-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 15 Oct 2026 07:59:58 +0200 Source: thunderbird Architecture: source Version: 1:153.5.0esr-1 Distribution: unstable Urgency: medium Maintainer: Carsten Schoenert <[email protected]> Changed-By: Carsten Schoenert <[email protected]> Changes: thunderbird (1:153.5.0esr-1) unstable; urgency=medium . [ Jeremy Bícha ] * [bcaa2d5] Remove obsolete Build-Depends: libidl-dev . [ Carsten Schoenert ] * [6273370] New upstream version 153.5.0esr Fixed CVE issues in upstream version 153.5 (MFSA 2026-110): CVE-2026-110249: Denial-of-service in the Exchange email component CVE-2026-109704: Privilege escalation in the Application Update component CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component CVE-2026-109706: Use-after-free in the Storage: IndexedDB component CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component CVE-2026-109710: Use-after-free in the Graphics: Text component CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component CVE-2026-109713: Use-after-free in the Crash Reporting component CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component CVE-2026-109718: Use-after-free in the XML component CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component CVE-2026-109724: Use-after-free in the DOM: Core & HTML component CVE-2026-109725: Use-after-free in the DOM: Core & HTML component CVE-2026-109726: Use-after-free in the SVG component CVE-2026-109727: Use-after-free in the Audio/Video component CVE-2026-109728: Use-after-free in the DOM: Animation component CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component CVE-2026-109730: Integer overflow in the Graphics component CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component CVE-2026-109732: Use-after-free in the DOM: Streams component CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component CVE-2026-109734: Mitigation bypass in the DOM: Security component CVE-2026-109736: Frame poisoning in the Layout component CVE-2026-109737: Mitigation bypass in the Enterprise Policies component CVE-2026-109738: Use-after-free in the Audio/Video: Playback component CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component CVE-2026-109741: Use-after-free in the Storage: Bucket File System component CVE-2026-109742: Information disclosure in the PDF Viewer component CVE-2026-109743: Privilege escalation in the Panning and Zooming component CVE-2026-109744: Other issue in the DOM: File component CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component CVE-2026-109782: Mitigation bypass in the File Handling component CVE-2026-109751: Information disclosure in the Networking component CVE-2026-109752: Use-after-free in the DOM: Workers component CVE-2026-109753: Incorrect boundary conditions in the Layout component CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component CVE-2026-109756: Privilege escalation in the DOM: Navigation component CVE-2026-109757: Sandbox escape due to race condition in the Networking component CVE-2026-109759: Site isolation issue in the Networking component CVE-2026-109760: Mitigation bypass in the Networking: HTTP component CVE-2026-109762: Incorrect boundary conditions in the SVG component CVE-2026-109763: Mitigation bypass in the File Handling component CVE-2026-109764: Mitigation bypass in the Enterprise Policies component CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component CVE-2026-109766: Mitigation bypass in the Enterprise Policies component CVE-2026-109767: Information disclosure in the Networking component CVE-2026-109783: Mitigation bypass in the File Handling component CVE-2026-109770: Spoofing issue in the DOM: Web Serial component CVE-2026-109775: Denial-of-service in the WebRTC component CVE-2026-109776: Race condition in the XPCOM component CVE-2026-109777: Information disclosure in the Storage: IndexedDB component CVE-2026-109778: Privilege escalation in the WebExtensions component CVE-2026-109781: Denial-of-service in the Printing: Output component * [65923fb] Rebuild patch queue from patch-queue branch Adjusted patch (description): fixes/Install-vaapitest-v4l2test-only-when-build.patch Checksums-Sha1: e45489f1ae7199ca65d9f26a8013247b691624d1 8444 thunderbird_153.5.0esr-1.dsc 3d697ed007c5442b85b72473f192930f8b983d61 12839928 thunderbird_153.5.0esr.orig-thunderbird-l10n.tar.xz 92dc0afc72799b166620b35e0c1b401b89695705 905958288 thunderbird_153.5.0esr.orig.tar.xz f7be0b2e2169a7effb5180ce03139054367cfb14 558892 thunderbird_153.5.0esr-1.debian.tar.xz 49b86d2ebb076ecad4bde93aedd1f86bda11f941 40883 thunderbird_153.5.0esr-1_amd64.buildinfo Checksums-Sha256: 28f11834d1cded7f654af4b5ce3485ae5d9eaaba7ddb148b15bc08a05bd3532b 8444 thunderbird_153.5.0esr-1.dsc 2b3ef1aa48632e10d98959ab359a40e360e131c773f7efe8b27f4706552c6113 12839928 thunderbird_153.5.0esr.orig-thunderbird-l10n.tar.xz 45516b9c15d749e0d1a292819adf560a6378e3d8572a3f7549bba221e135f5e7 905958288 thunderbird_153.5.0esr.orig.tar.xz b697a522cfaa751b11ffc3c39842c2cf1cfb29e388c6458c000634edfb7d906e 558892 thunderbird_153.5.0esr-1.debian.tar.xz 9606634a19bf35fcb293f8b993d5b2de2e486ef32b27dcd3422367b00b0cf94d 40883 thunderbird_153.5.0esr-1_amd64.buildinfo Files: 25b75d013ea6b55fe395602deb071dcb 8444 mail optional thunderbird_153.5.0esr-1.dsc 064520796e429bb040edd433e0c63c3c 12839928 mail optional thunderbird_153.5.0esr.orig-thunderbird-l10n.tar.xz b7ec5ca0bbbc9cb549ea67ed7ba76bd2 905958288 mail optional thunderbird_153.5.0esr.orig.tar.xz 066749f9408094465aff97cb7035d669 558892 mail optional thunderbird_153.5.0esr-1.debian.tar.xz 76f1c5972292304001e9802cfbb217e4 40883 mail optional thunderbird_153.5.0esr-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE----- iQJMBAEBCgA2FiEEtw38bxNP7PwBHmKqgwFgFCUdHbAFAmrRJTMYHGMuc2Nob2Vu ZXJ0QHQtb25saW5lLmRlAAoJEIMBYBQlHR2wsOAP/0DM5MUA1EEHIpJ1Hph9n+aD FsS5jmI+u74pOXdZi+u42Mag17NM/CtAESPtH4HP7ZoAVHPTjdUyEi9Ztu5+Xl9B roNC2Ouobs5Du/X2q2IZ8gjPo5I8y0t+XgNCIN7uqqYfdwRtvvwe1s9HmkaBiehr mGabwdwrCVoeiCcYckCJfMQTcZhIf+KOdSc7wLFwiyBUtBTlBFAvVr1Hd6ODWtyl 9o8ym7SA/F+X32+Yc+qjmi4u7pu385FrqEMOZhccequSCKi6N9uWUScE97+OnUZb HwC2issqLXHQVe+vj0ed5S3nESs5DfhR1E6Bx/guHY5IGjL/UdwVwZHBIVg5u8zl ngG9mFkzf/ceIaeF7Topzyz8C+Fg+rCJ5u78rXRK4cCEMZzMyzBFLXtY7qyapBS+ JIozIdyeHa0kWAYncguoKqwDhsTxAxa4pXE/OXx5oDwavaUm5kegde+jlDV9kpPK /KLpIDuoeH78d7Gxu/vsoWI2l5GpzM+MkMO4BoA4JBrxjM5oU+c/s4OAALnr03UC ERxP+8/4CbzX1k157GsJFKMDJ6ypVcWrxup84c4LOtgKeeQUFpWbLQrnkaekv8BR CIldY61MB2MEm9Nc/xhZ8ePbQGkwZKWo/03VgDdvTRYmfO58m5UPPGSmjvjHr5gC Y+u/4t9j+X/SQirqHaUG =vBzA -----END PGP SIGNATURE-----
pgpRgIVWKuGIM.pgp
Description: PGP signature
