Most recent entries from all

ALSA-2025:4229 — Important: thunderbird security update

Affected: AlmaLinux:9: thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* thunderbird: User Interface (UI) Misrepresentation of attachment URL (CVE-2025-3523) * thunderbird: Information Disclosure of /tmp directory listing (CVE-2025-2830) * thunderbird: Leak of hashed Window credentials via crafted attachment URL (CVE-2025-3522)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-07589

certfr-2025-avi-0317 — De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Elles permettent à un attaquant de provoquer…

certfr-2025-avi-0317

EUVD-2026-290730

fkie_cve-2025-3523

When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.

GHSA-4h7q-pj8m-5675

When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.

OESA-2025-1835 — thunderbird security update

Affected: openEuler:24.03-LTS-SP2: thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es):

A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10458)

An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10459)

The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10460)

In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, which could allow XSS attacks. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10461)

Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10462)

Video frames could have been leaked between origins in some situations. Thi…

openSUSE-SU-2025:15000-1 — MozillaThunderbird-128.9.2-1.1 on GA media

MozillaThunderbird-128.9.2-1.1 on GA media

RHSA-2025:4389 — Red Hat Security Advisory: thunderbird security update

thunderbird: Information Disclosure of /tmp directory listing thunderbird: Leak of hashed Window credentials via crafted attachment URL thunderbird: User Interface (UI) Misrepresentation of attachment URL

SUSE-SU-2025:1366-1 — Security update for MozillaThunderbird

Security update for MozillaThunderbird

UBUNTU-CVE-2025-3523

Affected: Ubuntu:22.04:LTS: thunderbird

WID-SEC-W-2025-0803 — Mozilla Thunderbird und Thunderbird ESR: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Thunderbird ausnutzen, um Informationen preiszugeben und Spoofing-Angriffe durchzuführen.