaScript: GC component + * CVE-2026-117866 (bmo#2059011) + Privilege escalation due to use-after-free in the Graphics: + Canvas2D component + * CVE-2026-117867 (bmo#2059110) + Use-after-free in the Layout component + * CVE-2026-117868 (bmo#2059961) + Sandbox escape in the DOM: Networking component + * CVE-2026-117869 (bmo#2068362) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-117870 (bmo#2068395) + Use-after-free in the JavaScript Engine component + * CVE-2026-117871 (bmo#2068400) + Invalid pointer in the Graphics component + * CVE-2026-117872 (bmo#2068410) + Use-after-free in the JavaScript: Standard Library component + * CVE-2026-117873 (bmo#2071733) + Incorrect boundary conditions in the Audio/Video: Playback + component + * CVE-2026-117874 (bmo#2073685) + Use-after-free in the Internationalization component + * CVE-2026-117875 (bmo#2073686) + Use-after-free in the Layout: Scrolling and Overflow + component + * CVE-2026-117876 (bmo#2074167) + Use-after-free in the Layout: Text and Fonts component + * CVE-2026-117877 (bmo#2074209) + Use-after-free in the Layout: Text and Fonts component + * CVE-2026-117878 (bmo#2075431) + Other issue, use-after-free in the Storage: IndexedDB + component + * CVE-2026-117879 (bmo#2075432) + Incorrect boundary conditions in the Layout: Tables component + * CVE-2026-117880 (bmo#2075996) + Use-after-free in the XML component + * CVE-2026-117881 (bmo#2076267) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-117882 (bmo#2076268) + Use-after-free in the Layout component + * CVE-2026-117883 (bmo#2076271) + Use-after-free in the DOM: HTML Parser component + * CVE-2026-117884 (bmo#2076410) + Use-after-free in the Networking component + * CVE-2026-117885 (bmo#2076983) + Use-after-free in the Layout: Grid component + * CVE-2026-117886 (bmo#2077162) + Incorrect boundary conditions in the Graphics: Text component + * CVE-2026-117887 (bmo#2077385) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-117888 (bmo#2078649) + Uninitialized memory in the Graphics: Canvas2D component + * CVE-2026-117889 (bmo#2078727) + Incorrect boundary conditions in the JavaScript Engine component + * CVE-2026-117890 (bmo#2078749) + JIT miscompilation in the JavaScript Engine: JIT component + * CVE-2026-117891 (bmo#2078837) + Use-after-free in the JavaScript Engine: JIT component + * CVE-2026-117892 (bmo#2078902) + Privilege escalation due to use-after-free in the WebRTC: + Networking component + * CVE-2026-117893 (bmo#2078946) + Incorrect boundary conditions in the Security: PSM component + * CVE-2026-117894 (bmo#2078983) + Incorrect boundary conditions in the WebRTC: Signaling component + * CVE-2026-117895 (bmo#2078994) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-117896 (bmo#2079032) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-117897 (bmo#2079036) + Incorrect boundary conditions in the Layout: Tables component + * CVE-2026-117898 (bmo#2079040) + Use-after-free in the JavaScript Engine: JIT component + * CVE-2026-117899 (bmo#2079046) + Use-after-free in the Networking: HTTP component + * CVE-2026-117900 (bmo#2079053) + Use-after-free in the DOM: Editor component + * CVE-2026-117901 (bmo#2079054) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-117902 (bmo#2079057) + Use-after-free in the Layout: Text and Fonts component + * CVE-2026-117903 (bmo#2079058) + Use-after-free in the Audio/Video component + * CVE-2026-117904 (bmo#2079059) + Use-after-free in the JavaScript: GC component + * CVE-2026-117905 (bmo#2079061) + Use-after-free in the Audio/Video: Playback component + * CVE-2026-117906 (bmo#2079062) + Use-after-free in the CSS Parsing and Computation component + * CVE-2026-117907 (bmo#2079068) + Use-after-free in the Networking component + * CVE-2026-117908 (bmo#2079069) + Use-after-free in the Graphics: ImageLib component + * CVE-2026-117909 (bmo#2079155) + Use-after-free in the JavaScript: GC component + * CVE-2026-117910 (bmo#2079156) + Invalid pointer in the JavaScript Engine component + * CVE-2026-117911 (bmo#2079171) + Use-after-free in the Audio/Video: Playback component + * CVE-2026-117912 (bmo#2079209) + Same-origin policy bypass in the CSS Parsing and Computation + component + * CVE-2026-117913 (bmo#2079252) + Use-after-free in the SVG component + * CVE-2026-117914 (bmo#2079253) + Use-after-free in the SVG component + * CVE-2026-117915 (bmo#2079255) + Incorrect boundary conditions in the Layout: Block and Inline + component + * CVE-2026-117916 (bmo#2079257) + Use-after-free in the XSLT component + * CVE-2026-117917 (bmo#2079301) + Invalid pointer in the Graphics: WebRender component + * CVE-2026-117918 (bmo#2079676) + Use-after-free in the Graphics: Canvas2D component + * CVE-2026-117919 (bmo#2079677) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-117920 (bmo#2079681) + Use-after-free in the DOM: HTML Parser component + * CVE-2026-117921 (bmo#2079687) + Use-after-free in the CSS Parsing and Computation component + * CVE-2026-117922 (bmo#2079692) + Use-after-free in the Networking: WebSockets component + * CVE-2026-117923 (bmo#2079781) + Use-after-free in the Audio/Video component + * CVE-2026-117924 (bmo#2079783) + Use-after-free in the XSLT component + * CVE-2026-117925 (bmo#2079786) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-117926 (bmo#2079924) + Incorrect boundary conditions in the SVG component + * CVE-2026-117927 (bmo#2080102) + Use-after-free in the SVG component + * CVE-2026-117928 (bmo#2081280) + Same-origin policy bypass in the CSS Parsing and Computation + component + * CVE-2026-117929 (bmo#2081549) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-117930 (bmo#2081953) + Use-after-free in the DOM: Bindings (WebIDL) component + * CVE-2026-117931 (bmo#2081969) + Use-after-free in the DOM: Events component + * CVE-2026-117932 (bmo#2081975) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-117933 (bmo#2081976) + Frame poisoning in the CSS Parsing and Computation component + * CVE-2026-117934 (bmo#2081977) + Use-after-free in the Layout component + * CVE-2026-117935 (bmo#2082000) + Use-after-free in the DOM: Bindings (WebIDL) component + * CVE-2026-117936 (bmo#2082001) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-117937 (bmo#2082005) + Invalid pointer in the JavaScript Engine component + * CVE-2026-117938 (bmo#2082009) + Use-after-free in the Layout component + * CVE-2026-117939 (bmo#2082030) + Use-after-free in the XML component + * CVE-2026-117940 (bmo#2082031) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-117941 (bmo#2082044) + Use-after-free in the DOM: CSS Object Model component + * CVE-2026-117942 (bmo#2082047) + Incorrect boundary conditions in the JavaScript Engine: JIT + component + * CVE-2026-117943 (bmo#2082061) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-117944 (bmo#2082064) + Use-after-free in the Layout component + * CVE-2026-117945 (bmo#2082076) + Incorrect boundary conditions in the XML component + * CVE-2026-117946 (bmo#2082092) + Incorrect boundary conditions in the JavaScript Engine + component + * CVE-2026-117947 (bmo#2082100) + Use-after-free in the XML component + * CVE-2026-117948 (bmo#2082112) + Use-after-free in the SVG component + * CVE-2026-117949 (bmo#2082118) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-117950 (bmo#2082127) + Incorrect boundary conditions in the DOM: Core & HTML + component + * CVE-2026-117951 (bmo#2082130) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-117952 (bmo#2082139) + Uninitialized memory in the Networking component + * CVE-2026-117953 (bmo#2082199) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-117954 (bmo#2082450) + Use-after-free in the Layout: Positioned component + * CVE-2026-117955 (bmo#2043044) + JIT miscompilation in the JavaScript: WebAssembly component + * CVE-2026-100801 (bmo#2057112) + Privilege escalation in the DLL Services component + * CVE-2026-117956 (bmo#2058659) + Invalid pointer in the Nimbus Desktop Client component + * CVE-2026-117957 (bmo#2061508) + Cryptographic issue in the WebRTC: Networking component + * CVE-2026-117958 (bmo#2061509) + Site isolation issue in the Networking: HTTP component + * CVE-2026-117959 (bmo#2067292) + Site isolation issue in the DOM: Service Workers component + * CVE-2026-117960 (bmo#2067647) + Spoofing issue in the DOM: Core & HTML component + * CVE-2026-117961 (bmo#2068458) + Incorrect boundary conditions in the Layout: Text and Fonts + component + * CVE-2026-117962 (bmo#2072411) + Sandbox escape due to incorrect boundary conditions in the + Storage: Quota Manager component + * CVE-2026-117963 (bmo#2073660) + Incorrect boundary conditions in the DOM: Service Workers + component + * CVE-2026-117964 (bmo#2074199) + Use-after-free in the Panning and Zooming component + * CVE-2026-117965 (bmo#2075126) + Same-origin policy bypass in the Address Bar component + * CVE-2026-117966 (bmo#2075726) + Site isolation issue in the Networking: HTTP component + * CVE-2026-117967 (bmo#2075930) + Mitigation bypass in the DOM: Security component + * CVE-2026-117968 (bmo#2075985) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-117969 (bmo#2075990) + Invalid pointer in the JavaScript Engine: JIT component + * CVE-2026-117970 (bmo#2076227) + Race condition in the Disability Access APIs component + * CVE-2026-117971 (bmo#2076399) + Sandbox escape due to use-after-free in the Print Preview + component + * CVE-2026-117972 (bmo#2076415) + Use-after-free in the Graphics component + * CVE-2026-117973 (bmo#2076704) + Use-after-free in the Networking: DNS component + * CVE-2026-117974 (bmo#2076705) + Use-after-free in the XML component + * CVE-2026-117975 (bmo#2076714) + Sandbox escape due to invalid pointer in the Graphics: + WebRender component + * CVE-2026-117976 (bmo#2076816) + Site isolation issue in the DOM: Navigation component + * CVE-2026-117977 (bmo#2077418) + Other issue in the Console component + * CVE-2026-117978 (bmo#2077730) + Incorrect boundary conditions in the Graphics component + * CVE-2026-117979 (bmo#2077739) + Incorrect boundary conditions in the Graphics: WebRender + component + * CVE-2026-117980 (bmo#2078145) + Use-after-free in the Graphics component + * CVE-2026-117981 (bmo#2078167) + Privilege escalation in the Toolkit component + * CVE-2026-117982 (bmo#2078855) + Invalid pointer in the JavaScript Engine: JIT component ++++ 53 more lines (skipped) ++++ between /work/SRC/openSUSE:Factory/MozillaThunderbird/MozillaThunderbird.changes ++++ and /work/SRC/openSUSE:Factory/.MozillaThunderbird.new.1255/MozillaThunderbird.changes Old: ---- l10n-153.5.1esr.tar.xz thunderbird-153.5.1esr.source.tar.xz thunderbird-153.5.1esr.source.tar.xz.asc New: ---- l10n-153.6.0esr.tar.xz thunderbird-153.6.0esr.source.tar.xz thunderbird-153.6.0esr.source.tar.xz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ MozillaThunderbird.spec ++++++ --- /var/tmp/diff_new_pack.KMhmVD/_old 2026-10-29 16:12:32.810678598 +0100 +++ /var/tmp/diff_new_pack.KMhmVD/_new 2026-10-29 16:12:32.812678681 +0100 @@ -30,8 +30,8 @@ # major 69 # mainver %%major.99 %define major 153 -%define mainver %major.5.1 -%define orig_version 153.5.1 +%define mainver %major.6.0 +%define orig_version 153.6.0 %define orig_suffix esr %define update_channel esr %define source_prefix thunderbird-%{orig_version} ++++++ l10n-153.5.1esr.tar.xz -> l10n-153.6.0esr.tar.xz ++++++ /work/SRC/openSUSE:Factory/MozillaThunderbird/l10n-153.5.1esr.tar.xz /work/SRC/openSUSE:Factory/.MozillaThunderbird.new.1255/l10n-153.6.0esr.tar.xz differ: char 15, line 1 ++++++ tar_stamps ++++++ --- /var/tmp/diff_new_pack.KMhmVD/_old 2026-10-29 16:12:33.111691221 +0100 +++ /var/tmp/diff_new_pack.KMhmVD/_new 2026-10-29 16:12:33.116691431 +0100 @@ -1,11 +1,11 @@ PRODUCT="thunderbird" CHANNEL="esr153" -VERSION="153.5.1" +VERSION="153.6.0" VERSION_SUFFIX="esr" -REV_VERSION="153.5.0" +REV_VERSION="153.5.1" PREV_VERSION_SUFFIX="esr" #SKIP_LOCALES="" # Uncomment to skip l10n and compare-locales-generation RELEASE_REPO="https://hg.mozilla.org/releases/comm-esr153"; -RELEASE_TAG="982ea48372bc85e3107d9d137cd96654ee862131" -RELEASE_TIMESTAMP="20261020144802" +RELEASE_TAG="c3fd7a6092572ef295fd562948356e5cea174bbb" +RELEASE_TIMESTAMP="20261026222624" ++++++ thunderbird-153.5.1esr.source.tar.xz -> thunderbird-153.6.0esr.source.tar.xz ++++++ /work/SRC/openSUSE:Factory/MozillaThunderbird/thunderbird-153.5.1esr.source.tar.xz /work/SRC/openSUSE:Factory/.MozillaThunderbird.new.1255/thunderbird-153.6.0esr.source.tar.xz differ: char 15, line 1 ++++++ thunderbird.desktop ++++++ --- /var/tmp/diff_new_pack.KMhmVD/_old 2026-10-29 16:12:33.201694996 +0100 +++ /var/tmp/diff_new_pack.KMhmVD/_new 2026-10-29 16:12:33.205695164 +0100 @@ -9,5 +9,6 @@ Terminal=false Type=Application StartupNotify=true +Categories=Network;GTK; MimeType=x-scheme-handler/mailto; ++++++ thunderbird.desktop.in ++++++ --- /var/tmp/diff_new_pack.KMhmVD/_old 2026-10-29 16:12:33.233696338 +0100 +++ /var/tmp/diff_new_pack.KMhmVD/_new 2026-10-29 16:12:33.237696506 +0100 @@ -9,5 +9,6 @@ Terminal=false Type=Application StartupNotify=true +Categories=Network;GTK; MimeType=x-scheme-handler/mailto;
