Read the docs
Red Hat Security Advisory

RHSA-2025:0165

thunderbird security update

Released 2025-01-09 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 7 records

TI-2025-00200 CVE-2025-0242 · GHSA-qw28-p6qx-vj78

Out-of-bounds write in Mozilla Firefox

Priority MEDIUM 46

Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.14716 Published 2025-01-07 Partial fix · 115.19, 128.6 +1 CWE-787
TI-2025-00199 CVE-2025-0241 · GHSA-hh4j-jwjv-8726

Memory corruption when using JavaScript Text Segmentation

Priority MEDIUM 43

When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash.

CVSS 3.1HIGH 7.7 Network No auth No interaction EPSS 0.00734 Published 2025-01-07 Partial fix · 128.6, 134 CWE-401
TI-2025-00195 CVE-2025-0237 · GHSA-2776-h8x3-vrr7

WebChannel APIs susceptible to confused deputy attack

Priority LOW 27

The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00598 Published 2025-01-07 Partial fix · 128.6, 134 CWE-863
TI-2025-00196 CVE-2025-0238 · GHSA-phcc-6pmp-qw9v

Use-after-free when breaking lines in text

Priority LOW 25

Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00794 Published 2025-01-07 Partial fix · 115.19, 128.6 +1 CWE-416
TI-2025-00198 CVE-2025-0240 · GHSA-f3xq-g93v-w8cv

Compartment mismatch when parsing JavaScript JSON module

Priority LOW 20

Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free.

CVSS 3.1MEDIUM 4.0 Local No auth No interaction EPSS 0.00673 Published 2025-01-07 Partial fix · 128.6, 134 CWE-416
TI-2025-00197 CVE-2025-0239 · GHSA-p4q7-g7ff-823j

Alt-Svc ALPN validation failure when redirected

Priority LOW 18

When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site.

CVSS 3.1MEDIUM 4.0 Local No auth No interaction EPSS 0.00227 Published 2025-01-07 Partial fix · 128.6, 134 CWE-295