Critical Security Update for Thunderbird: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:14844: Important: thunderbird security update. Affects thunderbird versions < 128.14.0-3.el10_0.alma.1. Fixed in 128.14.0-3.el10_0.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Mozilla Thunderbird is a widely used standalone mail and newsgroup client that allows users to manage their emails efficiently. It is known for its robust features, including customizable email organization, advanced search capabilities, and support for various email protocols. However, recent vulnerabilities have been identified that could compromise user security and data integrity.
Vulnerability Detail
The vulnerabilities in Thunderbird stem from multiple components, including Graphics, Audio/Video, and the JavaScript Engine. These issues can lead to denial-of-service attacks, sandbox escapes, and memory safety problems. Specifically, CVE-2025-9182 can cause out-of-memory errors, while CVE-2025-9179 allows for potential sandbox escapes. Additionally, CVE-2025-9180 presents a risk of same-origin policy bypass, and CVE-2025-9181 involves uninitialized memory access. These vulnerabilities could allow attackers to execute arbitrary code or crash the application, posing significant risks to user data and privacy.
How To Fix
Minimum fixed version
128.14.0-3.el10_0.alma.1
This is the first release that contains the fix.
sudo dnf update thunderbirdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to limit the use of Thunderbird for sensitive operations until the update is applied. Additionally, disabling certain features such as WebRender and GMP components may reduce exposure to the vulnerabilities until a full update can be performed.
Conclusion
In summary, the recent vulnerabilities in Thunderbird pose significant risks to user security. It is crucial for users to update to the latest patched version to mitigate these risks. By staying informed and utilizing tools like Vulert, users can better protect their applications from potential threats.
See every vulnerability recorded for thunderbird →
FAQ
The main vulnerabilities include denial-of-service due to out-of-memory errors, sandbox escape risks, same-origin policy bypass, and uninitialized memory access.
You can check your version of Thunderbird by navigating to the 'Help' menu and selecting 'About Thunderbird'. Compare your version with the patched version 128.14.0-3.el10_0.alma.1.
If you cannot update immediately, consider limiting the use of Thunderbird for sensitive communications and disabling certain features to reduce risk.
More information can be found on the CVE pages for each vulnerability, which provide detailed descriptions and potential impacts.
Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in your software, ensuring you stay informed about potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for thunderbird.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
