security update for thunderbird

This security update addresses multiple vulnerabilities in Mozilla Firefox ESR 140.14.0 and related Thunderbird versions. The vulnerabilities span a wide range of types including privilege escalation, use-after-free, information disclosure, site isolation issues, mitigation bypasses, race conditions, integer overflows, and same-origin policy bypasses. Affected components include Graphics (CanvasWebGL, ImageLib, Canvas2D, Text), DOM (UI Events & Focus Handling), Networking (Cookies), JavaScript (WebAssembly, JIT), Storage (Cache API), and others. The update fixes these issues in Firefox ESR 140.14.0 and Thunderbird packages distributed by SUSE and Red Hat. The vendor advisory from Red Hat confirms the fixes and rates the security impact as Important (medium severity).

The vulnerabilities could allow attackers to escalate privileges, cause use-after-free conditions potentially leading to crashes or code execution, disclose sensitive information, bypass site isolation and mitigation controls, and bypass same-origin policy protections. These issues affect core browser and email client components, potentially impacting confidentiality, integrity, and availability of affected systems. However, no known exploits in the wild have been reported at this time.

A security update is available and should be applied promptly. The fixes are included in Firefox ESR 140.14.0 and corresponding Thunderbird packages provided by SUSE and Red Hat. Users should update to the fixed versions (=140.14.0-1.el8_10 and thunderbird-0:140.14.0-1.el9_6.x86_64) as distributed by their vendors. No additional mitigation actions are required beyond applying the official patches.