thunderbird

This Red Hat Security Advisory addresses multiple security vulnerabilities in Mozilla Thunderbird and Firefox components, including denial of service, privilege escalation, information disclosure, use-after-free, sandbox escapes, mitigation bypasses, spoofing, race conditions, integer overflows, and other issues. The update also includes bug fixes and enhancements such as the Thunderbird ESR 153 rebase. The advisory rates the security impact as Important and covers Red Hat Enterprise Linux 9 and its Extended Update Support variants.

Red Hat Security Advisory: thunderbird security, bug fix, and enhancement update

A denial of service vulnerability (CVE-2026-45186) exists in the libexpat XML parser used by Mozilla Thunderbird, as packaged in Red Hat Enterprise Linux 10.2. This flaw allows denial of service via crafted XML input. Red Hat has issued an important security update for Thunderbird to address this issue, including a rebase to Thunderbird ESR 153.5.0. The update is available for multiple architectures and variants of Red Hat Enterprise Linux 10.2.

Mozilla Thunderbird contains a vulnerability in the libexpat XML parsing library that allows denial of service via crafted XML input (CVE-2026-45186). This security issue is addressed in Thunderbird version 153.5.0-1.el10_2.alma.1 and later. The update also includes bug fixes and enhancements related to the Thunderbird ESR 153 rebase for Red Hat Enterprise Linux 10.2 Extended Update Support.

Important: thunderbird security, bug fix, and enhancement update (CVE-2026-45186)

This Red Hat Security Advisory addresses multiple security vulnerabilities in Mozilla Firefox, including denial of service, privilege escalation, use-after-free, information disclosure, sandbox escapes, mitigation bypasses, and other memory safety issues. The update also includes bug fixes and enhancements, specifically a Firefox ESR 153 rebase for Red Hat Enterprise Linux 9. The advisory rates the security impact as Important and covers a broad range of components such as XML processing, JavaScript engine, networking, graphics, and sandboxing.

Red Hat Security Advisory: firefox security, bug fix, and enhancement update

A comprehensive security update for Mozilla Firefox addresses multiple vulnerabilities including denial of service, privilege escalation, use-after-free, information disclosure, sandbox escapes, mitigation bypasses, incorrect boundary conditions, race conditions, integer overflows, and JIT miscompilations. These issues affect various Firefox components such as the Application Update, XML, PDF Viewer, JavaScript Engine, Networking, Storage, DOM, Graphics, Audio/Video, and others. The update also includes bug fixes and enhancements, notably a Firefox ESR 153 rebase for Red Hat Enterprise Linux 8.

This Red Hat Security Advisory addresses multiple security vulnerabilities in Mozilla Firefox and related components, including libexpat and expat libraries. The issues include denial of service, information disclosure, privilege escalation, use-after-free, sandbox escapes, incorrect boundary conditions, race conditions, and integer overflows across various Firefox components such as the JavaScript engine, networking, graphics, DOM, and storage. The update also includes bug fixes and enhancements, notably a Firefox ESR 153 rebase for Red Hat Enterprise Linux 10. The advisory rates the security impact as Important and provides a comprehensive list of CVEs fixed in this update.

A vulnerability in libexpat causes excessive CPU consumption when processing specially crafted XML inputs with specific attribute patterns, leading to a denial of service. This flaw affects Red Hat Hardened Images RPMs including expat packages. The issue arises from quadratic parsing time due to attribute name collision checks. The vulnerability is rated as important severity by Red Hat. Mitigation includes restricting the maximum size of incoming XML payloads and running affected applications in restricted environments to limit impact.

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

A denial of service vulnerability (CVE-2026-45186) has been identified in the libexpat XML parsing library used in Red Hat Enterprise Linux 9. This flaw allows denial of service via crafted XML input. Red Hat has issued a security update to address this issue in expat version 2.5.0-6.el9_8.1. The update is rated as Important by Red Hat Product Security. No public exploit code or in-the-wild exploitation has been reported.

Red Hat Security Advisory: expat security update

coin3

expat

vnc4

xmlrpc-c

ayttm

cableswig

cadaver

gdcm

insighttoolkit4

libxmltok

matanza

smart

swish-e

tdom

wbxml2

Expat is a C library for parsing XML documents.

Security Fix(es):

* libexpat: denial of service via crafted XML input (CVE-2026-45186)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A denial of service vulnerability (CVE-2026-45186) has been identified in libexpat, a C library used for parsing XML documents. This flaw can be triggered by crafted XML input. Red Hat has issued a security advisory for Red Hat Enterprise Linux 10, rating the impact as Important and providing updated packages to address the issue.

A denial of service vulnerability (CVE-2026-45186) exists in the Expat XML parser library written in C. This flaw can be triggered by crafted XML input causing the parser to crash or become unresponsive. The vulnerability affects version 7.3 of the Debian package and Red Hat Enterprise Linux 8 distributions. Red Hat has released security updates addressing this issue in expat version 2.5.0-2.el8_10. No public exploits or in-the-wild exploitation have been reported.

expat: Schwachstelle ermöglicht Denial of Service

libexpat

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Search: CVE-2026-45186