Güvenlik Danışarlıklarına Dön
Thunderbird Security Update — AlmaLinux 8 (ALSA-2026:22643)
ALSA-2026:22643 updates Thunderbird on AlmaLinux 8, fixing CVE-2026-8388, CVE-2026-8391, CVE-2026-8401, CVE-2026-8956, CVE-2026-8975, CVE-2026-8955, CVE-2026-8968, CVE-2026-8957 and further engine flaws — JIT boundary-condition issues, sandbox-escape and memory-safety classes, aggregate CVSS 6.5 (CWE-119). Update with dnf update thunderbird and restart the client.
High
6.5 CVSS
AlmaLinux 8
SharedLicense lisansı altında bunun anlamı
The batch includes JIT boundary-condition and sandbox-escape fixes — the chain from crafted email content to code execution in the mail client runs through exactly those engine components.
Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388) * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391) * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401) * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956) * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151 (CVE-2026-8975) * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955) * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVE-2026-8968) * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954) * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-8958) * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946) * firefox: Privilege escalation in the Security component (CVE-2026-8970) * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950) * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974) * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953) * firefox: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (CVE-2026-8959) * firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961) * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962) * firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Sıkça Sorulan Sorular
What is ALSA-2026:22643?
It is AlmaLinux's Thunderbird erratum for AlmaLinux 8, fixing CVE-2026-8388, CVE-2026-8391, CVE-2026-8401, CVE-2026-8956, CVE-2026-8975, CVE-2026-8955, CVE-2026-8968, CVE-2026-8957 and further engine flaws — JIT boundary conditions, sandbox escapes and memory-safety issues, aggregate CVSS 6.5 (CWE-119).
Who is affected?
AlmaLinux 8 desktops and workstations running Thunderbird — the flaws trigger on rendering malicious email content.
How do I apply the fix?
Run dnf update thunderbird and restart the client; verify the updated version in its About dialog.
Why do JIT and sandbox fixes matter for a mail client?
Thunderbird renders HTML mail with the same engine class as the browser — JIT boundary flaws and sandbox escapes in that engine are the standard crafted-email-to-code-execution chain.
Sisteminizi güvenlik açıkları açısından kontrol edin
Size uygun tam düzeltme komutlarını görmek için ürününüzü ve işletim sisteminizi seçin.
Sisteminizi Kontrol Edin