Вернуться к предупреждениям о безопасности

Thunderbird Security Update — AlmaLinux 10 (ALSA-2026:90895)

ALSA-2026:90895 updates Thunderbird on AlmaLinux 10, fixing CVE-2026-45186 — a denial-of-service flaw in the bundled libexpat XML parser reachable via crafted XML input. Update with dnf update thunderbird and restart the client.

High 2.9 CVSS
AlmaLinux 10

Что это значит по лицензии SharedLicense

Malformed XML in email content can crash the mail client's parser — an availability attack against anyone rendering the crafted message.

Type:

security

Severity:

important

Release date:

2026-10-29

Description:

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* libexpat: denial of service via crafted XML input (CVE-2026-45186)

Bug Fix(es) and Enhancement(s):

* Thunderbird ESR 153 rebase [rhel-10.2.z] (JIRA:RHEL-175207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture Package Checksum
aarch64 thunderbird-153.5.0-1.el10_2.alma.1.aarch64.rpm b1fc1f15872d79c7c21981df764435103cf3842325143758989e8c7b212dbd08
ppc64le thunderbird-153.5.0-1.el10_2.alma.1.ppc64le.rpm 5878b8d6b628d1a8a25067e673b35d3020ed491bc85b05e2d824bd32d8b5732d
s390x thunderbird-153.5.0-1.el10_2.alma.1.s390x.rpm c694933f8fd42d2e9a5b3e0ffc9f6895f36fdf8e59adba22e03ee4c0a3fdd82e
x86_64 thunderbird-153.5.0-1.el10_2.alma.1.x86_64.rpm 5c368f646153e3d8951292dc1bec623a5bd47a663a458a31652c496afc467d89
x86_64_v2 thunderbird-153.5.0-1.el10_2.alma.1.x86_64_v2.rpm 6b19849de3e568d03c47cf5d0a65999f341d49e1f85ae5ee2e82ce83b44151c2

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Часто задаваемые вопросы

What is CVE-2026-45186?
It is a denial-of-service flaw in libexpat (crafted XML input causing parser failure), fixed in Thunderbird via the AlmaLinux 10 update ALSA-2026:90895 (rated Important).
Who is affected?
AlmaLinux 10 systems running Thunderbird — the bundled libexpat parses XML inside email content, so a crafted message can crash the client.
How do I apply the fix?
Run dnf update thunderbird and restart the client; verify the updated version in its About dialog.
Is this the same libexpat flaw as other advisories?
The libexpat DoS flaw is fixed per-product: Thunderbird carries its own bundled copy, which is why a mail-client erratum ships an expat fix — apply it wherever Thunderbird is installed.

Источники

Предупреждения о безопасности

Похожие предупреждения

Nodejs-Nodemon Security Update — AlmaLinux 10 (ALSA-2026:96236)

2026-11-10

Nodejs22 Security Update — AlmaLinux 10 (ALSA-2026:96094)

2026-11-10

Nodejs24 Security Update — AlmaLinux 10 (ALSA-2026:96088)

2026-11-10

Проверьте систему на уязвимости

Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.

Проверьте свою систему