Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 10

• Critical 9.8
  CVE-2025-14321 Public exploit

  Use-after-free in the WebRTC: Signaling component

  Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025
• Critical 9.8
  CVE-2025-14324

  JIT miscompilation in the JavaScript Engine: JIT component

  JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025
• Critical 9.8
  CVE-2025-14330

  JIT miscompilation in the JavaScript Engine: JIT component

  JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025
• High 8.8
  CVE-2025-14323

  Privilege escalation in the DOM: Notifications component

  Privilege escalation in the DOM: Notifications component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025
• High 8.8
  CVE-2025-14328

  Privilege escalation in the Netmonitor component

  Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025
• High 8.8
  CVE-2025-14329

  Privilege escalation in the Netmonitor component

  Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025
• High 8.1
  CVE-2025-14333

  Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146

  Memory safety bugs present in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145 and Thunderbird 145. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary co…

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025
• High 8.0
  CVE-2025-14322

  Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component

  Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025
• High 7.3
  CVE-2025-14325 Public exploit

  JIT miscompilation in the JavaScript Engine: JIT component

  JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025
• Medium 6.5
  CVE-2025-14331

  Same-origin policy bypass in the Request Handling component

  Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2420502
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2420503
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2420504
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2420506
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2420508
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2420509
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2420512
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2420513
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2420516
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2420517
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0124.json
• report
  https://access.redhat.com/security/cve/CVE-2025-14321
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-14321
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-14321
• article
  https://www.mozilla.org/security/advisories/mfsa2025-94/#CVE-2025-14321
• article
  https://www.mozilla.org/security/advisories/mfsa2025-96/#CVE-2025-14321
• report
  https://access.redhat.com/security/cve/CVE-2025-14322
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-14322
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-14322
• article
  https://www.mozilla.org/security/advisories/mfsa2025-94/#CVE-2025-14322
• report
  https://access.redhat.com/security/cve/CVE-2025-14323
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-14323
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-14323
• article
  https://www.mozilla.org/security/advisories/mfsa2025-94/#CVE-2025-14323
• report
  https://access.redhat.com/security/cve/CVE-2025-14324
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-14324
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-14324
• article
  https://www.mozilla.org/security/advisories/mfsa2025-94/#CVE-2025-14324
• report
  https://access.redhat.com/security/cve/CVE-2025-14325
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-14325
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-14325
• article
  https://www.mozilla.org/security/advisories/mfsa2025-94/#CVE-2025-14325
• report
  https://access.redhat.com/security/cve/CVE-2025-14328
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-14328
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-14328
• article
  https://www.mozilla.org/security/advisories/mfsa2025-94/#CVE-2025-14328
• report
  https://access.redhat.com/security/cve/CVE-2025-14329
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-14329