Mozilla Thunderbird Security Update (mfsa_2025-04) - Mac OS X

Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

Mozilla Thunderbird ESR Security Update (mfsa_2025-05) - Windows

Mozilla Thunderbird ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Mozilla Thunderbird ESR Security Update (mfsa_2025-05) - Mac OS X

Mozilla Thunderbird ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird...

CVE-2025-23720

Cross-Site Request Forgery CSRF vulnerability in Marco Castelluccio Web Push web-push allows Stored XSS.This issue affects Web Push: from n/a through = 1.4.0...

CVE-2025-23720

CVE-2025-23720 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Web Push (web-push) plugin by Marco Castelluccio that can lead to stored XSS. The provided sources confirm the issue arises in Web Push and can result in stored XSS, affecting versions up to and including ...

MozillaThunderbird-128.6.0-1.1 on GA media (moderate)

MozillaThunderbird-128.6.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:14648-1 Rating: moderate Cross-References: CVE-2025-0237 CVE-2025-0238 CVE-2025-0239 CVE-2025-0240 CVE-2025-0241 CVE-2025-0242 CVE-2025-0243 CVSS scores: CVE-2025-0237 SUSE : 5.4...

PT-2025-5048 · Mozilla · Web-Push

Name of the Vulnerable Software and Affected Versions: Mozilla Web Push versions n/a through 1.4.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability in Mozilla Web Push, which allows Stored XSS. Recommendations: For Mozilla Web Push versions n/a through 1.4.0,...

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird, related to improper storage of permissions, allows attackers to carry out clickjacking attacks.

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to improper storage of permissions. Exploiting this vulnerability can allow a remote attacker to carry out a clickjacking attack...

Vulnerabilities fixed in Mozilla Firefox and Thunderbird

Mozilla has fixed vulnerabilities in Firefox and Thunderbird Specifically for versions below 134 and 128.6. The vulnerabilities include client-side path traversal, privilege escalation and use-after-free conditions. These vulnerabilities can be exploited by malicious parties to gain unauthorized...

ROS-20250115-01

A vulnerability in Mozilla Firefox, Firefox ESR, and Thunderbird email client is related to improper permission persistence. exploitation of the vulnerability could allow a remote attacker to affect the confidentiality of protected information, to affect the confidentiality of protected informati...

OPENSUSE-SU-2025:14648-1 MozillaThunderbird-128.6.0-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-128.6.0-1.1 package on the GA media of openSUSE Tumbleweed...

ROS-20250115-02

A vulnerability in Mozilla Firefox, Firefox ESR, and Thunderbird email client is related to improper permission persistence. exploitation of the vulnerability could allow a remote attacker to affect the confidentiality of protected information, to affect the confidentiality of protected informati...

[SECURITY] Fedora 40 Update: thunderbird-128.6.0-1.fc40

Mozilla Thunderbird is a standalone mail and newsgroup client...

RHEL 8 : thunderbird (RHSA-2025:0284)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:0284 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Memory safety bugs fixed in Firefox 134...

RHEL 8 : thunderbird (RHSA-2025:0281)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:0281 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Memory safety bugs fixed in Firefox 134...

ROS-20250114-09

Vulnerability in the animation control and synchronization handler on web pages of Mozilla Firefox browsers, Firefox ESR is related to the possibility of memory usage after its release. Exploitation of the vulnerability could allow a remote attacker to execute arbitrary code by injecting it into...

openSUSE Security Advisory (SUSE-SU-2025:0080-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ROS-20250114-04

The incognito mode vulnerability in Mozilla Firefox, Firefox ESR browsers is due to the application not properly impose security restrictions. Exploitation of the vulnerability could allow an attacker acting remotely to bypass the implemented security restrictions Incognito mode vulnerability in...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : MozillaThunderbird (SUSE-SU-2025:0080-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0080-1 advisory. Update to Mozilla Thunderbird ESR 128.6 MFSA 2025-05, bsc1234991 Security fixes: - CVE-2025-0237...

ROS-20250114-10

Vulnerability in the animation control and synchronization handler on web pages of Mozilla Firefox browsers, Firefox ESR is related to the possibility of memory usage after its release. Exploitation of the vulnerability could allow a remote attacker to execute arbitrary code by injecting it into...