-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 15 Oct 2026 07:59:58 +0200
Source: thunderbird
Architecture: source
Version: 1:153.5.0esr-1
Distribution: unstable
Urgency: medium
Maintainer: Carsten Schoenert <c.schoenert@t-online.de>
Changed-By: Carsten Schoenert <c.schoenert@t-online.de>
Changes:
thunderbird (1:153.5.0esr-1) unstable; urgency=medium
.
[ Jeremy Bícha ]
* [bcaa2d5] Remove obsolete Build-Depends: libidl-dev
.
[ Carsten Schoenert ]
* [6273370] New upstream version 153.5.0esr
Fixed CVE issues in upstream version 153.5 (MFSA 2026-110):
CVE-2026-110249: Denial-of-service in the Exchange email component
CVE-2026-109704: Privilege escalation in the Application Update component
CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect
boundary conditions, use-after-free in the Networking
component
CVE-2026-109706: Use-after-free in the Storage: IndexedDB component
CVE-2026-109707: Sandbox escape due to use-after-free in the Networking
component
CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in
the Networking component
CVE-2026-109709: Information disclosure, privilege escalation in the
Security: Process Sandboxing component
CVE-2026-109710: Use-after-free in the Graphics: Text component
CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component
CVE-2026-109712: Sandbox escape due to uninitialized memory in the
Graphics component
CVE-2026-109713: Use-after-free in the Crash Reporting component
CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine
component
CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine
component
CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component
CVE-2026-109718: Use-after-free in the XML component
CVE-2026-109719: Race condition, use-after-free in the Graphics:
CanvasWebGL component
CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly
component
CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine:
JIT component
CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT
component
CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component
CVE-2026-109724: Use-after-free in the DOM: Core & HTML component
CVE-2026-109725: Use-after-free in the DOM: Core & HTML component
CVE-2026-109726: Use-after-free in the SVG component
CVE-2026-109727: Use-after-free in the Audio/Video component
CVE-2026-109728: Use-after-free in the DOM: Animation component
CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component
CVE-2026-109730: Integer overflow in the Graphics component
CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D
component
CVE-2026-109732: Use-after-free in the DOM: Streams component
CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT
component
CVE-2026-109734: Mitigation bypass in the DOM: Security component
CVE-2026-109736: Frame poisoning in the Layout component
CVE-2026-109737: Mitigation bypass in the Enterprise Policies component
CVE-2026-109738: Use-after-free in the Audio/Video: Playback component
CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in
the Widget: Win32 component
CVE-2026-109741: Use-after-free in the Storage: Bucket File System
component
CVE-2026-109742: Information disclosure in the PDF Viewer component
CVE-2026-109743: Privilege escalation in the Panning and Zooming component
CVE-2026-109744: Other issue in the DOM: File component
CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM:
Web Serial component
CVE-2026-109782: Mitigation bypass in the File Handling component
CVE-2026-109751: Information disclosure in the Networking component
CVE-2026-109752: Use-after-free in the DOM: Workers component
CVE-2026-109753: Incorrect boundary conditions in the Layout component
CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor
component
CVE-2026-109756: Privilege escalation in the DOM: Navigation component
CVE-2026-109757: Sandbox escape due to race condition in the Networking
component
CVE-2026-109759: Site isolation issue in the Networking component
CVE-2026-109760: Mitigation bypass in the Networking: HTTP component
CVE-2026-109762: Incorrect boundary conditions in the SVG component
CVE-2026-109763: Mitigation bypass in the File Handling component
CVE-2026-109764: Mitigation bypass in the Enterprise Policies component
CVE-2026-109765: Race condition, use-after-free in the Graphics: Text
component
CVE-2026-109766: Mitigation bypass in the Enterprise Policies component
CVE-2026-109767: Information disclosure in the Networking component
CVE-2026-109783: Mitigation bypass in the File Handling component
CVE-2026-109770: Spoofing issue in the DOM: Web Serial component
CVE-2026-109775: Denial-of-service in the WebRTC component
CVE-2026-109776: Race condition in the XPCOM component
CVE-2026-109777: Information disclosure in the Storage: IndexedDB
component
CVE-2026-109778: Privilege escalation in the WebExtensions component
CVE-2026-109781: Denial-of-service in the Printing: Output component
* [65923fb] Rebuild patch queue from patch-queue branch
Adjusted patch (description):
fixes/Install-vaapitest-v4l2test-only-when-build.patch
Checksums-Sha1:
e45489f1ae7199ca65d9f26a8013247b691624d1 8444 thunderbird_153.5.0esr-1.dsc
3d697ed007c5442b85b72473f192930f8b983d61 12839928 thunderbird_153.5.0esr.orig-thunderbird-l10n.tar.xz
92dc0afc72799b166620b35e0c1b401b89695705 905958288 thunderbird_153.5.0esr.orig.tar.xz
f7be0b2e2169a7effb5180ce03139054367cfb14 558892 thunderbird_153.5.0esr-1.debian.tar.xz
49b86d2ebb076ecad4bde93aedd1f86bda11f941 40883 thunderbird_153.5.0esr-1_amd64.buildinfo
Checksums-Sha256:
28f11834d1cded7f654af4b5ce3485ae5d9eaaba7ddb148b15bc08a05bd3532b 8444 thunderbird_153.5.0esr-1.dsc
2b3ef1aa48632e10d98959ab359a40e360e131c773f7efe8b27f4706552c6113 12839928 thunderbird_153.5.0esr.orig-thunderbird-l10n.tar.xz
45516b9c15d749e0d1a292819adf560a6378e3d8572a3f7549bba221e135f5e7 905958288 thunderbird_153.5.0esr.orig.tar.xz
b697a522cfaa751b11ffc3c39842c2cf1cfb29e388c6458c000634edfb7d906e 558892 thunderbird_153.5.0esr-1.debian.tar.xz
9606634a19bf35fcb293f8b993d5b2de2e486ef32b27dcd3422367b00b0cf94d 40883 thunderbird_153.5.0esr-1_amd64.buildinfo
Files:
25b75d013ea6b55fe395602deb071dcb 8444 mail optional thunderbird_153.5.0esr-1.dsc
064520796e429bb040edd433e0c63c3c 12839928 mail optional thunderbird_153.5.0esr.orig-thunderbird-l10n.tar.xz
b7ec5ca0bbbc9cb549ea67ed7ba76bd2 905958288 mail optional thunderbird_153.5.0esr.orig.tar.xz
066749f9408094465aff97cb7035d669 558892 mail optional thunderbird_153.5.0esr-1.debian.tar.xz
76f1c5972292304001e9802cfbb217e4 40883 mail optional thunderbird_153.5.0esr-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJMBAEBCgA2FiEEtw38bxNP7PwBHmKqgwFgFCUdHbAFAmrRJTMYHGMuc2Nob2Vu
ZXJ0QHQtb25saW5lLmRlAAoJEIMBYBQlHR2wsOAP/0DM5MUA1EEHIpJ1Hph9n+aD
FsS5jmI+u74pOXdZi+u42Mag17NM/CtAESPtH4HP7ZoAVHPTjdUyEi9Ztu5+Xl9B
roNC2Ouobs5Du/X2q2IZ8gjPo5I8y0t+XgNCIN7uqqYfdwRtvvwe1s9HmkaBiehr
mGabwdwrCVoeiCcYckCJfMQTcZhIf+KOdSc7wLFwiyBUtBTlBFAvVr1Hd6ODWtyl
9o8ym7SA/F+X32+Yc+qjmi4u7pu385FrqEMOZhccequSCKi6N9uWUScE97+OnUZb
HwC2issqLXHQVe+vj0ed5S3nESs5DfhR1E6Bx/guHY5IGjL/UdwVwZHBIVg5u8zl
ngG9mFkzf/ceIaeF7Topzyz8C+Fg+rCJ5u78rXRK4cCEMZzMyzBFLXtY7qyapBS+
JIozIdyeHa0kWAYncguoKqwDhsTxAxa4pXE/OXx5oDwavaUm5kegde+jlDV9kpPK
/KLpIDuoeH78d7Gxu/vsoWI2l5GpzM+MkMO4BoA4JBrxjM5oU+c/s4OAALnr03UC
ERxP+8/4CbzX1k157GsJFKMDJ6ypVcWrxup84c4LOtgKeeQUFpWbLQrnkaekv8BR
CIldY61MB2MEm9Nc/xhZ8ePbQGkwZKWo/03VgDdvTRYmfO58m5UPPGSmjvjHr5gC
Y+u/4t9j+X/SQirqHaUG
=vBzA
-----END PGP SIGNATURE-----
