Red Hat Security Advisory

RHSA-2025:18320

thunderbird security update

Released 2025-10-20 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) thunderbird-140.4.0-2.el10_0

Fixes 7 records

TI-2025-10735 CVE-2025-11710 · GHSA-ff52-484q-63r5

Cross-process information leaked due to malicious IPC messages

MEDIUM 49

A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised process.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00422 Published 2025-10-14 Partial fix · 115.29, 140.4 +1 CWE-200

TI-2025-10734 CVE-2025-11709 · GHSA-2w7r-ggfp-x894

Out of bounds read/write in a privileged process triggered by WebGL textures

MEDIUM 49

A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00422 Published 2025-10-14 Partial fix · 115.29, 140.4 +1 CWE-787

TI-2025-10733 CVE-2025-11708 · GHSA-h7jc-cc8w-wcwg

Use after free in Mozilla Firefox

MEDIUM 49

Use-after-free in MediaTrackGraphImpl::GetInstance().

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00509 Published 2025-10-14 Partial fix · 140.4, 144 CWE-416

TI-2025-10740 CVE-2025-11715 · GHSA-vpvq-m4pf-x2cp

Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144

MEDIUM 40

Memory safety bugs present in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00328 Published 2025-10-14 Partial fix · 140.4, 144 CWE-119

TI-2025-10739 CVE-2025-11714 · GHSA-2p9h-v8v8-2j3w

Memory corruption in Mozilla Firefox

MEDIUM 40

Memory safety bugs present in Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00335 Published 2025-10-14 Partial fix · 115.29, 140.4 +1 CWE-119

TI-2025-10736 CVE-2025-11711 · GHSA-xp5g-gff9-qvvx

Some non-writable Object properties could be modified

LOW 28

There was a way to change the value of JavaScript Object properties that were supposed to be non-writeable.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0023 Published 2025-10-14 Partial fix · 115.29, 140.4 +1 CWE-591

TI-2025-10737 CVE-2025-11712 · GHSA-rf6g-cf9f-g4v7

An OBJECT tag type attribute overrode browser behavior on web resources without a content-type

LOW 27

A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00221 Published 2025-10-14 Partial fix · 140.4, 144 CWE-116