Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Thunderbird could reveal attachments and file paths
published 1 year ago
Summary
The Thunderbird email program can mistakenly show the true web address of an attachment, let attackers see temporary file listings, and expose hashed login data. It also contains flaws that could let a malicious update gain higher privileges. Install the latest Thunderbird update as soon as possible to close these gaps.
What to do
- Update almalinux thunderbird to version 128.10.0-1.el10_0.alma.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:10 | almalinux | thunderbird |
< 128.10.0-1.el10_0.alma.1 Fix: upgrade to 128.10.0-1.el10_0.alma.1
|
Original advisory text
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* thunderbird: User Interface (UI) Misrepresentation of attachment URL (CVE-2025-3523)
* thunderbird: Information Disclosure of /tmp directory listing (CVE-2025-2830)
* thunderbird: Leak of hashed Window credentials via crafted attachment URL (CVE-2025-3522)
* firefox: thunderbird: Privilege escalation in Firefox Updater (CVE-2025-2817)
* firefox: thunderbird: Unsafe attribute access during XPath parsing (CVE-2025-4087)
* firefox: thunderbird: Process isolation bypass using "javascript:" URI links in cross-origin frames (CVE-2025-4083)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10 (CVE-2025-4091)
* firefox: thunderbird: Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10 (CVE-2025-4093)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* thunderbird: User Interface (UI) Misrepresentation of attachment URL (CVE-2025-3523)
* thunderbird: Information Disclosure of /tmp directory listing (CVE-2025-2830)
* thunderbird: Leak of hashed Window credentials via crafted attachment URL (CVE-2025-3522)
* firefox: thunderbird: Privilege escalation in Firefox Updater (CVE-2025-2817)
* firefox: thunderbird: Unsafe attribute access during XPath parsing (CVE-2025-4087)
* firefox: thunderbird: Process isolation bypass using "javascript:" URI links in cross-origin frames (CVE-2025-4083)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10 (CVE-2025-4091)
* firefox: thunderbird: Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10 (CVE-2025-4093)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2025:7507 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-2817 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-2830 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-3522 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-3523 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-4083 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-4087 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-4091 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-4093 Third Party Advisory
- https://bugzilla.redhat.com/2359786 Third Party Advisory
- https://bugzilla.redhat.com/2359789 Third Party Advisory
- https://bugzilla.redhat.com/2359793 Third Party Advisory
- https://bugzilla.redhat.com/2362902 Third Party Advisory
- https://bugzilla.redhat.com/2362904 Third Party Advisory
- https://bugzilla.redhat.com/2362907 Third Party Advisory
- https://bugzilla.redhat.com/2362912 Third Party Advisory
- https://bugzilla.redhat.com/2362915 Third Party Advisory
- https://errata.almalinux.org/10/ALSA-2025-7507.html Vendor Advisory
Timeline
Published13 May 2025
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2025:7507 · OSV
Track software like this
Free during beta