Important: thunderbird

Issue Overview: Through a series of popup and window.print calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR 102.5, Thunderbird 102.5, and Firefo...

Amazon Linux 2 : thunderbird (ALAS-2025-2859)

The version of thunderbird installed on the remote host is prior to 128.10.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2859 advisory. Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From...

RHEL 9 : thunderbird (RHSA-2025:8326)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:8326 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: JavaScript Execution via Spoofed PDF Attachment...

CVE-2025-5268 Memory safety bugs fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11

Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in...

Mozilla Thunderbird < 128.11

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 128.11. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-46 advisory. - Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bug showed evidence of...

Mozilla Thunderbird < 139.0

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 139.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-45 advisory. - Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10...

Oracle Linux 9 : thunderbird (ELSA-2025-8203)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2025-8203 advisory. 128.10.1-1.0.1 - Fix prefs for new nss Orabug: 37079813 - Add Oracle prefs 128.10.1 - Add OpenELA debranding 128.10.1-1 - Update to 128.10.1 Tenable ha...

Mozilla Thunderbird < 139.0

The version of Thunderbird installed on the remote Windows host is prior to 139.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-45 advisory. - Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of...

Fedora 41 : thunderbird (2025-ee55907675)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-ee55907675 advisory. Update to 128.10.2 https://www.thunderbird.net/en-US/thunderbird/128.10.2esr/releasenotes/ ---- Update to 128.10.1...

Mozilla Thunderbird Security Update (mfsa_2025-41) - Windows

Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

Mozilla Thunderbird < 138.0.2

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 138.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-41 advisory. - An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing arr...

Mozilla Thunderbird < 138.0.2

The version of Thunderbird installed on the remote Windows host is prior to 138.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-41 advisory. - An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index...

Mozilla Thunderbird < 128.10.2

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 128.10.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-40 advisory. - An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing...

Mozilla Thunderbird < 128.10.2

The version of Thunderbird installed on the remote Windows host is prior to 128.10.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-40 advisory. - An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index...

AlmaLinux 9 : thunderbird (ALSA-2025:7435)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2025:7435 advisory. thunderbird: User Interface UI Misrepresentation of attachment URL CVE-2025-3523 thunderbird: Information Disclosure of /tmp directory listing CVE-2025-28...

KLA83808 Multiple vulnerabilities in Mozilla Thunderbird ESR

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to cause denial of service. Below is a complete list of vulnerabilities: 1. Out of bounds memory read or write vulnerability on a JavaScript Promise object can be exploited to cause denia...

Slackware Linux 15.0 / current mozilla-thunderbird Multiple Vulnerabilities (SSA:2025-136-01)

The version of mozilla-thunderbird installed on the remote host is prior to 128.10.1esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-136-01 advisory. New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues...

AlmaLinux 9 : firefox (ALSA-2025:4443)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:4443 advisory. firefox: thunderbird: Privilege escalation in Firefox Updater CVE-2025-2817 firefox: thunderbird: Unsafe attribute access during XPath parsing CVE-2025-40...

AlmaLinux 9 : thunderbird (ALSA-2025:4460)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2025:4460 advisory. firefox: thunderbird: Privilege escalation in Firefox Updater CVE-2025-2817 firefox: thunderbird: Unsafe attribute access during XPath parsing CVE-2025-40...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...