Critical Security Update for Thunderbird: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:12188: Important: thunderbird security update. Affects thunderbird versions < 128.13.0-3.el10_0.alma.1. Fixed in 128.13.0-3.el10_0.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Thunderbird is a standalone mail and newsgroup client that allows users to manage their email and news feeds efficiently. It is known for its robust features, including advanced search capabilities, customizable interface, and strong privacy controls. However, recent vulnerabilities have been identified that could compromise user security and data integrity.
Vulnerability Detail
The vulnerabilities in Thunderbird stem from various issues, including memory safety bugs, incorrect URL handling, and potential user-assisted code execution. These vulnerabilities could allow attackers to execute arbitrary code, leading to unauthorized access to user data or system compromise. Specific vulnerabilities include CVE-2025-8028, which involves a large branch table leading to truncated instructions, and CVE-2025-8035, which pertains to memory safety issues that could be exploited by malicious actors.
How To Fix
Minimum fixed version
128.13.0-3.el10_0.alma.1
This is the first release that contains the fix.
sudo dnf update thunderbirdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable JavaScript in Thunderbird to mitigate the risk of certain vulnerabilities. However, this may affect the functionality of some features. To disable JavaScript, navigate to the settings and adjust the preferences accordingly.
Conclusion
The identified vulnerabilities in Thunderbird pose significant risks to user security. It is crucial for users to update to the latest patched version to mitigate these risks. Additionally, temporary workarounds can be employed until the update is applied.
See every vulnerability recorded for thunderbird →
FAQ
The main vulnerabilities include memory safety bugs, incorrect URL handling, and potential code execution risks, as detailed in CVEs such as CVE-2025-8028 and CVE-2025-8035.
You can check your version of Thunderbird by navigating to the 'Help' menu and selecting 'About Thunderbird'. Compare your version with the patched version 128.13.0-3.el10_0.alma.1.
If you cannot update immediately, consider disabling JavaScript as a temporary workaround to reduce the risk of exploitation.
For more details, refer to the CVE pages associated with the vulnerabilities, which provide in-depth information about the impact and technical aspects.
Vulert allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check your application for vulnerabilities in real-time using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for thunderbird.
