Skip to content
OpenAdvisories
Medium RHSA-2025:4665 3 CVEs

Red Hat Security Advisory: thunderbird security update

Published May 8, 2025 · Updated Jun 28, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream thunderbird 0:128.9.2-1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream thunderbird-debuginfo 0:128.9.2-1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream thunderbird-debugsource 0:128.9.2-1.el8_6
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream thunderbird 0:128.9.2-1.el8_6
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream thunderbird-debuginfo 0:128.9.2-1.el8_6
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream thunderbird-debugsource 0:128.9.2-1.el8_6
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream thunderbird 0:128.9.2-1.el8_6
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream thunderbird-debuginfo 0:128.9.2-1.el8_6
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream thunderbird-debugsource 0:128.9.2-1.el8_6

Vulnerabilities 3

  • Medium 6.4
    CVE-2025-3523

    User Interface (UI) Misrepresentation of attachment URL

    When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick …

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  • Medium 6.3
    CVE-2025-2830

    Information Disclosure of /tmp directory listing

    By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disc…

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  • Medium 6.3
    CVE-2025-3522

    Leak of hashed Window credentials via crafted attachment URL

    Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine file size, and navigates to it when the user clicks the attac…

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2359786
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2359789
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2359793
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_4665.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-2830
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-2830
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-2830
  • article
    https://bugzilla.mozilla.org/show_bug.cgi?id=1956379
  • article
    https://www.mozilla.org/security/advisories/mfsa2025-26/
  • article
    https://www.mozilla.org/security/advisories/mfsa2025-27/
  • report
    https://access.redhat.com/security/cve/CVE-2025-3522
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-3522
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-3522
  • article
    https://bugzilla.mozilla.org/show_bug.cgi?id=1955372
  • report
    https://access.redhat.com/security/cve/CVE-2025-3523
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-3523
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-3523
  • article
    https://bugzilla.mozilla.org/show_bug.cgi?id=1958385