Package thunderbird: Information
Source package: thunderbird
Version: 157.0.1-alt1
Build time: Oct 22, 2026, 05:01 PM in the task #435998
Category: Networking/Mail
Report package bugHome page: https://www.thunderbird.net
License: MPL-2.0
Summary: Thunderbird is Mozilla's e-mail client
Description:
Thunderbird is Mozilla's next generation e-mail client. Thunderbird makes emailing safer, faster and easier than ever before and can also scale to meet the most sophisticated organizational needs. The package contains Lightning - an integrated calendar for Thunderbird.
List of RPM packages built from this SRPM:
thunderbird (x86_64, aarch64)
thunderbird-debuginfo (x86_64, aarch64)
thunderbird (x86_64, aarch64)
thunderbird-debuginfo (x86_64, aarch64)
Maintainer: Ajrat Makhmutov
List of contributors:
Ajrat Makhmutov
Ivan A. Melnikov
Pavel Vasenkov
Andrey Cherepanov
Grigory Ustinov
Alexey Sheplyakov
Aleksei Nikiforov
Gleb Fotengauer-Malinovskiy
Paul Wolneykien
Anton Farygin
Vladimir Didenko
Alexey Gladkov
Alexey Morozov
Ajrat Makhmutov
Ivan A. Melnikov
Pavel Vasenkov
Andrey Cherepanov
Grigory Ustinov
Alexey Sheplyakov
Aleksei Nikiforov
Gleb Fotengauer-Malinovskiy
Paul Wolneykien
Anton Farygin
Vladimir Didenko
Alexey Gladkov
Alexey Morozov
Last changed
Oct. 2, 2026 Ajrat Makhmutov 157.0.1-alt1
- New version.
Oct. 1, 2026 Ajrat Makhmutov 157.0-alt1
- New version. - Fix an EWS account showing no folders when the server rejects one of the requested well-known folder IDs (Closes: 60098). - Fixes: + CVE-2026-103500: Heap buffer overflow opening large email + CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback component + CVE-2026-100757: Use-after-free in the Widget component + CVE-2026-100758: Sandbox escape in the DOM: Navigation component + CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager component + CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing component + CVE-2026-100761: Privilege escalation due to use-after-free in the Graphics: WebGPU component + CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content Processes component + CVE-2026-100763: Incorrect boundary conditions in the Graphics: WebGPU component + CVE-2026-100764: Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component + CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component + CVE-2026-100766: Information disclosure in the Networking: JAR component + CVE-2026-100767: Use-after-free in the Networking: Cache component + CVE-2026-100768: Use-after-free in the Graphics: WebGPU component + CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component + CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content Processes component + CVE-2026-100771: Undefined behavior in the DOM: Streams component + CVE-2026-100772: Use-after-free in the DOM: Core & HTML component + CVE-2026-100773: Use-after-free in the Storage: IndexedDB component + CVE-2026-100774: Use-after-free in the DOM: Core & HTML component + CVE-2026-100775: Sandbox escape in the Graphics component + CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component + CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component + CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core & HTML component + CVE-2026-100779: Use-after-free in the XSLT component + CVE-2026-100780: Use-after-free in the DOM: Core & HTML component + CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component + CVE-2026-100782: Privilege escalation due to incorrect boundary conditions in the Graphics component + CVE-2026-100783: Uninitialized memory in the Audio/Video component + CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component + CVE-2026-100785: Use-after-free in the DOM: Core & HTML component + CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics component + CVE-2026-100787: Sandbox escape in the XUL component + CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component + CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component + CVE-2026-100790: Use-after-free in the XSLT component + CVE-2026-100791: Use-after-free in the DOM: Core & HTML component + CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly component + CVE-2026-100793: JIT miscompilation in the JavaScript Engine component + CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the Internationalization component + CVE-2026-96869: Information disclosure in the Networking component + CVE-2026-100795: Denial-of-service in the Networking component + CVE-2026-100796: Use-after-free in the JavaScript: WebAssembly component + CVE-2026-100797: Privilege escalation due to use-after-free in the Graphics: WebRender component + CVE-2026-100798: Cryptography misuse in Storage: Quota Manager component + CVE-2026-100799: Uninitialized memory in the Graphics: WebGPU component + CVE-2026-100800: Sandbox escape due to use-after-free in the Disability Access APIs component + CVE-2026-100801: Privilege escalation in the DLL Services component + CVE-2026-100802: Uninitialized memory in the Graphics: WebGPU component + CVE-2026-100803: Same-origin policy bypass in the WebExtensions component + CVE-2026-100804: Sandbox escape due to use-after-free in the Preferences: Backend component + CVE-2026-100805: Race condition, use-after-free in the Audio/Video component + CVE-2026-100806: Uninitialized memory in the Graphics: WebGPU component + CVE-2026-100807: Privilege escalation in the DOM: Service Workers component + CVE-2026-100808: Mitigation bypass in the DOM: Service Workers component + CVE-2026-100809: Same-origin policy bypass in the DevTools component + CVE-2026-100810: Other issue in the DevTools component + CVE-2026-100811: Sandbox escape due to use-after-free in the DOM: Core & HTML component + CVE-2026-100812: Denial-of-service in the Graphics component + CVE-2026-100813: Invalid pointer in the JavaScript Engine: JIT component + CVE-2026-100814: Incorrect boundary conditions in the JavaScript Engine: JIT component + CVE-2026-100815: Use-after-free in the CSS Parsing and Computation component + CVE-2026-100816: Site isolation issue in the DOM: Networking component + CVE-2026-100817: Other issue in the JavaScript: WebAssembly component + CVE-2026-100818: Sandbox escape due to use-after-free in the Widget: Gtk component + CVE-2026-100819: Sandbox escape due to incorrect boundary conditions in the XPCOM component + CVE-2026-100820: Privilege escalation in the Address Bar component + CVE-2026-100821: Site isolation issue in the Panning and Zooming component + CVE-2026-100822: Spoofing issue in the Networking: HTTP component + CVE-2026-100824: Privilege escalation in the Places component + CVE-2026-100825: Use-after-free in the JavaScript Engine: JIT component + CVE-2026-100826: Denial-of-service in the Storage: StorageManager component + CVE-2026-100828: Mitigation bypass in the Bookmarks & History component + CVE-2026-100829: Mitigation bypass in the DOM: Security component + CVE-2026-100830: Mitigation bypass in the DOM: Navigation component + CVE-2026-100831: Use-after-free in the DOM: UI Events & Focus Handling component
Sept. 23, 2026 Ajrat Makhmutov 156.0.1-alt1
- New version. - Drop the new-mail sound patch rejected upstream: the Xfce event-sounds default is not a Thunderbird bug. - Rework the chat message style patch after upstream review.