RHSA-2025:8391HighCVSS 7.5

Red Hat Security Advisory: thunderbird security update

Published
June 2, 2025
Last Modified
August 6, 2026

🔗 CVE IDs covered (4)

CVE-2025-3877 · pendingCVE-2025-3909 →CVE-2025-3932 →CVE-2025-3875 →

📋 Description

CVE-2025-3875 — thunderbird: Sender Spoofing via Malformed From Header in Thunderbird CVE-2025-3877 — thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links CVE-2025-3909 — thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link CVE-2025-3932 — thunderbird: Tracking Links in Attachments Bypassed Remote Content Blocking

🎯 Affected products5

  • Red Hat Enterprise Linux AppStream AUS (v. 8.2)
  • thunderbird-0:128.10.1-1.el8_2.src as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)
  • thunderbird-0:128.10.1-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)
  • thunderbird-debuginfo-0:128.10.1-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)
  • thunderbird-debugsource-0:128.10.1-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

🔗 References (7)