-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 05 Oct 2026 17:20:18 +0200 Source: thunderbird Architecture: source Version: 1:157.0-1 Distribution: experimental Urgency: medium Maintainer: Carsten Schoenert <[email protected]> Changed-By: Carsten Schoenert <[email protected]> Changes: thunderbird (1:157.0-1) experimental; urgency=medium . [ Carsten Schoenert ] * [965d4d7] d/copyright: Update content due upstream changes * [a0d4726] d/copyright: Fix misspelled word thunderbird-l10n * [11888b8] New upstream version 157.0 Fixed CVE issues in upstream version 157 (MFSA 2026-101): CVE-2026-103500: Heap buffer overflow opening large email CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback component CVE-2026-100757: Use-after-free in the Widget component CVE-2026-100758: Sandbox escape in the DOM: Navigation component CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager component CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing component CVE-2026-100761: Privilege escalation due to use-after-free in the Graphics: WebGPU component CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content Processes component CVE-2026-100763: Incorrect boundary conditions in the Graphics: WebGPU component CVE-2026-100764: Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component CVE-2026-100766: Information disclosure in the Networking: JAR component CVE-2026-100767: Use-after-free in the Networking: Cache component CVE-2026-100768: Use-after-free in the Graphics: WebGPU component CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content Processes component CVE-2026-100771: Undefined behavior in the DOM: Streams component CVE-2026-100772: Use-after-free in the DOM: Core & HTML component CVE-2026-100773: Use-after-free in the Storage: IndexedDB component CVE-2026-100774: Use-after-free in the DOM: Core & HTML component CVE-2026-100775: Sandbox escape in the Graphics component CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core & HTML component CVE-2026-100779: Use-after-free in the XSLT component CVE-2026-100780: Use-after-free in the DOM: Core & HTML component CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component CVE-2026-100782: Privilege escalation due to incorrect boundary conditions in the Graphics component CVE-2026-100783: Uninitialized memory in the Audio/Video component CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component CVE-2026-100785: Use-after-free in the DOM: Core & HTML component CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics component CVE-2026-100787: Sandbox escape in the XUL component CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component CVE-2026-100790: Use-after-free in the XSLT component CVE-2026-100791: Use-after-free in the DOM: Core & HTML component CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly component CVE-2026-100793: JIT miscompilation in the JavaScript Engine component CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the Internationalization component CVE-2026-96869: Information disclosure in the Networking component CVE-2026-100795: Denial-of-service in the Networking component CVE-2026-100796: Use-after-free in the JavaScript: WebAssembly component CVE-2026-100797: Privilege escalation due to use-after-free in the Graphics: WebRender component CVE-2026-100798: Cryptography misuse in Storage: Quota Manager component CVE-2026-100799: Uninitialized memory in the Graphics: WebGPU component CVE-2026-100800: Sandbox escape due to use-after-free in the Disability Access APIs component CVE-2026-100801: Privilege escalation in the DLL Services component CVE-2026-100802: Uninitialized memory in the Graphics: WebGPU component CVE-2026-100803: Same-origin policy bypass in the WebExtensions component CVE-2026-100804: Sandbox escape due to use-after-free in the Preferences: Backend component CVE-2026-100805: Race condition, use-after-free in the Audio/Video component CVE-2026-100806: Uninitialized memory in the Graphics: WebGPU component CVE-2026-100807: Privilege escalation in the DOM: Service Workers component CVE-2026-100808: Mitigation bypass in the DOM: Service Workers component CVE-2026-100809: Same-origin policy bypass in the DevTools component CVE-2026-100810: Other issue in the DevTools component CVE-2026-100811: Sandbox escape due to use-after-free in the DOM: Core & HTML component CVE-2026-100812: Denial-of-service in the Graphics component CVE-2026-100813: Invalid pointer in the JavaScript Engine: JIT component CVE-2026-100814: Incorrect boundary conditions in the JavaScript Engine: JIT component CVE-2026-100815: Use-after-free in the CSS Parsing and Computation component CVE-2026-100816: Site isolation issue in the DOM: Networking component CVE-2026-100817: Other issue in the JavaScript: WebAssembly component CVE-2026-100818: Sandbox escape due to use-after-free in the Widget: Gtk component CVE-2026-100819: Sandbox escape due to incorrect boundary conditions in the XPCOM component CVE-2026-100820: Privilege escalation in the Address Bar component CVE-2026-100821: Site isolation issue in the Panning and Zooming component CVE-2026-100822: Spoofing issue in the Networking: HTTP component CVE-2026-100824: Privilege escalation in the Places component CVE-2026-100825: Use-after-free in the JavaScript Engine: JIT component CVE-2026-100826: Denial-of-service in the Storage: StorageManager component CVE-2026-100828: Mitigation bypass in the Bookmarks & History component CVE-2026-100829: Mitigation bypass in the DOM: Security component CVE-2026-100830: Mitigation bypass in the DOM: Navigation component CVE-2026-100831: Use-after-free in the DOM: UI Events & Focus Handling component * [e189cc8] d/read-cve-data.py: Add helper to collect CVE data * [ceb44d9] d/read-cve-data.py: Increase subsequent_indent by one space . [ Christoph Goehre ] * [ddde1fe] d/read-cve-data.py: replace %< with 8< to simulate a better looking scissors Checksums-Sha1: 3e724030d6f10845c98a9d36e048189763197dfe 8435 thunderbird_157.0-1.dsc 105787a190255b6502b12da43bda2b079204fa0f 12986656 thunderbird_157.0.orig-thunderbird-l10n.tar.xz 97d93335e74322df62d3e18929db2c4ac023cd39 914450444 thunderbird_157.0.orig.tar.xz 9acef84d3db1e02bde8b7c246d664f9e7ed44c89 539904 thunderbird_157.0-1.debian.tar.xz f3dad0d7afd8998453af8a1484f572e183f9d4c9 39908 thunderbird_157.0-1_amd64.buildinfo Checksums-Sha256: 7e9ce6845fd33862a49733a4a06629bf1e8a2b9a99e44e137dfbcd9c37bfb562 8435 thunderbird_157.0-1.dsc 394da0d906808f87b7c761430790df6cb900dd611c443e3c3309b462c0f16964 12986656 thunderbird_157.0.orig-thunderbird-l10n.tar.xz 92808fc84862672af6365fd1556481c25bccec28a55491ddeddca856de41c029 914450444 thunderbird_157.0.orig.tar.xz 7d7ffef287466cf0982840bbaf8911e960017370bdbb5c91a482c66e07856f47 539904 thunderbird_157.0-1.debian.tar.xz 79212815d374620e1b781a0a15197162855429100a780d1de18d6f63f135d7e4 39908 thunderbird_157.0-1_amd64.buildinfo Files: 0d65625141fe8107438f60037dfcd7a1 8435 mail optional thunderbird_157.0-1.dsc a5463d7cd0166ccb805f7ed0005d44c8 12986656 mail optional thunderbird_157.0.orig-thunderbird-l10n.tar.xz cb2c22e3b1d809c4a591abb293d4b223 914450444 mail optional thunderbird_157.0.orig.tar.xz 7c4361b2a93e0e445198b3f04a0f3a26 539904 mail optional thunderbird_157.0-1.debian.tar.xz 2490417436d176f48211c8a97a73da81 39908 mail optional thunderbird_157.0-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE----- iQJMBAEBCgA2FiEEtw38bxNP7PwBHmKqgwFgFCUdHbAFAmrD+VIYHGMuc2Nob2Vu ZXJ0QHQtb25saW5lLmRlAAoJEIMBYBQlHR2wJ40P/3ECBVqPQgNyL3lMrJ4CToan 7lR2EunTM7HV23CL9lQmo1UhEZGwrivR4Jm80iWqUrQ3rv3bBMK+BLuzqaYEY/fs p19JsSmCvVx0SdqcgRhs/fSbSPwKKa0wcmAsTi4dHT3Ecxou/enaaxGGO/ZLuDTW TCMKMQhjaMG4mtnD0PeXrfaMqlFcmEZaFX4Q4tRdKPTsrgCS/xNUhMFiJGExsPbP KmM8K8EHAdZL2pFmP91Dwbtrl46+wwoW/AK8pQGaj+cz1kuOM22YqCGFLlnxmhhi 2QREgVi+UKXFSDpWC3yy4P5Ivtwipf7ihHhzaEyVQ82Ad9izlDxI9g37MHKVvgda uxIZJCiHUscxjwEHF6NBQn5JOHt+VBZgPkVl4TC4YJY0cXqsBEXkmxeA4DQSUGBw C9MrCLFHvSHx4Qa9N1m9FJEpSSFZmThzDYGiVe7D6BQYTmZG9vGMA4GDUqm8TsFG pNVLP4funPK0fWNiOuGOZxYMQou+w9NPznHSlbEC3h9o0YF9ASjKd1DmRRrmp2Cv /22a/iECKAr6ERWXGRgrfzdlxqkcRUWNQ986w4gZLBVN/BJX9ohq4PDxhcq/ZysC u/XxOx4PUiA+SoqJQMgHPH+E9scsFTZkrp1pL0+dZRhGZcK6S2xvzy/s+Ncje5PR pQGgunIsfepkVsPcMmzY =j6sM -----END PGP SIGNATURE-----
pgptjSS5N1O2h.pgp
Description: PGP signature
