-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 02 Sep 2026 09:10:45 -0400
Source: thunderbird
Architecture: source
Version: 1:140.15.0esr-1~deb13u1
Distribution: trixie-security
Urgency: medium
Maintainer: Carsten Schoenert <c.schoenert@t-online.de>
Changed-By: Christoph Goehre <chris@sigxcpu.org>
Changes:
 thunderbird (1:140.15.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * [4095154] New upstream version 140.15.0esr
     Fixed CVE issues in upstream version 140.15 (MFSA 2026-87):
     CVE-2026-84639: Uninitialized memory in MIME parsing
     CVE-2026-84640: One byte overflow read in mail parser
     CVE-2026-84641: Information disclosure due to malicious IMAP server
                     response
     CVE-2026-75874: Sandbox escape in the Remote Settings Client component
     CVE-2026-16365: Privilege escalation in the DOM: Workers component
     CVE-2026-84119: Sandbox escape due to use-after-free in the DOM:
                     Navigation component
     CVE-2026-84120: Use-after-free in the Audio/Video component
     CVE-2026-84121: Sandbox escape due to use-after-free in the DOM: Security
                     component
     CVE-2026-84122: Use-after-free in the Audio/Video component
     CVE-2026-84124: Use-after-free in the DOM: Core &amp; HTML component
     CVE-2026-16371: Privilege escalation in the DOM: Navigation component
     CVE-2026-84131: Privilege escalation due to invalid pointer in the
                     Graphics component
     CVE-2026-84143: Internally found bugs fixed in Thunderbird 155,
                     Thunderbird ESR 153.2 and Thunderbird ESR 140.15
     CVE-2026-84145: Internally found bugs fixed in Thunderbird 155,
                     Thunderbird ESR 153.2 and Thunderbird ESR 140.15
Checksums-Sha1:
 43899f7147664075d98d0efb1408ad681b837bf4 8496 thunderbird_140.15.0esr-1~deb13u1.dsc
 d8429f80890d339a19b58f1e3c9eb62374ee79ff 12278824 thunderbird_140.15.0esr.orig-thunderbird-l10n.tar.xz
 7d13956f6a120a38432ae78827ababbfb7631440 786619936 thunderbird_140.15.0esr.orig.tar.xz
 a3637b28978495138d8a47ca1797be1ff9abf9dc 572508 thunderbird_140.15.0esr-1~deb13u1.debian.tar.xz
Checksums-Sha256:
 98cc4b9274a9721dabfca3a1a79988ab38cbbce9bcd3bab86d4eaee74c655794 8496 thunderbird_140.15.0esr-1~deb13u1.dsc
 de8e669e0230a221c215648d1cc26318f8cc873fa8e28acb610588eb8f853d4a 12278824 thunderbird_140.15.0esr.orig-thunderbird-l10n.tar.xz
 0c492070521a3783c82856382bd6fb56ef515b9e40c3885d4dbe08f2274fcaa2 786619936 thunderbird_140.15.0esr.orig.tar.xz
 1b9770e791300798aaad29e4bb0025f618c873ab1304b9a0f80b61b3d4a5fe63 572508 thunderbird_140.15.0esr-1~deb13u1.debian.tar.xz
Files:
 bc0b95134fdc1eac8ea1b08b7d2e8efb 8496 mail optional thunderbird_140.15.0esr-1~deb13u1.dsc
 c6ec44bc8b63f914cfb1ff75369e7285 12278824 mail optional thunderbird_140.15.0esr.orig-thunderbird-l10n.tar.xz
 95f592cc66813b4bdf63791d288cde66 786619936 mail optional thunderbird_140.15.0esr.orig.tar.xz
 bc5c9337a033aa5dd7e41291d3fa7445 572508 mail optional thunderbird_140.15.0esr-1~deb13u1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEi5SBnCVVcKN0tizNJuPIdadEIO8FAmqYQHUACgkQJuPIdadE
IO+UkA/+IN4yeK12TS9nxRT5UsAj+UFf6kFyhF6PcV6sPeiX+cpJOiASqQnDywjs
nmac0aQgXBrSIZHjSRmJvMIU9FgbBH2PVp2TzQRc64tu9uptm6W2VtrozE6OIVJX
YE9+FvXXhITShTYUK9p5c+uTFBla90KnqGBa0tJRUOec+RCDH1kmguWdTlTaDkal
foQbn/S49x1MmypQWhO+AYZmq9IvWeuNOSATNdLrpa4B8ttAahURbCRN8VVpxcWp
vRqHRCYtrIBYR4al8wELb9MSQRUpWibB3jwGrhfjnk6TspxL9VjdEl+1v+RF9KRZ
tnQY3Oo9y4mGwBQVwNuTybD1zzNov78h+OmbZ6cD5XlRZNoOVxEQeOGz77cRWdmH
tS17Kgg2X2P2OrFU2nQOeHQqS3bV5cNXIXKg/F+z6s+xzTK0y5m+4AyOoec4EWnH
pYuZOYFw475ltXL1uipf5SpDi3Oi9/fagLt7UcAhExrvmB5OXgsXXg3+7d45qoWe
MXdaMHTTI6cr0gyzVxht1vnHiyfSFM4yQvxrq74tX/i4CabedDH609hYmZt3dXlt
hoTnQlBXq4i484TY2+1W1kqsfKyeL8ofLs3OkZZ3XFiuXbYcWvGJo8tcy1PWFLSC
omLpDHNxeYbngMw1T+GzayqDnpWNllHwW/avfk9wv3v4NZ8GewE=
=guG3
-----END PGP SIGNATURE-----