Skip to content
OpenAdvisories
High ALAS2-2025-2789 28 CVEs

Important: thunderbird security update (Amazon Linux 2)

Published Mar 1, 2025 · Updated Mar 7, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-1017: Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. CVE-2025-1016: Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. CVE-2025-1015: The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malicious payload in a field. For example, in the "Other" field of the Instant Messaging section. If another user imported the address book, clicking on the link could result in opening a web page inside Thunderbird, and that page could execute (unprivileged) JavaScript. This vulnerability affects Thunderbird < 128.7. CVE-2025-1014: Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. CVE-2025-1013: A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. CVE-2025-1012: A race during concurrent delazification could have led to a use-after-free. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. CVE-2025-1011: A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. CVE-2025-1010: An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. CVE-2025-1009: An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. CVE-2025-0510: Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040. This vulnerability affects Thunderbird < 128.7 and Thunderbird < 135. CVE-2025-0242: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Firefox ESR < 115.19, Thunderbird < 134, and Thunderbird ESR < 128.6. CVE-2024-9400: A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during JIT compilation. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131. CVE-2024-9399: A website configured to initiate a specially crafted WebTransport session could crash the Firefox process leading to a denial of service condition. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131. CVE-2024-9397: A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131. CVE-2024-9396: It is currently unknown if this issue is exploitable but a condition may arise where the structured clone of certain objects could lead to memory corruption. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131. CVE-2024-8900: An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events. This vulnerability affects Firefox < 129. CVE-2024-50336: matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver. Fixed in matrix-js-sdk 34.11.1. CVE-2024-11159: Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird < 128.4.3 and Thunderbird < 132.0.1. CVE-2024-10467: Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132. CVE-2024-10466: By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive. This vulnerability af

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 thunderbird 0:128.7.0-1.amzn2.0.2
Amazon Linux · 2 thunderbird-debuginfo 0:128.7.0-1.amzn2.0.2

Vulnerabilities 28

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-10458.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-10459.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-10460.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-10461.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-10462.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-10463.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-10464.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-10465.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-10466.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-10467.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-11159.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-50336.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-8900.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-9396.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-9397.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-9399.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-9400.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-0242.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-0510.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-1009.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-1010.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-1011.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-1012.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-1013.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-1014.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-1015.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-1016.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-1017.html