Your message dated Wed, 02 Sep 2026 17:37:22 +0000
with message-id <[email protected]>
and subject line Bug#900210: fixed in thunderbird 1:153.2.0esr-1
has caused the Debian Bug report #900210,
regarding /etc/apparmor.d/usr.bin.thunderbird: breaks stuff with custom $TMPDIR
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
900210: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900210
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: thunderbird
Version: 1:52.8.0-1~deb9u1
Severity: important
Attempting to send e-mail results in a popup:
[ Send Message Error ]
Sending of the message failed.
# aa-status --enabled && echo "AppArmor Enabled"
AppArmor Enabled
# aa-status | egrep '(profiles|thunderbird)'
54 profiles are loaded.
21 profiles are in enforce mode.
thunderbird
thunderbird//browser_java
thunderbird//browser_openjdk
thunderbird//gpg
thunderbird//sanitized_helper
33 profiles are in complain mode.
6 processes have profiles defined.
thunderbird (32689)
dmesg shows the following apparmor DENIED messages:
[62711.954571] audit: type=1400 audit(1527437094.186:58): apparmor="DENIED"
operation="open" profile="thunderbird" name="/run/user/1000/xauth-1000-_0"
pid=32700 comm="thunderbird" requested_mask="r" denied_mask="r" fsuid=1000
ouid=1000
[62711.960341] audit: type=1400 audit(1527437094.194:59): apparmor="DENIED"
operation="open" profile="thunderbird" name="/run/user/1000/xauth-1000-_0"
pid=32689 comm="thunderbird" requested_mask="r" denied_mask="r" fsuid=1000
ouid=1000
[62711.971343] audit: type=1400 audit(1527437094.202:60): apparmor="DENIED"
operation="mkdir" profile="thunderbird"
name="/run/user/1000/thunderbird_sdowdy/" pid=32689 comm="thunderbird"
requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
[62711.971925] audit: type=1400 audit(1527437094.206:61): apparmor="DENIED"
operation="open" profile="thunderbird" name="/run/user/1000/xauth-1000-_0"
pid=32689 comm="thunderbird" requested_mask="r" denied_mask="r" fsuid=1000
ouid=1000
[62712.747197] audit: type=1400 audit(1527437094.978:62): apparmor="DENIED"
operation="open" profile="thunderbird" name="/run/user/1000/xauth-1000-_0"
pid=32689 comm="thunderbird" requested_mask="r" denied_mask="r" fsuid=1000
ouid=1000
[62712.895221] audit: type=1400 audit(1527437095.126:63): apparmor="DENIED"
operation="open" profile="thunderbird" name="/etc/xdg/mimeapps.list" pid=32689
comm="thunderbird" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[63310.628483] audit: type=1400 audit(1527437692.863:64): apparmor="DENIED"
operation="mknod" profile="thunderbird" name="/run/user/1000/nsemail.eml"
pid=32689 comm="thunderbird" requested_mask="c" denied_mask="c" fsuid=1000
ouid=1000
[63310.671468] audit: type=1400 audit(1527437692.907:65): apparmor="DENIED"
operation="open" profile="thunderbird" name="/run/user/1000/xauth-1000-_0"
pid=32689 comm="thunderbird" requested_mask="r" denied_mask="r" fsuid=1000
ouid=1000
$ env | grep /run/user
TMPDIR=/run/user/1000/
GPG_AGENT_INFO=/run/user/1000/gnupg/S.gpg-agent:0:1
DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus
XDG_RUNTIME_DIR=/run/user/1000
XAUTHORITY=/run/user/1000/xauth-1000-_0
I suspect because i explicitly set TMPDIR to XDG_RUNTIME_DIR (something that
should be pretty normal, even better than using /tmp, IMHO), that AppArmor
should allow for this.
(i'm not entirely sure that's the issue, but it seems likely)
Also, for general purposes...
I did choose to allow/use maintainer's version of AppArmor configuration in the
recent update, however, i think you should respect the existing
enforce/complain/disable state of the user's system, as i'd previously done:
aa-complain /etc/apparmor.d/usr.bin.thunderbird
(which i am back to now in order to keep working)
thanks,
--stephen
-- System Information:
Debian Release: 9.4
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 4.16.0-0.bpo.1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=
(charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages thunderbird depends on:
ii debianutils 4.8.1.1
ii fontconfig 2.11.0-6.7+b1
ii libatk1.0-0 2.22.0-1
ii libc6 2.24-11+deb9u3
ii libcairo-gobject2 1.14.8-1
ii libcairo2 1.14.8-1
ii libdbus-1-3 1.10.26-0+deb9u1
ii libdbus-glib-1-2 0.108-2
ii libevent-2.0-5 2.0.21-stable-3
ii libffi6 3.2.1-6
ii libfontconfig1 2.11.0-6.7+b1
ii libfreetype6 2.6.3-3.2
ii libgcc1 1:6.3.0-18+deb9u1
ii libgdk-pixbuf2.0-0 2.36.5-2+deb9u2
ii libglib2.0-0 2.50.3-2
ii libgtk-3-0 3.22.11-1
ii libhunspell-1.4-0 1.4.1-2+b2
ii libpango-1.0-0 1.40.5-1
ii libpangocairo-1.0-0 1.40.5-1
ii libpangoft2-1.0-0 1.40.5-1
ii libpixman-1-0 0.34.0-1
ii libstartup-notification0 0.12-4+b2
ii libstdc++6 6.3.0-18+deb9u1
ii libvpx4 1.6.1-3+deb9u1
ii libx11-6 2:1.6.4-3
ii libx11-xcb1 2:1.6.4-3
ii libxcb-shm0 1.12-1
ii libxcb1 1.12-1
ii libxcomposite1 1:0.4.4-2
ii libxdamage1 1:1.1.4-2+b3
ii libxext6 2:1.3.3-1+b2
ii libxfixes3 1:5.0.3-1
ii libxrender1 1:0.9.10-1
ii libxt6 1:1.1.5-1
ii psmisc 22.21-2.1+b2
ii x11-utils 7.7+3+b1
ii zlib1g 1:1.2.8.dfsg-5
Versions of packages thunderbird recommends:
ii hunspell-en-us [hunspell-dictionary] 20070829-7
ii lightning 1:52.8.0-1~deb9u1
Versions of packages thunderbird suggests:
ii apparmor 2.11.0-3+deb9u2
pn fonts-lyx <none>
ii libgssapi-krb5-2 1.15-1+deb9u1
-- debconf-show failed
--- End Message ---
--- Begin Message ---
Source: thunderbird
Source-Version: 1:153.2.0esr-1
Done: Carsten Schoenert <[email protected]>
We believe that the bug you reported is fixed in the latest version of
thunderbird, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Carsten Schoenert <[email protected]> (supplier of updated thunderbird
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 01 Sep 2026 19:03:49 +0200
Source: thunderbird
Architecture: source
Version: 1:153.2.0esr-1
Distribution: unstable
Urgency: medium
Maintainer: Carsten Schoenert <[email protected]>
Changed-By: Carsten Schoenert <[email protected]>
Closes: 880424 882218 883245 900210 909281 914403 917613 928178 949450 949649
955380 961269 1127710 1128672 1145329
Changes:
thunderbird (1:153.2.0esr-1) unstable; urgency=medium
.
[ Carsten Schoenert ]
* [cb6c2c5] Merge tag 'debian/1%153.1.0esr-1' into debian/sid
* [3c5e98e] d/gbp.conf: Adjust upstream branch to new ESR cycle
* [628233d] New upstream version 153.2.0esr
Fixed CVE issues in upstream version 153.2 (MFSA 2026-88):
CVE-2026-84639: Uninitialized memory in MIME parsing
CVE-2026-84640: One byte overflow read in mail parser
CVE-2026-84641: Information disclosure due to malicious IMAP server
response
CVE-2026-84637: Calendar invitation attachments could launch local
executables
CVE-2026-84642: Allowed UNC hostnames for attachments interpreted as a
regular expression
CVE-2026-75874: Sandbox escape in the Remote Settings Client component
CVE-2026-84118: Use-after-free in the JavaScript: GC component
CVE-2026-84119: Sandbox escape due to use-after-free in the DOM:
Navigation component
CVE-2026-84120: Use-after-free in the Audio/Video component
CVE-2026-84121: Sandbox escape due to use-after-free in the DOM:
Security component
CVE-2026-84122: Use-after-free in the Audio/Video component
CVE-2026-84123: Privilege escalation due to use-after-free in the
Graphics: WebGPU component
CVE-2026-84124: Use-after-free in the DOM: Core & HTML component
CVE-2026-84125: Use-after-free in the DOM: Core & HTML component
CVE-2026-74952: Privilege escalation in the Application Update component
CVE-2026-84129: Site isolation issue in the DOM: Navigation component
CVE-2026-84130: Information disclosure in the Graphics: WebGPU component
CVE-2026-84131: Privilege escalation due to invalid pointer in the
Graphics component
CVE-2026-84132: Information disclosure in the Networking: HTTP component
CVE-2026-84133: Site isolation issue in the DOM: Push Subscriptions
component
CVE-2026-84134: Other issue in the Profile Backup component
CVE-2026-84136: Other issue in the DOM: Navigation component
CVE-2026-84137: Spoofing issue in the DOM: Core & HTML component
CVE-2026-84139: Clickjacking issue in the DOM: Events component
CVE-2026-84140: Site isolation issue in the DOM: Navigation component
CVE-2026-84141: Integer overflow in the Graphics: ImageLib component
CVE-2026-84143: Internally found bugs fixed in Thunderbird 155,
Thunderbird ESR 153.2 and Thunderbird ESR 140.15
CVE-2026-84144: Internally found bugs fixed in Thunderbird 155 and
Thunderbird ESR 153.2
CVE-2026-84145: Internally found bugs fixed in Thunderbird 155,
Thunderbird ESR 153.2 and Thunderbird ESR 140.15
(Closes: #1145329, #1128672, #1127710, #928178, #909281, #955380, #882218,
#900210, #914403, #917613, #949450, #880424, #883245, #961269, #949649)
Checksums-Sha1:
bac4eb72b9649c816760856964d09c076e38faf5 8422 thunderbird_153.2.0esr-1.dsc
fe79aa4defdc8020c7a02c6df6bb7b563f36adfb 12815688
thunderbird_153.2.0esr.orig-thunderbird-l10n.tar.xz
233dca2b586cd5c74b64334dce706f1e3ca00b80 904710156
thunderbird_153.2.0esr.orig.tar.xz
b7cdeda74917b707b255c13b708b09157c5e7db8 556104
thunderbird_153.2.0esr-1.debian.tar.xz
791e62c718ff9918ea5877797a45c0d22738ea38 41146
thunderbird_153.2.0esr-1_amd64.buildinfo
Checksums-Sha256:
d77eab67b96ee31524426926ef06a4e48ac3b2415ea96d1a7f2128e77ca99ad0 8422
thunderbird_153.2.0esr-1.dsc
c33e07a872d250687088a407ce054593f6b0c2f5683e9af8f6632cdeb9700553 12815688
thunderbird_153.2.0esr.orig-thunderbird-l10n.tar.xz
79c01aa5b07f3464d43cc96300141b678a2685c861b9bcc6890e9e6d088f1aeb 904710156
thunderbird_153.2.0esr.orig.tar.xz
533a8015c15e833508f91e121182c5426af50c22ab56a0f1081c0fdda20f39e9 556104
thunderbird_153.2.0esr-1.debian.tar.xz
f241204d92ccbacd2171d1e9f151875e6211f07ba8339177364a68d98cca2f95 41146
thunderbird_153.2.0esr-1_amd64.buildinfo
Files:
ed3769dd9d71c325b0279905fdb13bb5 8422 mail optional
thunderbird_153.2.0esr-1.dsc
86caafe71439920cf8a6654c990c9fa2 12815688 mail optional
thunderbird_153.2.0esr.orig-thunderbird-l10n.tar.xz
b2c0d7f65a9cd572aa2a1f30644775cc 904710156 mail optional
thunderbird_153.2.0esr.orig.tar.xz
2ef3d8fe96862cfda6fcee8e46c50a71 556104 mail optional
thunderbird_153.2.0esr-1.debian.tar.xz
dfc69d6380f67a4b97137b4f7fe5d71b 41146 mail optional
thunderbird_153.2.0esr-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtw38bxNP7PwBHmKqgwFgFCUdHbAFAmqYPuMACgkQgwFgFCUd
HbDucw//V9bDtLsvpm/xw02HRxdA7FPVmYjP9k4oWIf634i82Cu+o8UHksHNYfip
qCMpgrwR+LXPDfnF/UZeW8AaMvX69C3Be2b33TB/7Cgjo9kIJI0/4IhKhp0CJiwn
jjtRkyVNLDDDYMNJU4pbkQR/PDlyjG2N/RSqfylR/iC1KUO70D6XkIAkw6AoUEoP
1s+Ly52fdF6SSvLRwcTQtt/k7xKRILVIda+uDey/LAz40TszDTbwbSrY+/tkWBtW
5aLA+eE6YR/aKxlW7+rUj1IhaW0FzlAEbUCrl2li5l0oSw4JqqPGmYSUuQyfJXI1
V8eytDOU5tl8uYGb1ixlYB5nmbRrT815bBw0Fddw5rR+7j9QD/QlSRfOHgP+ppm5
bWfyiPaI0mCUTm5trv6ECl3BZC4/rpWAmn80ucxfJoocqlEl+mALDV5DCz0sSU4p
ErQ8zZYHZfgfiZbwSi2jElhUwWvAD8r0AmsZSxaZJEjRQeq+DGj56kK0+mnpIMQ1
hzWr1OBr+Tt2FZw4n94GAZ077U8SFlGTQSMTdk+vaT6wypuWY2TtJqiPW2uk8B1v
2HZd5KIBFdYgiChNyZEa1RpfCX+xhjXIdE6jc1yhpZ8rmwHLVVzY4nfaUCoXm70E
OcNnneYzELnz8mbI3NXZ9iyjPXAMdyskdSijmOgPMlC7pNh0pks=
=sQE4
-----END PGP SIGNATURE-----
pgpdhF_zuaPJw.pgp
Description: PGP signature
--- End Message ---
