Most recent entries from all

ALSA-2024:10591 — Important: thunderbird security update

Affected: AlmaLinux:8: thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* thunderbird: Potential disclosure of plaintext in OpenPGP encrypted message (CVE-2024-11159) * firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CVE-2024-11694) * firefox: thunderbird: Unhandled Exception in Add-on Signature Verification (CVE-2024-11696) * firefox: thunderbird: Select list elements could be shown over another site (CVE-2024-11692) * firefox: thunderbird: Memory safety bugs fixed in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5 (CVE-2024-11699) * firefox: thunderbird: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters (CVE-2024-11695) * firefox: thunderbird: Improper Keypress Handling in Executable File Confirmation Dialog (CVE-2024-11697)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-00116

certfr-2024-avi-0983 — Une vulnérabilité a été découverte dans les produits Mozilla. Elle permet à un attaquant de provoquer une atteinte à la…

certfr-2024-avi-0983

cnvd-2025-00867

EUVD-2026-206375

fkie_cve-2024-11159

Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird < 128.4.3 and Thunderbird < 132.0.1.

GHSA-jm4h-wwjv-4q5c

Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird < 128.4.3 and Thunderbird < 132.0.1.

OESA-2025-1835 — thunderbird security update

Affected: openEuler:24.03-LTS-SP2: thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es):

A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10458)

An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10459)

The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10460)

In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, which could allow XSS attacks. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10461)

Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10462)

Video frames could have been leaked between origins in some situations. Thi…

openSUSE-SU-2024:14497-1 — MozillaThunderbird-128.4.3-1.1 on GA media

MozillaThunderbird-128.4.3-1.1 on GA media

RHSA-2024:10667 — Red Hat Security Advisory: thunderbird security update

thunderbird: Potential disclosure of plaintext in OpenPGP encrypted message firefox: thunderbird: Select list elements could be shown over another site firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims firefox: thunderbird: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters firefox: thunderbird: Unhandled Exception in Add-on Signature Verification firefox: thunderbird: Improper Keypress Handling in Executable File Confirmation Dialog firefox: thunderbird: Memory safety bugs fixed in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5

SUSE-SU-2024:4050-1 — Security update for MozillaThunderbird

Security update for MozillaThunderbird

Withdrawn: UBUNTU-CVE-2024-11159

Withdrawn by the publisher.

Affected: Ubuntu:24.04:LTS: thunderbird

Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird < 128.4.3 and Thunderbird < 132.0.1.

WID-SEC-W-2024-3464 — Mozilla Thunderbird: Schwachstelle ermöglicht Offenlegung von Informationen

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Mozilla Thunderbird ausnutzen, um Informationen offenzulegen.