Most recent entries from all

ALSA-2025:1184 — Important: thunderbird security update

2026-10-04T20:46:14.862909+00:00

Affected: AlmaLinux:9: thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7 (CVE-2025-1017) * firefox: thunderbird: Use-after-free in Custom Highlight (CVE-2025-1010) * firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7 (CVE-2025-1016) * firefox: thunderbird: Potential opening of private browsing tabs in normal browsing windows (CVE-2025-1013) * firefox: thunderbird: A bug in WebAssembly code generation could result in a crash (CVE-2025-1011) * thunderbird: Unsanitized address book fields (CVE-2025-1015) * firefox: thunderbird: Use-after-free in XSLT (CVE-2025-1009) * thunderbird: Address of e-mail sender can be spoofed by malicious email (CVE-2025-0510) * firefox: thunderbird: Certificate length was not properly checked (CVE-2025-1014) * firefox: thunderbird: Use-after-free during concurrent delazification (CVE-2025-1012)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-02316

2026-10-04T20:46:14.862981+00:00

bdu:2025-02316

certfr-2025-avi-0097 — De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un atta…

2026-10-04T20:46:14.862999+00:00

certfr-2025-avi-0097

EUVD-2026-290782

2026-10-04T20:46:14.863016+00:00

EUVD-2026-290782

fkie_cve-2025-0510

2026-10-04T20:46:14.863026+00:00

Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040. This vulnerability was fixed in Thunderbird 128.7 and Thunderbird 135.

GHSA-9h64-69xj-vx28

2026-10-04T20:46:14.863047+00:00

Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040. This vulnerability affects Thunderbird < 128.7 and Thunderbird < 135.

OESA-2025-1835 — thunderbird security update

2026-10-04T20:46:14.863062+00:00

Affected: openEuler:24.03-LTS-SP2: thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es):

A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10458)

An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10459)

The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10460)

In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, which could allow XSS attacks. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10461)

Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10462)

Video frames could have been leaked between origins in some situations. Thi…

openSUSE-SU-2025:14731-1 — MozillaThunderbird-128.7.0-1.1 on GA media

2026-10-04T20:46:14.863281+00:00

MozillaThunderbird-128.7.0-1.1 on GA media

RHSA-2025:1317 — Red Hat Security Advisory: thunderbird security update

2026-10-04T20:46:14.863307+00:00

thunderbird: Address of e-mail sender can be spoofed by malicious email firefox: thunderbird: Use-after-free in XSLT firefox: thunderbird: Use-after-free in Custom Highlight firefox: thunderbird: A bug in WebAssembly code generation could result in a crash firefox: thunderbird: Use-after-free during concurrent delazification firefox: thunderbird: Potential opening of private browsing tabs in normal browsing windows firefox: thunderbird: Certificate length was not properly checked thunderbird: Unsanitized address book fields firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7 firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7

SUSE-SU-2025:0405-1 — Security update for MozillaThunderbird

2026-10-04T20:46:14.863340+00:00

Security update for MozillaThunderbird

UBUNTU-CVE-2025-0510

2026-10-04T20:46:14.863359+00:00

Affected: Ubuntu:22.04:LTS: thunderbird

WID-SEC-W-2025-0262 — Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

2026-10-04T20:46:14.863377+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Mozilla Thunderbird ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen preiszugeben, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen oder Spoofing-Angriffe durchzuführen.