Red Hat Security Advisory

RHSA-2025:8391

thunderbird security update

Released 2025-06-02 · Red Hat rating Important · View on Red Hat →

Fixed in

TI-2025-03455 CVE-2025-3909 · GHSA-h6cg-6m9j-xj9g

LOW 38

Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.0047 Published 2025-05-14 Partial fix · 128.10.1, 138.0.1 CWE-356

TI-2025-03423 CVE-2025-3875 · GHSA-rg69-33g2-mp48

LOW 33

Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00396 Published 2025-05-14 Partial fix · 128.10.1, 138.0.1 CWE-290

TI-2025-03477 CVE-2025-3932 · GHSA-jfxg-6gv4-f2gh

LOW 29

It was possible to craft an email that showed a tracking link as an attachment.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00388 Published 2025-05-14 Partial fix · 128.10.1, 138.0.1 CWE-288