Description
The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If another user imported the address book, clicking on the link could result in opening a web page inside Thunderbird, and that page could execute (unprivileged) JavaScript. This vulnerability was fixed in Thunderbird 128.7 and Thunderbird 135.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mozilla | Thunderbird | — | 128.7 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | thunderbird | 1:128.7.0esr-1 | — |
| Debian 13 | thunderbird | 1:128.7.0esr-1 | — |
| Debian 12 | thunderbird | 1:128.7.0esr-1~deb12u1 | DSA-5861-1 |
| Debian 11 | thunderbird | 1:128.7.0esr-1~deb11u1 | DLA-4045-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | thunderbird | 1:128.12.0+build1-0ubuntu0.22.04.1 | USN-7663-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | thunderbird | 128.7.0-1.el9_5 | RHSA-2025:1184 |
| RHEL 8 | thunderbird | 128.7.0-1.el8_10 | RHSA-2025:1292 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | thunderbird | 128.7.0-1.el9_4 | RHSA-2025:1318 |
| RHEL 9.2 EUS | thunderbird | 128.7.0-1.el9_2 | RHSA-2025:1317 |
| RHEL 9.0 E4S | thunderbird | 128.7.0-1.el9_0 | RHSA-2025:1319 |
| RHEL 8.8 EUS | thunderbird | 128.7.0-1.el8_8 | RHSA-2025:1340 |
| RHEL 8.6 TUS | thunderbird | 128.7.0-1.el8_6 | RHSA-2025:1341 |
| RHEL 8.6 E4S | thunderbird | 128.7.0-1.el8_6 | RHSA-2025:1341 |
| RHEL 8.6 AUS | thunderbird | 128.7.0-1.el8_6 | RHSA-2025:1341 |
| RHEL 8.4 TUS | thunderbird | 128.7.0-1.el8_4 | RHSA-2025:1339 |
| RHEL 8.4 E4S | thunderbird | 128.7.0-1.el8_4 | RHSA-2025:1339 |
| RHEL 8.4 AUS | thunderbird | 128.7.0-1.el8_4 | RHSA-2025:1339 |
| RHEL 8.2 AUS | thunderbird | 128.7.0-1.el8_2 | RHSA-2025:1348 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | thunderbird | 128.7.0-1.el9_5.alma.1 | ALSA-2025:1184 |
| AlmaLinux 8 | thunderbird | 128.7.0-1.el8_10.alma.1 | ALSA-2025:1292 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | thunderbird | 128.7.0-1.el8_10 | RLSA-2025:1292 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | MozillaThunderbird | 128.7.0-150200.8.200.1 | SUSE-SU-2025:0405-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaThunderbird | 128.7.0-1.1 | openSUSE-SU-2025:14731-1 |
| openSUSE Leap 15.6 | MozillaThunderbird | 128.7.0-150200.8.200.1 | SUSE-SU-2025:0405-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | thunderbird | 128.7.0-1.amzn2.0.2 | ALAS2-2025-2789 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | thunderbird | 128.7.0-1.0.1.el9_5 | ELSA-2025-1184 |
| Oracle Linux 8 | thunderbird | 128.7.0-1.0.1.el8_10 | ELSA-2025-1292 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
r3m0t3nu11/CVE-2025-1015 ★ 3 · Feb 6, 2025
an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If another user imported the address bo…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 22
- ALSA-2025:1184 Important: thunderbird security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:1292 Important: thunderbird security update AlmaLinux Security Advisories · Oct 29, 2026
- USN-7663-1 thunderbird vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- RHSA-2025:1341 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Apr 14, 2026
- RHSA-2025:1348 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Apr 14, 2026
- RHSA-2025:1339 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Apr 14, 2026
- RHSA-2025:1340 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Apr 14, 2026
- RHSA-2025:1319 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Apr 14, 2026
- RHSA-2025:1317 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Apr 14, 2026
- RHSA-2025:1318 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Apr 14, 2026
- RHSA-2025:1292 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Apr 14, 2026
- RHSA-2025:1184 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Apr 14, 2026
- DSA-5861-1 thunderbird - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4045-1 thunderbird - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2025:1292 Important: thunderbird security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2025:0405-1 Security update for MozillaThunderbird SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14731-1 MozillaThunderbird-128.7.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0262 Mozilla Firefox und Thunderbird: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 2, 2026
- ALAS2-2025-2789 Important: thunderbird security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 7, 2025
- ELSA-2025-1292 Important: thunderbird security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 11, 2025
- ELSA-2025-1184 Important: thunderbird security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Feb 10, 2025
- NCSC-2025-0040 Kwetsbaarheden verholpen in Mozilla Firefox en Thunderbird NCSC-NL (Netherlands) · Feb 7, 2025