-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 02 Sep 2026 09:10:45 -0400
Source: thunderbird
Binary: thunderbird thunderbird-dbgsym
Architecture: i386
Version: 1:140.15.0esr-1~deb13u1
Distribution: trixie-security
Urgency: medium
Maintainer: amd64 / i386 Build Daemon (x86-ubc-02) <buildd_amd64-x86-ubc-02@buildd.debian.org>
Changed-By: Christoph Goehre <chris@sigxcpu.org>
Description:
 thunderbird - mail/news client with RSS, chat and integrated spam filter suppor
Changes:
 thunderbird (1:140.15.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * [4095154] New upstream version 140.15.0esr
     Fixed CVE issues in upstream version 140.15 (MFSA 2026-87):
     CVE-2026-84639: Uninitialized memory in MIME parsing
     CVE-2026-84640: One byte overflow read in mail parser
     CVE-2026-84641: Information disclosure due to malicious IMAP server
                     response
     CVE-2026-75874: Sandbox escape in the Remote Settings Client component
     CVE-2026-16365: Privilege escalation in the DOM: Workers component
     CVE-2026-84119: Sandbox escape due to use-after-free in the DOM:
                     Navigation component
     CVE-2026-84120: Use-after-free in the Audio/Video component
     CVE-2026-84121: Sandbox escape due to use-after-free in the DOM: Security
                     component
     CVE-2026-84122: Use-after-free in the Audio/Video component
     CVE-2026-84124: Use-after-free in the DOM: Core &amp; HTML component
     CVE-2026-16371: Privilege escalation in the DOM: Navigation component
     CVE-2026-84131: Privilege escalation due to invalid pointer in the
                     Graphics component
     CVE-2026-84143: Internally found bugs fixed in Thunderbird 155,
                     Thunderbird ESR 153.2 and Thunderbird ESR 140.15
     CVE-2026-84145: Internally found bugs fixed in Thunderbird 155,
                     Thunderbird ESR 153.2 and Thunderbird ESR 140.15
Checksums-Sha1:
 dd751be6dbb42a087a788363ae44b358700d54f8 8629916 thunderbird-dbgsym_140.15.0esr-1~deb13u1_i386.deb
 c322c27770c05b23694241d219c0c488fd5648a8 21274 thunderbird_140.15.0esr-1~deb13u1_i386-buildd.buildinfo
 8c2706d266297a1b6d16ad60be7f4ded43d0bce8 74226164 thunderbird_140.15.0esr-1~deb13u1_i386.deb
Checksums-Sha256:
 824167c75d2a413bda43f1d1ed6b2e788339777bc69eeaf0348ee82c4d7cde20 8629916 thunderbird-dbgsym_140.15.0esr-1~deb13u1_i386.deb
 d457352dc1411714e7fa12a6b9c04aeadaef025efafaa62e08fa494fbce39069 21274 thunderbird_140.15.0esr-1~deb13u1_i386-buildd.buildinfo
 fe3a90005473a1f6daf43341fb231b902cc74bfd0b5d6926d58987aeb0d882b4 74226164 thunderbird_140.15.0esr-1~deb13u1_i386.deb
Files:
 006f7ad77bcf00bedbfc347ebc8d230a 8629916 debug optional thunderbird-dbgsym_140.15.0esr-1~deb13u1_i386.deb
 ea8bcf5f6e867ec79f558408291bd1af 21274 mail optional thunderbird_140.15.0esr-1~deb13u1_i386-buildd.buildinfo
 e0172d259e4cdd9d65e1cb2ab458b0d2 74226164 mail optional thunderbird_140.15.0esr-1~deb13u1_i386.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEb5EwsJvHBEjqIJYIbheoBegwXLIFAmqYYvUACgkQbheoBegw
XLIyORAAmvN2aOm5Q3T+qsYDhQ/ZQpz3hkErgwWs0AWr+ThULTuK/YbY7pnUvTJn
SgwOhxg0CPzoGCqczwYlMSCu2BHMtR7oGWnBzUII0IZ5+kxge/FFL0yH2vPZJRiA
sd+7ex95+hXvmwphQtOfA/Js2DgeV/WKmzfuTu7yq0jN2S+d9O+xEE+lm/JGkCQ6
SMDTXmAXPlv1ZItGb8QDRdW9AHf9m3FTZPIDw/KVUfofyK5J6o3336dtDLWubDNB
cSuG+hVcLBAFtkBImc4xl1e83wmA+HA5uC2XcXAdLESD8smI+qyxJoIwP1HZQ34L
pPBt8fXvy/gMz5tREnphHbth9JgPd7v2HNma07JV43DCoOGhdRDG8nEssSOzEiND
r82Vz5/fdkSM1n3QKYTOL6q4if4uSUXeMf0bqQEnUF4VfjjsvNOeBO7qRQgqamFT
Dp0oGyc/tVup90MrzwKUL67cFK5Hhe9I+01546EkoU3t2BrRAZNswaabS8LQELnO
2HZbTm/GDiBtN2Di8Up/3wknNHtiiexpYK8w6GLDoj+dNIwz6L9m6olks+Ok1/4x
/1R+YJeySHoWC3oITWgO5fT4tVqybEvIvB0hABZrAOr76rNXuuqGHuGsjiw1Wcxw
xL4jcirqfQAqwLavevPODoPdB4wun+s+mMnJR0Fx3uoGeI7ifbA=
=agJn
-----END PGP SIGNATURE-----