Skip to content
OpenAdvisories
High RHSA-2025:3036 4 CVEs

Red Hat Security Advisory: thunderbird security update

Published Mar 20, 2025 · Updated Jul 28, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream thunderbird 0:128.8.0-2.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream thunderbird-debuginfo 0:128.8.0-2.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream thunderbird-debugsource 0:128.8.0-2.el8_6
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream thunderbird 0:128.8.0-2.el8_6
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream thunderbird-debuginfo 0:128.8.0-2.el8_6
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream thunderbird-debugsource 0:128.8.0-2.el8_6
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream thunderbird 0:128.8.0-2.el8_6
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream thunderbird-debuginfo 0:128.8.0-2.el8_6
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream thunderbird-debugsource 0:128.8.0-2.el8_6

Vulnerabilities 4

  • High 7.5
    CVE-2025-1937

    Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8

    Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to…

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • High 7.0
    CVE-2025-26696

    Crafted email message incorrectly shown as being encrypted

    Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8.

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  • Medium 6.5
    CVE-2025-1938

    Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8

    Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.…

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • Medium 5.3
    CVE-2025-26695

    Downloading of OpenPGP keys from WKD used incorrect padding

    When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested email address. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8.

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2349793
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2349795
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3036.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-1937
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-1937
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-1937
  • article
    https://bugzilla.mozilla.org/buglist.cgi?bug_id=1938471%2C1940716
  • article
    https://www.mozilla.org/security/advisories/mfsa2025-14/
  • article
    https://www.mozilla.org/security/advisories/mfsa2025-15/
  • article
    https://www.mozilla.org/security/advisories/mfsa2025-16/
  • report
    https://access.redhat.com/security/cve/CVE-2025-1938
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-1938
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-1938
  • article
    https://bugzilla.mozilla.org/buglist.cgi?bug_id=1922889%2C1935004%2C1943586%2C1943912%2C1948111
  • report
    https://access.redhat.com/security/cve/CVE-2025-26695
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2351146
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-26695
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-26695
  • article
    https://bugzilla.mozilla.org/show_bug.cgi?id=1883039
  • article
    https://www.mozilla.org/security/advisories/mfsa2025-17/
  • article
    https://www.mozilla.org/security/advisories/mfsa2025-18/
  • report
    https://access.redhat.com/security/cve/CVE-2025-26696
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2351157
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-26696
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-26696
  • article
    https://bugzilla.mozilla.org/show_bug.cgi?id=1864205