Red Hat Security Advisory

RHSA-2025:3009

thunderbird security update

Released 2025-03-18 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream AUS (v.8.4) thunderbird-128.8.0-2.el8_4
Red Hat Enterprise Linux AppStream E4S (v.8.4) thunderbird-128.8.0-2.el8_4
Red Hat Enterprise Linux AppStream TUS (v.8.4) thunderbird-128.8.0-2.el8_4

Fixes 4 records

TI-2025-01682 CVE-2025-1937 · GHSA-5427-6cg5-37h6

Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8

LOW 36

Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00562 Published 2025-03-04 Partial fix · 115.21, 128.8 +1 CWE-1260

TI-2025-19630 CVE-2025-26696 · GHSA-w56w-w5xr-q52m

Crafted email message incorrectly shown as being encrypted

LOW 31

Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted.

CVSS 3.1HIGH 7.0 Network No auth No interaction EPSS 0.00356 Published 2025-03-10 Partial fix · 128.8, 136 CWE-290

TI-2025-01683 CVE-2025-1938 · GHSA-f8xf-r8j3-6845

Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8

LOW 31

Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00337 Published 2025-03-04 Partial fix · 128.8, 136 CWE-787

TI-2025-19629 CVE-2025-26695 · GHSA-29qq-gf32-fj2m

Downloading of OpenPGP keys from WKD used incorrect padding

LOW 23

When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested email address.

CVSS 3.1MEDIUM 5.3 Local Low privileges No interaction EPSS 0.00156 Published 2025-03-10 Partial fix · 128.8, 136