This update for MozillaThunderbird fixes the following issues:
Mozilla Thunderbird 140.4:
* changed: Account Hub is now disabled by default for second
email account
* changed: Flatpak runtime has been updated to Freedesktop SDK
24.08
* fixed: Users could not read mail signed with OpenPGP v6 and
PQC keys
* fixed: Image preview in Insert Image dialog failed with CSP
error for web resources
* fixed: Emptying trash on exit did not work with some
providers
* fixed: Thunderbird could crash when applying filters
* fixed: Users were unable to override expired mail server
certificate
* fixed: Opening Website header link in RSS feed incorrectly
re-encoded URL parameters
* fixed: Security fixes
MFSA 2025-85 (bsc#1251263):
* CVE-2025-11708
Use-after-free in MediaTrackGraphImpl::GetInstance()
* CVE-2025-11709
Out of bounds read/write in a privileged process triggered by
WebGL textures
* CVE-2025-11710
Cross-process...
Read the Full Advisory- openSUSE Leap 16.0:
MozillaThunderbird-140.4.0-bp160.1.1
MozillaThunderbird-openpgp-librnp-140.4.0-bp160.1.1
MozillaThunderbird-translations-common-140.4.0-bp160.1.1
MozillaThunderbird-translations-other-140.4.0-bp160.1.1
* bsc#1247774
* bsc#1251263
References:
* https://www.suse.com/security/cve/CVE-2025-11708.html
* https://www.suse.com/security/cve/CVE-2025-11709.html
* https://www.suse.com/security/cve/CVE-2025-11710.html
* https://www.suse.com/security/cve/CVE-2025-11711.html
* https://www.suse.com/security/cve/CVE-2025-11712.html
* https://www.suse.com/security/cve/CVE-2025-11713.html
* https://www.suse.com/security/cve/CVE-2025-11714.html
* https://www.suse.com/security/cve/CVE-2025-11715.html
Get the latest Linux and open source security news straight to your inbox.