Description
Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mozilla | Thunderbird | — | 128.8 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | thunderbird | 1:128.8.0esr-1 | — |
| Debian 13 | thunderbird | 1:128.8.0esr-1 | — |
| Debian 12 | thunderbird | 1:128.8.0esr-1~deb12u1 | DSA-5876-1 |
| Debian 11 | thunderbird | 1:128.8.0esr-1~deb11u1 | DLA-4081-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | thunderbird | 1:128.12.0+build1-0ubuntu0.22.04.1 | USN-7663-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | thunderbird | 128.8.0-2.el9_5 | RHSA-2025:2899 |
| RHEL 8 | thunderbird | 128.8.0-2.el8_10 | RHSA-2025:2900 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | thunderbird | 128.8.0-2.el9_4 | RHSA-2025:2957 |
| RHEL 9.2 EUS | thunderbird | 128.8.0-2.el9_2 | RHSA-2025:2959 |
| RHEL 9.0 E4S | thunderbird | 128.8.0-2.el9_0 | RHSA-2025:3013 |
| RHEL 8.8 EUS | thunderbird | 128.8.0-2.el8_8 | RHSA-2025:2958 |
| RHEL 8.6 TUS | thunderbird | 128.8.0-2.el8_6 | RHSA-2025:3036 |
| RHEL 8.6 E4S | thunderbird | 128.8.0-2.el8_6 | RHSA-2025:3036 |
| RHEL 8.6 AUS | thunderbird | 128.8.0-2.el8_6 | RHSA-2025:3036 |
| RHEL 8.4 TUS | thunderbird | 128.8.0-2.el8_4 | RHSA-2025:3009 |
| RHEL 8.4 E4S | thunderbird | 128.8.0-2.el8_4 | RHSA-2025:3009 |
| RHEL 8.4 AUS | thunderbird | 128.8.0-2.el8_4 | RHSA-2025:3009 |
| RHEL 8.2 AUS | thunderbird | 128.8.0-2.el8_2 | RHSA-2025:2960 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | thunderbird | 128.8.0-2.el8_10.alma.1 | ALSA-2025:2900 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | MozillaThunderbird | 128.8.0-150200.8.203.1 | SUSE-SU-2025:0849-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | MozillaThunderbird | 128.8.0-150200.8.203.1 | SUSE-SU-2025:0849-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | thunderbird | 128.8.1-1.amzn2.0.1 | ALAS2-2025-2807 |
Advisories 16
- ALSA-2025:2900 Important: thunderbird security update AlmaLinux Security Advisories · Nov 6, 2026
- RHSA-2025:2959 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jul 28, 2026
- RHSA-2025:3009 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jul 28, 2026
- RHSA-2025:2899 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jul 28, 2026
- RHSA-2025:3036 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jul 28, 2026
- RHSA-2025:2900 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jul 28, 2026
- RHSA-2025:3013 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jul 28, 2026
- RHSA-2025:2957 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jul 28, 2026
- RHSA-2025:2958 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jul 28, 2026
- RHSA-2025:2960 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jul 28, 2026
- USN-7663-1 thunderbird vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-5876-1 thunderbird - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4081-1 thunderbird - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2025:0849-1 Security update for MozillaThunderbird SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0482 Mozilla Firefox, Mozilla Firefox ESR und Mozilla Thunderbird: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 2, 2026
- ALAS2-2025-2807 Important: thunderbird security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 1, 2025