Skip to content
OpenAdvisories
High ALSA-2025:8196 4 CVEs

Important: thunderbird security update

Published May 27, 2025 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link (CVE-2025-3909)
* thunderbird: Sender Spoofing via Malformed From Header in Thunderbird (CVE-2025-3875)
* thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (CVE-2025-3877)
* thunderbird: Tracking Links in Attachments Bypassed Remote Content Blocking (CVE-2025-3932)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
AlmaLinux · 10 thunderbird 128.10.1-1.el10_0.alma.1

Vulnerabilities 4

  • High 8.1
    CVE-2025-3909

    JavaScript Execution via Spoofed PDF Attachment and file:/// Link

    Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment (message/rfc822) and setting its content type to application/pdf, Thunderbird may inco…

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  • High 7.5
    CVE-2025-3875

    Sender Spoofing via Malformed From Header in Thunderbird

    Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats spoofed@example.com as the actua…

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  • Medium 6.5
    CVE-2025-3932

    Tracking Links in Attachments Bypassed Remote Content Blocking

    It was possible to craft an email that showed a tracking link as an attachment. If the user attempted to open the attachment, Thunderbird automatically accessed the link. The configuration to block remote content did not prevent that. Thunderbird has been fix…

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  • Unscored —
    CVE-2025-3877 Rejected

    This CVE was marked as fixed, but due to other code landing - was not actually fixed. It was subsequently fixed in CVE-…

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-3875
  • report
    https://access.redhat.com/security/cve/CVE-2025-3877
  • report
    https://access.redhat.com/security/cve/CVE-2025-3909
  • report
    https://access.redhat.com/security/cve/CVE-2025-3932
  • report
    https://bugzilla.redhat.com/2366283
  • report
    https://bugzilla.redhat.com/2366287
  • report
    https://bugzilla.redhat.com/2366291
  • report
    https://bugzilla.redhat.com/2366297
  • advisory
    https://errata.almalinux.org/10/ALSA-2025-8196.html