Skip to content
OpenAdvisories
High RHSA-2025:8784 4 CVEs

Red Hat Security Advisory: thunderbird security update

Published Jun 11, 2025 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream thunderbird 0:128.10.1-1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream thunderbird-debuginfo 0:128.10.1-1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream thunderbird-debugsource 0:128.10.1-1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream thunderbird 0:128.10.1-1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream thunderbird-debuginfo 0:128.10.1-1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream thunderbird-debugsource 0:128.10.1-1.el8_8

Vulnerabilities 4

  • High 8.1
    CVE-2025-3909

    JavaScript Execution via Spoofed PDF Attachment and file:/// Link

    Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment (message/rfc822) and setting its content type to application/pdf, Thunderbird may inco…

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  • High 7.5
    CVE-2025-3875

    Sender Spoofing via Malformed From Header in Thunderbird

    Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats spoofed@example.com as the actua…

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  • Medium 6.5
    CVE-2025-3932

    Tracking Links in Attachments Bypassed Remote Content Blocking

    It was possible to craft an email that showed a tracking link as an attachment. If the user attempted to open the attachment, Thunderbird automatically accessed the link. The configuration to block remote content did not prevent that. Thunderbird has been fix…

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  • Unscored —
    CVE-2025-3877 Rejected

    This CVE was marked as fixed, but due to other code landing - was not actually fixed. It was subsequently fixed in CVE-…

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2366283
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2366287
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2366291
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2366297
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8784.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-3875
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-3875
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-3875
  • article
    https://www.mozilla.org/en-US/security/advisories/mfsa2025-34/#CVE-2025-3875
  • report
    https://access.redhat.com/security/cve/CVE-2025-3877
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-3877
  • report
    https://access.redhat.com/security/cve/CVE-2025-3909
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-3909
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-3909
  • article
    https://www.mozilla.org/en-US/security/advisories/mfsa2025-34/#CVE-2025-3909
  • report
    https://access.redhat.com/security/cve/CVE-2025-3932
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-3932
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-3932
  • article
    https://www.mozilla.org/en-US/security/advisories/mfsa2025-34/#CVE-2025-3932