Skip to content
OpenAdvisories
High ALSA-2025:7435 3 CVEs

Important: thunderbird security update

Published May 13, 2025 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* thunderbird: User Interface (UI) Misrepresentation of attachment URL (CVE-2025-3523)
* thunderbird: Information Disclosure of /tmp directory listing (CVE-2025-2830)
* thunderbird: Leak of hashed Window credentials via crafted attachment URL (CVE-2025-3522)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
AlmaLinux · 9 thunderbird 128.10.0-1.el9_6.alma.1

Vulnerabilities 3

  • Medium 6.4
    CVE-2025-3523

    User Interface (UI) Misrepresentation of attachment URL

    When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick …

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  • Medium 6.3
    CVE-2025-2830

    Information Disclosure of /tmp directory listing

    By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disc…

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  • Medium 6.3
    CVE-2025-3522

    Leak of hashed Window credentials via crafted attachment URL

    Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine file size, and navigates to it when the user clicks the attac…

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-2830
  • report
    https://access.redhat.com/security/cve/CVE-2025-3522
  • report
    https://access.redhat.com/security/cve/CVE-2025-3523
  • report
    https://bugzilla.redhat.com/2359786
  • report
    https://bugzilla.redhat.com/2359789
  • report
    https://bugzilla.redhat.com/2359793
  • advisory
    https://errata.almalinux.org/9/ALSA-2025-7435.html