RHSA-2025:7507HighCVSS 8.8

Red Hat Security Advisory: thunderbird security update

Published
May 13, 2025
Last Modified
November 5, 2026

🔗 CVE IDs covered (8)

CVE-2025-3522 →CVE-2025-3523 →CVE-2025-4083 →CVE-2025-4087 →CVE-2025-4091 →CVE-2025-4093 →CVE-2025-2817 →CVE-2025-2830 →

📋 Description

CVE-2025-2817 — firefox: thunderbird: Privilege escalation in Firefox Updater CVE-2025-2830 — thunderbird: Information Disclosure of /tmp directory listing CVE-2025-3522 — thunderbird: Leak of hashed Window credentials via crafted attachment URL CVE-2025-3523 — thunderbird: User Interface (UI) Misrepresentation of attachment URL CVE-2025-4083 — firefox: thunderbird: Process isolation bypass using "javascript:" URI links in cross-origin frames CVE-2025-4087 — firefox: thunderbird: Unsafe attribute access during XPath parsing CVE-2025-4091 — firefox: thunderbird: Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10 CVE-2025-4093 — firefox: thunderbird: Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10

🎯 Affected products14

  • Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-0:128.10.0-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-0:128.10.0-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-0:128.10.0-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-0:128.10.0-1.el10_0.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-0:128.10.0-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-debuginfo-0:128.10.0-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-debuginfo-0:128.10.0-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-debuginfo-0:128.10.0-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-debuginfo-0:128.10.0-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-debugsource-0:128.10.0-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-debugsource-0:128.10.0-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-debugsource-0:128.10.0-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • thunderbird-debugsource-0:128.10.0-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

🔗 References (11)