Debian DSA-6598-1 updates Thunderbird
Debian has released DSA-6598-1, a security update for Thunderbird. See how to check installed versions and apply the fix across machines.
TL;DR: Debian has published DSA-6598-1, a security update for Thunderbird, so Debian machines with the mail client should be upgraded.
What happened
The Debian security team announced DSA-6598-1 on October 30, 2026. It is a security update for Thunderbird. The announcement points to the Debian security tracker for the CVEs it covers and the fixed versions, so use the tracker for the exact version to install.
Am I affected?
Thunderbird is a desktop mail client, so it is most likely on developer workstations and some jump hosts. To check one machine by hand, run dpkg -l | grep -i thunderbird, then apt list --upgradable | grep -i thunderbird. Apply the update with sudo apt update && sudo apt install --only-upgrade thunderbird, then restart the application.
How to check with Stackurity
Stackurity assesses Debian packages with the distribution's own advisories, so DSA-6598-1 is matched against the installed Thunderbird package on servers where its agent runs, and shows the version to upgrade to. Workstations without the agent are not seen, so cover them with your usual patch tooling.
Stackurity keeps a live inventory of installed packages through a read-only agent on Linux servers and matches it against new advisories every hour, using each distribution's own version rules so that backports are not reported as false alarms. After an upgrade, check again records whether the issue is really gone. Read how verification works. The core is open source, and Stackurity Cloud offers a 14-day free trial without a card: start a free trial.
