RHSA-2026:6917 - Security Advisory

Topic

An update for thunderbird is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

• firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701)
• firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4721)
• firefox: thunderbird: Privilege escalation in the Netmonitor component (CVE-2026-4717)
• firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-4688)
• firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4706)
• firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4695)
• firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4689)
• firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-4698)
• firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component (CVE-2026-4716)
• firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component (CVE-2026-4684)
• firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4705)
• firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component (CVE-2026-4715)
• firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4685)
• firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4714)
• firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-4709)
• firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4710)
• firefox: thunderbird: Information disclosure in the Widget: Cocoa component (CVE-2026-4712)
• firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4697)
• firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4713)
• firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4690)
• firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-4711)
• firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4686)
• firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4708)
• firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-4691)
• firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-4699)
• firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-4696)
• firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-4693)
• firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4718)
• firefox: thunderbird: JIT miscompilation in the JavaScript Engine component (CVE-2026-4702)
• firefox: thunderbird: Incorrect boundary conditions in the Graphics: Text component (CVE-2026-4719)
• firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics component (CVE-2026-4694)
• firefox: thunderbird: Sandbox escape in the Responsive Design Mode component (CVE-2026-4692)
• firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4720)
• firefox: thunderbird: Mitigation bypass in the Networking: HTTP component (CVE-2026-4700)
• firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4707)
• firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component (CVE-2026-4704)
• firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component (CVE-2026-4687)
• thunderbird: Out of bounds read in IMAP parsing (CVE-2026-4371)
• thunderbird: Spoofing issue in Thunderbird (CVE-2026-3889)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64
• Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64
• Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le
• Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x

Fixes

• BZ - 2450710 - CVE-2026-4701 firefox: thunderbird: Use-after-free in the JavaScript Engine component
• BZ - 2450711 - CVE-2026-4721 firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149
• BZ - 2450712 - CVE-2026-4717 firefox: thunderbird: Privilege escalation in the Netmonitor component
• BZ - 2450713 - CVE-2026-4688 firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component
• BZ - 2450714 - CVE-2026-4706 firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component
• BZ - 2450715 - CVE-2026-4695 firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component
• BZ - 2450718 - CVE-2026-4689 firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component
• BZ - 2450719 - CVE-2026-4698 firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component
• BZ - 2450720 - CVE-2026-4716 firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component
• BZ - 2450721 - CVE-2026-4684 firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component
• BZ - 2450722 - CVE-2026-4705 firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component
• BZ - 2450723 - CVE-2026-4715 firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component
• BZ - 2450724 - CVE-2026-4685 firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component
• BZ - 2450725 - CVE-2026-4714 firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component
• BZ - 2450726 - CVE-2026-4709 firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component
• BZ - 2450727 - CVE-2026-4710 firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component
• BZ - 2450728 - CVE-2026-4712 firefox: thunderbird: Information disclosure in the Widget: Cocoa component
• BZ - 2450729 - CVE-2026-4697 firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component
• BZ - 2450730 - CVE-2026-4713 firefox: thunderbird: Incorrect boundary conditions in the Graphics component
• BZ - 2450732 - CVE-2026-4690 firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component
• BZ - 2450733 - CVE-2026-4711 firefox: thunderbird: Use-after-free in the Widget: Cocoa component
• BZ - 2450734 - CVE-2026-4686 firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component
• BZ - 2450735 - CVE-2026-4708 firefox: thunderbird: Incorrect boundary conditions in the Graphics component
• BZ - 2450738 - CVE-2026-4691 firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component
• BZ - 2450739 - CVE-2026-4699 firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component
• BZ - 2450740 - CVE-2026-4696 firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component
• BZ - 2450741 - CVE-2026-4693 firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component
• BZ - 2450742 - CVE-2026-4718 firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component
• BZ - 2450744 - CVE-2026-4702 firefox: thunderbird: JIT miscompilation in the JavaScript Engine component
• BZ - 2450746 - CVE-2026-4719 firefox: thunderbird: Incorrect boundary conditions in the Graphics: Text component
• BZ - 2450747 - CVE-2026-4694 firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics component
• BZ - 2450748 - CVE-2026-4692 firefox: thunderbird: Sandbox escape in the Responsive Design Mode component
• BZ - 2450751 - CVE-2026-4720 firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149
• BZ - 2450752 - CVE-2026-4700 firefox: thunderbird: Mitigation bypass in the Networking: HTTP component
• BZ - 2450755 - CVE-2026-4707 firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component
• BZ - 2450756 - CVE-2026-4704 firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component
• BZ - 2450757 - CVE-2026-4687 firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component
• BZ - 2451001 - CVE-2026-4371 thunderbird: Out of bounds read in IMAP parsing
• BZ - 2451006 - CVE-2026-3889 thunderbird: Spoofing issue in Thunderbird

CVEs

• CVE-2026-3889
• CVE-2026-4371
• CVE-2026-4684
• CVE-2026-4685
• CVE-2026-4686
• CVE-2026-4687
• CVE-2026-4688
• CVE-2026-4689
• CVE-2026-4690
• CVE-2026-4691
• CVE-2026-4692
• CVE-2026-4693
• CVE-2026-4694
• CVE-2026-4695
• CVE-2026-4696
• CVE-2026-4697
• CVE-2026-4698
• CVE-2026-4699
• CVE-2026-4700
• CVE-2026-4701
• CVE-2026-4702
• CVE-2026-4704
• CVE-2026-4705
• CVE-2026-4706
• CVE-2026-4707
• CVE-2026-4708
• CVE-2026-4709
• CVE-2026-4710
• CVE-2026-4711
• CVE-2026-4712
• CVE-2026-4713
• CVE-2026-4714
• CVE-2026-4715
• CVE-2026-4716
• CVE-2026-4717
• CVE-2026-4718
• CVE-2026-4719
• CVE-2026-4720
• CVE-2026-4721

References

• https://access.redhat.com/security/updates/classification/#important