Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 9

• High 8.8
  CVE-2025-13014

  Use-after-free in the Audio/Video component

  Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird 140.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Nov 11, 2025
• High 8.8
  CVE-2025-13020

  Use-after-free in the WebRTC: Audio/Video component

  Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Nov 11, 2025
• High 8.1
  CVE-2025-13017

  Same-origin policy bypass in the DOM: Notifications component

  Same-origin policy bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Nov 11, 2025
• High 8.1
  CVE-2025-13018

  Mitigation bypass in the DOM: Security component

  Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Nov 11, 2025
• High 8.1
  CVE-2025-13019

  Same-origin policy bypass in the DOM: Workers component

  Same-origin policy bypass in the DOM: Workers component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Nov 11, 2025
• High 7.5
  CVE-2025-13012

  Race condition in the Graphics component

  Race condition in the Graphics component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird 140.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Nov 11, 2025
• High 7.5
  CVE-2025-13016

  Incorrect boundary conditions in the JavaScript: WebAssembly component

  Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Nov 11, 2025
• Medium 6.1
  CVE-2025-13013

  Mitigation bypass in the DOM: Core & HTML component

  Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird 140.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Nov 11, 2025
• Low 3.4
  CVE-2025-13015

  Spoofing issue in Firefox

  Spoofing issue in Firefox. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, and Firefox ESR 115.30.

  Mozilla Firefox thunderbird mozjs38 Browsers Debian Ubuntu Wolfi
  Nov 11, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414079
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414080
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414083
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414084
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414085
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414086
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414090
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414091
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414092
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22450.json
• report
  https://access.redhat.com/security/cve/CVE-2025-13012
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-13012
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-13012
• article
  https://www.mozilla.org/security/advisories/mfsa2025-88/#CVE-2025-13012
• report
  https://access.redhat.com/security/cve/CVE-2025-13013
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-13013
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-13013
• article
  https://www.mozilla.org/security/advisories/mfsa2025-88/#CVE-2025-13013
• report
  https://access.redhat.com/security/cve/CVE-2025-13014
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-13014
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-13014
• article
  https://www.mozilla.org/security/advisories/mfsa2025-88/#CVE-2025-13014
• report
  https://access.redhat.com/security/cve/CVE-2025-13015
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-13015
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-13015
• article
  https://www.mozilla.org/security/advisories/mfsa2025-88/#CVE-2025-13015
• report
  https://access.redhat.com/security/cve/CVE-2025-13016
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-13016
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-13016
• article
  https://www.mozilla.org/security/advisories/mfsa2025-88/#CVE-2025-13016
• report
  https://access.redhat.com/security/cve/CVE-2025-13017
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-13017
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-13017
• article
  https://www.mozilla.org/security/advisories/mfsa2025-88/#CVE-2025-13017
• report
  https://access.redhat.com/security/cve/CVE-2025-13018
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-13018
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-13018
• article
  https://www.mozilla.org/security/advisories/mfsa2025-88/#CVE-2025-13018