-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 05 Oct 2026 17:20:18 +0200
Source: thunderbird
Architecture: source
Version: 1:157.0-1
Distribution: experimental
Urgency: medium
Maintainer: Carsten Schoenert <c.schoenert@t-online.de>
Changed-By: Carsten Schoenert <c.schoenert@t-online.de>
Changes:
thunderbird (1:157.0-1) experimental; urgency=medium
.
[ Carsten Schoenert ]
* [965d4d7] d/copyright: Update content due upstream changes
* [a0d4726] d/copyright: Fix misspelled word thunderbird-l10n
* [11888b8] New upstream version 157.0
Fixed CVE issues in upstream version 157 (MFSA 2026-101):
CVE-2026-103500: Heap buffer overflow opening large email
CVE-2026-100756: Incorrect boundary conditions in the Audio/Video:
Playback component
CVE-2026-100757: Use-after-free in the Widget component
CVE-2026-100758: Sandbox escape in the DOM: Navigation component
CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager
component
CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing
component
CVE-2026-100761: Privilege escalation due to use-after-free in the
Graphics: WebGPU component
CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content
Processes component
CVE-2026-100763: Incorrect boundary conditions in the Graphics: WebGPU
component
CVE-2026-100764: Privilege escalation due to incorrect boundary conditions
in the Graphics: WebGPU component
CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component
CVE-2026-100766: Information disclosure in the Networking: JAR component
CVE-2026-100767: Use-after-free in the Networking: Cache component
CVE-2026-100768: Use-after-free in the Graphics: WebGPU component
CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component
CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content
Processes component
CVE-2026-100771: Undefined behavior in the DOM: Streams component
CVE-2026-100772: Use-after-free in the DOM: Core & HTML component
CVE-2026-100773: Use-after-free in the Storage: IndexedDB component
CVE-2026-100774: Use-after-free in the DOM: Core & HTML component
CVE-2026-100775: Sandbox escape in the Graphics component
CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component
CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component
CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core &
HTML component
CVE-2026-100779: Use-after-free in the XSLT component
CVE-2026-100780: Use-after-free in the DOM: Core & HTML component
CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in
the Graphics: WebRender component
CVE-2026-100782: Privilege escalation due to incorrect boundary conditions
in the Graphics component
CVE-2026-100783: Uninitialized memory in the Audio/Video component
CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component
CVE-2026-100785: Use-after-free in the DOM: Core & HTML component
CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics
component
CVE-2026-100787: Sandbox escape in the XUL component
CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component
CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component
CVE-2026-100790: Use-after-free in the XSLT component
CVE-2026-100791: Use-after-free in the DOM: Core & HTML component
CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly
component
CVE-2026-100793: JIT miscompilation in the JavaScript Engine component
CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in
the Internationalization component
CVE-2026-96869: Information disclosure in the Networking component
CVE-2026-100795: Denial-of-service in the Networking component
CVE-2026-100796: Use-after-free in the JavaScript: WebAssembly component
CVE-2026-100797: Privilege escalation due to use-after-free in the
Graphics: WebRender component
CVE-2026-100798: Cryptography misuse in Storage: Quota Manager component
CVE-2026-100799: Uninitialized memory in the Graphics: WebGPU component
CVE-2026-100800: Sandbox escape due to use-after-free in the Disability
Access APIs component
CVE-2026-100801: Privilege escalation in the DLL Services component
CVE-2026-100802: Uninitialized memory in the Graphics: WebGPU component
CVE-2026-100803: Same-origin policy bypass in the WebExtensions component
CVE-2026-100804: Sandbox escape due to use-after-free in the Preferences:
Backend component
CVE-2026-100805: Race condition, use-after-free in the Audio/Video
component
CVE-2026-100806: Uninitialized memory in the Graphics: WebGPU component
CVE-2026-100807: Privilege escalation in the DOM: Service Workers
component
CVE-2026-100808: Mitigation bypass in the DOM: Service Workers component
CVE-2026-100809: Same-origin policy bypass in the DevTools component
CVE-2026-100810: Other issue in the DevTools component
CVE-2026-100811: Sandbox escape due to use-after-free in the DOM: Core &
HTML component
CVE-2026-100812: Denial-of-service in the Graphics component
CVE-2026-100813: Invalid pointer in the JavaScript Engine: JIT component
CVE-2026-100814: Incorrect boundary conditions in the JavaScript Engine:
JIT component
CVE-2026-100815: Use-after-free in the CSS Parsing and Computation
component
CVE-2026-100816: Site isolation issue in the DOM: Networking component
CVE-2026-100817: Other issue in the JavaScript: WebAssembly component
CVE-2026-100818: Sandbox escape due to use-after-free in the Widget: Gtk
component
CVE-2026-100819: Sandbox escape due to incorrect boundary conditions in
the XPCOM component
CVE-2026-100820: Privilege escalation in the Address Bar component
CVE-2026-100821: Site isolation issue in the Panning and Zooming component
CVE-2026-100822: Spoofing issue in the Networking: HTTP component
CVE-2026-100824: Privilege escalation in the Places component
CVE-2026-100825: Use-after-free in the JavaScript Engine: JIT component
CVE-2026-100826: Denial-of-service in the Storage: StorageManager
component
CVE-2026-100828: Mitigation bypass in the Bookmarks & History component
CVE-2026-100829: Mitigation bypass in the DOM: Security component
CVE-2026-100830: Mitigation bypass in the DOM: Navigation component
CVE-2026-100831: Use-after-free in the DOM: UI Events & Focus Handling
component
* [e189cc8] d/read-cve-data.py: Add helper to collect CVE data
* [ceb44d9] d/read-cve-data.py: Increase subsequent_indent by one space
.
[ Christoph Goehre ]
* [ddde1fe] d/read-cve-data.py: replace %< with 8< to simulate a better
looking scissors
Checksums-Sha1:
3e724030d6f10845c98a9d36e048189763197dfe 8435 thunderbird_157.0-1.dsc
105787a190255b6502b12da43bda2b079204fa0f 12986656 thunderbird_157.0.orig-thunderbird-l10n.tar.xz
97d93335e74322df62d3e18929db2c4ac023cd39 914450444 thunderbird_157.0.orig.tar.xz
9acef84d3db1e02bde8b7c246d664f9e7ed44c89 539904 thunderbird_157.0-1.debian.tar.xz
f3dad0d7afd8998453af8a1484f572e183f9d4c9 39908 thunderbird_157.0-1_amd64.buildinfo
Checksums-Sha256:
7e9ce6845fd33862a49733a4a06629bf1e8a2b9a99e44e137dfbcd9c37bfb562 8435 thunderbird_157.0-1.dsc
394da0d906808f87b7c761430790df6cb900dd611c443e3c3309b462c0f16964 12986656 thunderbird_157.0.orig-thunderbird-l10n.tar.xz
92808fc84862672af6365fd1556481c25bccec28a55491ddeddca856de41c029 914450444 thunderbird_157.0.orig.tar.xz
7d7ffef287466cf0982840bbaf8911e960017370bdbb5c91a482c66e07856f47 539904 thunderbird_157.0-1.debian.tar.xz
79212815d374620e1b781a0a15197162855429100a780d1de18d6f63f135d7e4 39908 thunderbird_157.0-1_amd64.buildinfo
Files:
0d65625141fe8107438f60037dfcd7a1 8435 mail optional thunderbird_157.0-1.dsc
a5463d7cd0166ccb805f7ed0005d44c8 12986656 mail optional thunderbird_157.0.orig-thunderbird-l10n.tar.xz
cb2c22e3b1d809c4a591abb293d4b223 914450444 mail optional thunderbird_157.0.orig.tar.xz
7c4361b2a93e0e445198b3f04a0f3a26 539904 mail optional thunderbird_157.0-1.debian.tar.xz
2490417436d176f48211c8a97a73da81 39908 mail optional thunderbird_157.0-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJMBAEBCgA2FiEEtw38bxNP7PwBHmKqgwFgFCUdHbAFAmrD+VIYHGMuc2Nob2Vu
ZXJ0QHQtb25saW5lLmRlAAoJEIMBYBQlHR2wJ40P/3ECBVqPQgNyL3lMrJ4CToan
7lR2EunTM7HV23CL9lQmo1UhEZGwrivR4Jm80iWqUrQ3rv3bBMK+BLuzqaYEY/fs
p19JsSmCvVx0SdqcgRhs/fSbSPwKKa0wcmAsTi4dHT3Ecxou/enaaxGGO/ZLuDTW
TCMKMQhjaMG4mtnD0PeXrfaMqlFcmEZaFX4Q4tRdKPTsrgCS/xNUhMFiJGExsPbP
KmM8K8EHAdZL2pFmP91Dwbtrl46+wwoW/AK8pQGaj+cz1kuOM22YqCGFLlnxmhhi
2QREgVi+UKXFSDpWC3yy4P5Ivtwipf7ihHhzaEyVQ82Ad9izlDxI9g37MHKVvgda
uxIZJCiHUscxjwEHF6NBQn5JOHt+VBZgPkVl4TC4YJY0cXqsBEXkmxeA4DQSUGBw
C9MrCLFHvSHx4Qa9N1m9FJEpSSFZmThzDYGiVe7D6BQYTmZG9vGMA4GDUqm8TsFG
pNVLP4funPK0fWNiOuGOZxYMQou+w9NPznHSlbEC3h9o0YF9ASjKd1DmRRrmp2Cv
/22a/iECKAr6ERWXGRgrfzdlxqkcRUWNQ986w4gZLBVN/BJX9ohq4PDxhcq/ZysC
u/XxOx4PUiA+SoqJQMgHPH+E9scsFTZkrp1pL0+dZRhGZcK6S2xvzy/s+Ncje5PR
pQGgunIsfepkVsPcMmzY
=j6sM
-----END PGP SIGNATURE-----
