Red Hat Security AdvisoryRHSA-2025:7689
thunderbird security update
Released 2025-05-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v.8.8) thunderbird-128.10.0-1.el8_8
Fixes 5 records
Priority MEDIUM 48
A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially ena…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00459 · Published 2025-04-29 · Partial fix · 115.23, 128.10 +1 CWE-653
Priority MEDIUM 41
Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00667 · Published 2025-04-29 · Partial fix · 115.23, 128.10 +1 CWE-22
Priority LOW 38
Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00491 · Published 2025-04-29 · Partial fix · 128.10 CWE-119
Priority LOW 38
Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00507 · Published 2025-04-29 · Partial fix · 128.10, 138 CWE-119
Priority LOW 22
A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access.
CVSS 3.1MEDIUM 4.8· Network · No auth · No interaction · EPSS 0.00323 · Published 2025-04-29 · Partial fix · 128.10, 138 CWE-125
THREATIST.IORead the docs