Loading story…
Debian issued security advisories DSA-6178-1 and DSA-6179-1 for Firefox ESR and Thunderbird, releasing updated packages to address unspecified security flaws in the browser and email client. The notices were published through Debian Security Announce and indicate that both widely deployed Mozilla applications received coordinated fixes for vulnerabilities affecting Debian users.
The updates highlight continued patching of internet-facing software that commonly processes untrusted web and email content, making both products high-priority targets for exploitation. Organizations running Debian systems should review the relevant advisories, deploy the updated firefox-esr and thunderbird packages promptly, and verify that endpoints and user workstations are aligned with the latest security releases.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Debian published security advisory DSA 6179-1 for thunderbird, announcing a security update for the package.
Debian published security advisory DSA 6178-1 for firefox-esr, announcing a security update for the package.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Debian published two security advisories for **Thunderbird**, identified as `DSA-6211-1` and `DSA-6229-1`, indicating repeated security fixes for the email client within a short period. The notices show Debian maintained active remediation for Thunderbird vulnerabilities affecting supported Debian systems, with separate updates released through the Debian security advisory channel. The advisories did not include a public synopsis in the provided references, but they confirm that administrators using Debian-packaged Thunderbird should review and apply the latest available security updates. The back-to-back notices suggest ongoing vulnerability handling for Thunderbird and reinforce the need to verify package versions across endpoints where the client is installed.
Jun 29, 2026
Debian issued **DSA-6148-1** to ship a *firefox-esr* security update after Mozilla disclosed numerous vulnerabilities that could enable **arbitrary code execution**, **sandbox escape**, **same-origin policy bypass**, **information disclosure**, and **privilege escalation**. The advisory lists a large set of CVEs (including `CVE-2026-2757` through `CVE-2026-2793`, with gaps) and states fixes are available for Debian *oldstable* (bookworm) in **`firefox-esr` 140.8.0esr-1~deb12u1** (with the notice indicating corresponding updates for *stable* as well). The Canadian Centre for Cyber Security published **AV26-160**, relaying Mozilla’s February 24, 2026 advisories and urging organizations to apply updates for affected Mozilla products, including **Firefox ESR prior to 140.8**, **Firefox ESR prior to 115.33**, and **Firefox prior to 148**. The alert points administrators to Mozilla Foundation Security Advisories **2026-13**, **2026-14**, and **2026-15** as upstream references for the addressed vulnerabilities and remediation guidance.
Jun 29, 2026
Mozilla released **Firefox 150** and updated **Firefox ESR** branches to address multiple security vulnerabilities, prompting downstream advisories from Debian and the Canadian Centre for Cyber Security. The fixes cover Firefox versions prior to `150`, Firefox ESR versions prior to `140.10` and `115.35`, and include vulnerabilities tracked as **CVE-2026-6768**, **CVE-2026-6784**, **CVE-2026-6785**, and **CVE-2026-6786**. **CVE-2026-6768** was described as a mitigation bypass in Firefox’s `Networking: Cookies` component and was assigned a **CVSS 9.8** score, indicating potentially severe impact if left unpatched. Mozilla also shipped related security fixes in **Thunderbird 150**, which uses Firefox’s web engine and addressed issues including a clickjacking and information disclosure flaw referenced in the Firefox advisories. Alongside the security patches, Mozilla’s releases included broad product updates such as privacy and platform changes in Firefox and improved encrypted-message search and OpenPGP features in Thunderbird. Government and Linux distribution advisories urged users and administrators to review Mozilla’s bulletins and apply the latest browser and mail client updates promptly.
Jun 29, 2026