RHSA-2025:8507HighCVSS 7.5

Red Hat Security Advisory: thunderbird security update

Published
June 4, 2025
Last Modified
August 6, 2026

🔗 CVE IDs covered (4)

CVE-2025-3875 →CVE-2025-3877 · pendingCVE-2025-3909 →CVE-2025-3932 →

📋 Description

CVE-2025-3875 — thunderbird: Sender Spoofing via Malformed From Header in Thunderbird CVE-2025-3877 — thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links CVE-2025-3909 — thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link CVE-2025-3932 — thunderbird: Tracking Links in Attachments Bypassed Remote Content Blocking

🎯 Affected products5

  • Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • thunderbird-0:128.10.1-1.el8_4.src as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • thunderbird-0:128.10.1-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • thunderbird-debuginfo-0:128.10.1-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • thunderbird-debugsource-0:128.10.1-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

🔗 References (7)