Skip to content
OpenAdvisories
High ELSA-2025-7435 3 CVEs

Important: thunderbird security update (Oracle Linux 9)

Published May 22, 2025 · Updated May 22, 2025

Ecosystem: Oracle Linux

Summary

[128.10.0-1.0.1]
- Fix prefs for new nss [Orabug: 37079813]
- Add Oracle prefs

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 9 thunderbird 0:128.10.0-1.0.1.el9_6

Vulnerabilities 3

  • Medium 6.4
    CVE-2025-3523

    User Interface (UI) Misrepresentation of attachment URL

    When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick …

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  • Medium 6.3
    CVE-2025-2830

    Information Disclosure of /tmp directory listing

    By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disc…

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  • Medium 6.3
    CVE-2025-3522

    Leak of hashed Window credentials via crafted attachment URL

    Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine file size, and navigates to it when the user clicks the attac…

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu