Detections
Analytics

AlmaLinux 9.2 [TuxCare] Security Update: thunderbird Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787115646)

medium Nessus Plugin ID 360063

Synopsis

The AlmaLinux host is missing one or more security updates.

Description

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787115646 advisory.

 - Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 143 and Thunderbird 143. (CVE-2025-10530)

 - Mitigation bypass in the Web Compatibility: Tooling component. This vulnerability was fixed in Firefox 143 and Thunderbird 143. (CVE-2025-10531)

 - Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to escalate privileges. *This bug only affects Thunderbird for macOS. Other versions of Thunderbird are unaffected.*. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, and Thunderbird 128.10. (CVE-2025-4082)

 - A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. *This bug only affects Thunderbird for Android.
 Other versions of Thunderbird are unaffected.*. This vulnerability was fixed in Firefox 138 and Thunderbird 138. (CVE-2025-4086)

 - Due to insufficient escaping of special characters in the copy as cURL feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability was fixed in Firefox 138 and Thunderbird 138. (CVE-2025-4089)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected thunderbird package based on the guidance in TuxCare advisory ALMALINUX9.2:CLSA-2026:1787115646.

See Also

https://cve.tuxcare.com/els/releases/CLSA-2026:1787115646

http://www.nessus.org/u?68f4dc3d

Plugin Details

Severity: Medium

ID: 360063

File Name: tuxcare_alma_linux_9.2_CLSA-2026-1787115646.nasl

Version: 1.1

Type: Local

Published: 10/1/2026

Updated: 10/1/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.88

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2026-4728

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/AlmaLinux/release, Host/AlmaLinux/rpm-list, Host/OS/extended-third-party

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/19/2026

Vulnerability Publication Date: 4/29/2025

Reference Information

CVE: CVE-2025-10530, CVE-2025-10531, CVE-2025-4082, CVE-2025-4086, CVE-2025-4089, CVE-2025-4092, CVE-2025-5272, CVE-2025-8043, CVE-2025-8044, CVE-2026-0881, CVE-2026-0892, CVE-2026-12300, CVE-2026-12301, CVE-2026-12316, CVE-2026-12326, CVE-2026-16364, CVE-2026-16365, CVE-2026-16366, CVE-2026-16370, CVE-2026-16372, CVE-2026-16376, CVE-2026-16378, CVE-2026-16380, CVE-2026-16382, CVE-2026-16384, CVE-2026-16385, CVE-2026-16386, CVE-2026-16388, CVE-2026-16389, CVE-2026-16399, CVE-2026-16400, CVE-2026-16401, CVE-2026-16402, CVE-2026-16403, CVE-2026-16407, CVE-2026-16409, CVE-2026-16410, CVE-2026-2798, CVE-2026-2801, CVE-2026-2802, CVE-2026-2804, CVE-2026-4726, CVE-2026-4728, CVE-2026-6755, CVE-2026-6758, CVE-2026-6760, CVE-2026-6768, CVE-2026-6783

CLSA: 2026:1787115646