Amazon Linux 2 : thunderbird (ALAS-2025-2873)

The version of thunderbird installed on the remote host is prior to 128.11.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2873 advisory. An attacker was able to perform an out-of-bounds read or write on a JavaScript Promise object. This vulnerability...

AlmaLinux 8 : thunderbird (ALSA-2025:8756)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2025:8756 advisory. thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link CVE-2025-3909 thunderbird: Sender Spoofing via Malformed From Header in...

Oracle Linux 8 : thunderbird (ELSA-2025-8756)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2025-8756 advisory. 128.11.0-1.0.1 - Fix prefs for new nss Orabug: 37079820 - Add Oracle prefs file 128.11.0 - Add OpenELA debranding 128.11.0-1 - Update to 128.11.0...

RHEL 8 : thunderbird (RHSA-2025:8756)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:8756 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: JavaScript Execution via Spoofed PDF Attachment...

RHEL 8 : thunderbird (RHSA-2025:8629)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:8629 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Out-of-bounds access when resolving...

RHEL 8 : thunderbird (RHSA-2025:8631)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:8631 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Out-of-bounds access when resolving...

RHEL 8 : thunderbird (RHSA-2025:8630)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:8630 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Out-of-bounds access when resolving...

RHEL 9 : thunderbird (RHSA-2025:8642)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:8642 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Out-of-bounds access when resolving...

Oracle Linux 9 : thunderbird (ELSA-2025-8607)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2025-8607 advisory. 128.11.0-1.0.1 - Fix prefs for new nss Orabug: 37079813 - Add Oracle prefs 128.11.0 - Add OpenELA debranding 128.11.0-1 - Update to 128.11.0 Tenable ha...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

RHEL 9 : thunderbird (RHSA-2025:8599)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:8599 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Out-of-bounds access when resolving...

RHEL 10 : thunderbird (RHSA-2025:7493)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:7493 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: URL Bar Spoofing via non-BMP Unicode...

RHEL 10 : thunderbird (RHSA-2025:8196)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:8196 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: JavaScript Execution via Spoofed PDF Attachment...

RHEL 8 : thunderbird (RHSA-2025:8594)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:8594 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: JavaScript Execution via Spoofed PDF Attachment...

RHEL 8 : thunderbird (RHSA-2025:8391)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:8391 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: JavaScript Execution via Spoofed PDF Attachment...

Amazon Linux 2023 : firefox (ALAS2023-2025-976)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-976 advisory. An issue in sqlite v.3.49.0 allows an attacker to cause a denial of service via the SQLITEDBCONFIGLOOKASIDE component CVE-2025-29088 A process isolation vulnerability in Firefox stemmed from...

Fedora 41 : thunderbird (2025-5bf1989d48)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-5bf1989d48 advisory. Update to 128.11.0 https://www.thunderbird.net/en-US/thunderbird/128.11.0esr/releasenotes/...

RHEL 9 : thunderbird (RHSA-2025:8324)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:8324 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: JavaScript Execution via Spoofed PDF Attachment...

Important: thunderbird

Issue Overview: Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an invalid value "Spoofed Name ", Thunderbird treats [email protected] as the actual address. This...

Amazon Linux 2 : thunderbird, --advisory ALAS2-2025-2858 (ALAS-2025-2858)

The version of thunderbird installed on the remote host is prior to 128.10.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2858 advisory. Through a series of popup and window.print calls, an attacker can cause a window to go fullscreen without the user...