Summary
Mozilla heeft kwetsbaarheden verholpen in Firefox en Thunderbird (Specifiek voor versies onder 138 en 128.10).
Details
Interpretaties
De kwetsbaarheden omvatten privilege-escalatie door code-injectie, onveilige verwerking van WebGL-shaderattributen, onjuiste isolatie van processen, en lokale code-executie door inadequate sanitatie van speciale karakters. Deze kwetsbaarheden kunnen leiden tot gevoelige informatielekken, geheugenbeschadiging en de mogelijkheid voor aanvallers om schadelijke commando's uit te voeren buiten de sandbox van de browser.
Oplossingen
Mozilla heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 13
-
Critical 9.1
Process isolation bypass using "javascript:" URI links in cross-origin frames
A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape. This vulnerabil…
-
High 8.8
Privilege escalation in Thunderbird Updater
Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls,…
-
High 8.1
Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10
Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.…
-
High 8.1
Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10
Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 128.1…
-
High 7.1
Potential information leakage and privilege escalation in UITour actor
An attacker with control over a content process could potentially leverage the privileged UITour actor to leak sensitive information or escalate privileges. This vulnerability was fixed in Firefox 138 and Thunderbird 138.
-
Medium 6.5
Specially crafted filename could be used to obscure download type
A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. *This bug only affects Thunderbird for Android. Other versions of Thunderbird are unaffected.*. This…
-
Medium 6.5
Cross-site request forgery via storage access API redirects
A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any site that had invoked the Storage Access API. This enabled potential Cross-Site Request Forgery attacks across origins…
-
Medium 6.5
Memory safety bugs fixed in Firefox 138 and Thunderbird 138
Memory safety bugs present in Firefox 137 and Thunderbird 137. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefo…
-
Medium 5.9
WebGL shader attribute memory corruption in Thunderbird for macOS
Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to escalate privileges. *This bug only affects Thunderbird for macOS. Other versions of Thunderbird are unaffec…
-
Medium 5.7
Potential local code execution in "copy as cURL" command
Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. *This bug only affects Firefox for Windows. Other v…
-
Medium 5.3
Leaked library paths in Thunderbird for Android
A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat. This vulnerability was fixed in Firefox 138 and Thunderbird 138.
-
Medium 5.1
Potential local code execution in "copy as cURL" command
Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability was fixed in Firefox 138 and Thunder…
-
Medium 4.8
Unsafe attribute access during XPath parsing
A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This could lead to out-of-bounds read access and potentially, memory corruption. This vulnerability was fixe…
Revision history
-
#1.0.0
Initiele versie
References
-
Source - mozilla
https://www.mozilla.org/security/advisories/mfsa2025-28/
-
Source - mozilla
https://www.mozilla.org/security/advisories/mfsa2025-29/
-
Source - mozilla
https://www.mozilla.org/security/advisories/mfsa2025-30/
-
Source - mozilla
https://www.mozilla.org/security/advisories/mfsa2025-31/
-
Source - mozilla
https://www.mozilla.org/security/advisories/mfsa2025-32/