Debian dsa-5912 : thunderbird - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5912 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5912-1 [email protected] https://www.debian.org/securit...

Amazon Linux 2 : thunderbird (ALAS-2025-2836)

The version of thunderbird installed on the remote host is prior to 68.10.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2836 advisory. The Mozilla Foundation Security Advisory describes this flaw as: Due to confusion about ValueTags on JavaScript...

RHEL 8 : thunderbird (RHSA-2025:4389)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:4389 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: User Interface UI Misrepresentation of attachmen...

Amazon Linux 2 : thunderbird (ALAS-2025-2840)

The version of thunderbird installed on the remote host is prior to 128.9.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2840 advisory. JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after- free. This...

CVE-2025-4092 Memory safety bugs fixed in Firefox 138 and Thunderbird 138

Memory safety bugs present in Firefox 137 and Thunderbird 137. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 138 and Thunderbird 138...

CVE-2025-4091 Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10

Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firef...

CVE-2025-4091

CVE-2025-4091 involves memory-safety bugs in Mozilla Firefox and Thunderbird. The initial entry notes memory corruption evidence and indicates that attackers could potentially exploit some bugs to run arbitrary code, affecting Firefox < 138, Firefox ESR < 128.10, Thunderbird < 138, and T...

PT-2025-18161

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 138 Thunderbird versions prior to 138 Description Memory safety bugs are present in certain versions of Firefox and Thunderbird, showing evidence of memory corruption. It is presumed that with enough effort, some of...

KLA83542 Multiple vulnerabilities in Mozilla Thunderbird ESR

Multiple vulnerabilities were found in Mozilla Thunderbird ESR. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions, cause denial of service, gain privileges. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerabilit...

Slackware Linux 15.0 / current mozilla-thunderbird Multiple Vulnerabilities (SSA:2025-119-02)

The version of mozilla-thunderbird installed on the remote host is prior to 128.10.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-119-02 advisory. New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues...

KLA83540 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions, perform cross-site scripting attack, obtain sensitive information, gain privileges, cause denial of service. Below is a complete...

PT-2025-18154

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 138 Thunderbird versions prior to 138 Description An attacker with control over a content process could potentially leverage the privileged UITour actor to leak sensitive information or escalate privileges...

AlmaLinux 9 : thunderbird (ALSA-2025:4229)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2025:4229 advisory. thunderbird: User Interface UI Misrepresentation of attachment URL CVE-2025-3523 thunderbird: Information Disclosure of /tmp directory listing CVE-2025-28...

Fedora 40 : thunderbird (2025-fd8eb9ca57)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-fd8eb9ca57 advisory. Update to 128.9.2 https://www.thunderbird.net/en-US/thunderbird/128.9.1esr/releasenotes/...

AlmaLinux 9 : thunderbird (ALSA-2025:4169)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2025:4169 advisory. firefox: thunderbird: URL Bar Spoofing via non-BMP Unicode characters CVE-2025-3029 firefox: thunderbird: Use-after-free triggered by XSLTProcessor...

AlmaLinux 8 : thunderbird (ALSA-2025:4170)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2025:4170 advisory. firefox: thunderbird: URL Bar Spoofing via non-BMP Unicode characters CVE-2025-3029 firefox: thunderbird: Use-after-free triggered by XSLTProcessor...

Oracle Linux 9 : thunderbird (ELSA-2025-4169)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2025-4169 advisory. 128.9.0-2.0.1 - Fix prefs for new nss Orabug: 37079813 - Add Oracle prefs 128.9.0 - Add OpenELA debranding 128.9.0-2 - Update to 128.9.0 build3 128.9.0...

RHEL 8 : thunderbird (RHSA-2025:4170)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:4170 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: URL Bar Spoofing via non-BMP Unicode...

Oracle Linux 8 : thunderbird (ELSA-2025-4170)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2025-4170 advisory. 128.9.0-2.0.1 - Fix prefs for new nss Orabug: 37079820 - Add Oracle prefs file 128.9.0 - Add OpenELA debranding 128.9.0-2 - Update to 128.9.0 build3...

RHEL 8 : thunderbird (RHSA-2025:4031)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:4031 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: Use-after-free triggered by XSLTProcessor...