Red Hat Product Errata RHSA-2026:0025 - Security Advisory
Issued:
2026-01-05
Updated:
2026-01-05

RHSA-2026:0025 - Security Advisory

Synopsis

Important: thunderbird security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for thunderbird is now available for Red Hat Enterprise Linux 10.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146 (CVE-2025-14333)
  • firefox: Use-after-free in the WebRTC: Signaling component (CVE-2025-14321)
  • firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14325)
  • firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2025-14322)
  • firefox: Privilege escalation in the Netmonitor component (CVE-2025-14328)
  • firefox: Privilege escalation in the Netmonitor component (CVE-2025-14329)
  • firefox: Same-origin policy bypass in the Request Handling component (CVE-2025-14331)
  • firefox: Privilege escalation in the DOM: Notifications component (CVE-2025-14323)
  • firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14330)
  • firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14324)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 10 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 10 s390x
  • Red Hat Enterprise Linux for Power, little endian 10 ppc64le
  • Red Hat Enterprise Linux for ARM 64 10 aarch64

Fixes

  • BZ - 2420502 - CVE-2025-14333 firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146
  • BZ - 2420503 - CVE-2025-14321 firefox: thunderbird: Use-after-free in the WebRTC: Signaling component
  • BZ - 2420504 - CVE-2025-14325 firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component
  • BZ - 2420506 - CVE-2025-14322 firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
  • BZ - 2420508 - CVE-2025-14328 firefox: thunderbird: Privilege escalation in the Netmonitor component
  • BZ - 2420509 - CVE-2025-14329 firefox: thunderbird: Privilege escalation in the Netmonitor component
  • BZ - 2420512 - CVE-2025-14331 firefox: thunderbird: Same-origin policy bypass in the Request Handling component
  • BZ - 2420513 - CVE-2025-14323 firefox: thunderbird: Privilege escalation in the DOM: Notifications component
  • BZ - 2420516 - CVE-2025-14330 firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component
  • BZ - 2420517 - CVE-2025-14324 firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component

Red Hat Enterprise Linux for x86_64 10

SRPM
thunderbird-140.6.0-1.el10_1.src.rpm SHA-256: dea410162ea87a77d2f79e9246e3e60c1c9fd66b574fb8caf3854d3164117d3a
x86_64
thunderbird-140.6.0-1.el10_1.x86_64.rpm SHA-256: 6ead5817568f2f824e2305235ad3f888f732643618cb99fe63e7d8169ebfc4a3
thunderbird-debuginfo-140.6.0-1.el10_1.x86_64.rpm SHA-256: 5ffa475dd214e25fc646f90529b53e6889f08782747a30df27052f8100c8f93e
thunderbird-debugsource-140.6.0-1.el10_1.x86_64.rpm SHA-256: 69c2701f0b228d4bf7068c23cad5667372d268be6bec17c3c5ccf545cf086c9b

Red Hat Enterprise Linux for IBM z Systems 10

SRPM
thunderbird-140.6.0-1.el10_1.src.rpm SHA-256: dea410162ea87a77d2f79e9246e3e60c1c9fd66b574fb8caf3854d3164117d3a
s390x
thunderbird-140.6.0-1.el10_1.s390x.rpm SHA-256: 5c0957f96622382f938d1e00bd25ee68cc125e63c62c5a6c7b4fc1bde7a6d521
thunderbird-debuginfo-140.6.0-1.el10_1.s390x.rpm SHA-256: 034fb8c7657863d4ade616393232d09acd161aede607d85ceb614e6af024739d
thunderbird-debugsource-140.6.0-1.el10_1.s390x.rpm SHA-256: 6ca4c03f4402aaaf1d8845b5fc9ced74f3c26a596301b70a2d80785830370f0c

Red Hat Enterprise Linux for Power, little endian 10

SRPM
thunderbird-140.6.0-1.el10_1.src.rpm SHA-256: dea410162ea87a77d2f79e9246e3e60c1c9fd66b574fb8caf3854d3164117d3a
ppc64le
thunderbird-140.6.0-1.el10_1.ppc64le.rpm SHA-256: 05887feb4ccdb8684765e6c4d9a6d35a0c80ab5d190b2ec59d4463e97cebbe90
thunderbird-debuginfo-140.6.0-1.el10_1.ppc64le.rpm SHA-256: 6c5f3f3725732702b9f6e8e32498719cc40a57e793028bffaf780121f1cff581
thunderbird-debugsource-140.6.0-1.el10_1.ppc64le.rpm SHA-256: bc5c22522e92ed204295aca16872d40a915d7e0dfbc3a3c9d8e1502c1ab77b8b

Red Hat Enterprise Linux for ARM 64 10

SRPM
thunderbird-140.6.0-1.el10_1.src.rpm SHA-256: dea410162ea87a77d2f79e9246e3e60c1c9fd66b574fb8caf3854d3164117d3a
aarch64
thunderbird-140.6.0-1.el10_1.aarch64.rpm SHA-256: 2edb46eee39b6de82d317747770ea0d33b23ae56ddc2fac821e7f434ca2bf9fe
thunderbird-debuginfo-140.6.0-1.el10_1.aarch64.rpm SHA-256: 99e4c1cafda94cec1c3a64530309e076e3af28edac304f6c6e945f94aa7ab9a5
thunderbird-debugsource-140.6.0-1.el10_1.aarch64.rpm SHA-256: a362cf6064db6f508691b79d6ba75c0ef783f92d620ca7f70e6d8d2e361fd9a7

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.