CVE-2025-6436 Memory safety bugs fixed in Firefox 140 and Thunderbird 140

Memory safety bugs present in Firefox 139 and Thunderbird 139. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 140 and Thunderbird 140...

CVE-2025-6436

Memory safety bugs present in Firefox 139 and Thunderbird 139. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 140 and Thunderbird 140...

CVE-2025-6436 Memory safety bugs fixed in Firefox 140 and Thunderbird 140

Memory safety bugs present in Firefox 139 and Thunderbird 139. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 140 and Thunderbird 140...

CVE-2025-6436

CVE-2025-6436 relates to memory safety bugs in Firefox 139 and Thunderbird 139 that could allow memory corruption and potentially run arbitrary code. Affected products are Firefox and Thunderbird versions before 140. The Mozilla advisories MFSA2025-54 and MFSA2025-51 describe the nature of the is...

Mozilla -- persistent UUID that identifies browser

[email protected] reports: An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability affects Firefox 140, Firefox E...

Important: thunderbird

Issue Overview: A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data e.g. using /dev/urando...

Fedora 41 : thunderbird (2025-883496c803)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-883496c803 advisory. Update to 128.11.1 https://www.mozilla.org/en-US/security/advisories/mfsa2025-49/ Tenable has extracted the preceding description block directly from the...

TencentOS Server 4: firefox (TSSA-2024:1058)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:1058 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

Fedora 42 : thunderbird (2025-1ac9269cc4)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-1ac9269cc4 advisory. Update to 128.11.1 https://www.mozilla.org/en-US/security/advisories/mfsa2025-49/ Tenable has extracted the preceding description block directly from the...

DEBIAN-CVE-2025-5986

A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data e.g. using /dev/urandom on Linux or to...

CVE-2025-5986

CVE-2025-5986 affects Thunderbird. A crafted HTML email that uses mailbox:/// links can trigger automatic, unsolicited downloads of PDF files to the user’s desktop or home directory without prompting, even if auto-saving is disabled. This can lead to disk-space exhaustion and potential credential...

CVE-2025-5986

A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data e.g. using /dev/urandom on Linux or to...

The vulnerability of the Update Handler component in Mozilla Firefox, Mozilla Firefox ESR, and the Mozilla Thunderbird email client allows a hacker to escalate their privileges.

The vulnerability of the Update Handler component in Mozilla Firefox, Mozilla Firefox ESR, and the email client Mozilla Thunderbird is related to access control deficiencies. Exploiting this vulnerability can allow an attacker to enhance their privileges remotely...

Mozilla Thunderbird < 139.0.2

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 139.0.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2025-50 advisory. - A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the...

Mozilla Thunderbird < 128.11.1

The version of Thunderbird installed on the remote Windows host is prior to 128.11.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2025-49 advisory. - A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's...

Mozilla Thunderbird < 139.0.2

The version of Thunderbird installed on the remote Windows host is prior to 139.0.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2025-50 advisory. - A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's...

The vulnerability of the Thunderbird email client, related to incorrect restrictions on the path to the restricted catalog, allows attackers to disclose protected information.

The vulnerability of the Thunderbird email client is related to incorrect restrictions on the path to the restricted catalog. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose protected information...

CVE-2025-5272

Memory safety bugs present in Firefox 138 and Thunderbird 138. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 139 and Thunderbird 139...

CVE-2025-5268

Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in...

CVE-2025-5269

Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 128.11 and Thunderbird 128.11...