Critical Security Update for Thunderbird: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:4649: Important: thunderbird security update. Affects thunderbird versions < 128.9.2-1.el8_10.alma.1. Fixed in 128.9.2-1.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Thunderbird is a standalone mail and newsgroup client that allows users to manage their email communications efficiently. It is known for its robust features, including customizable email organization, advanced search capabilities, and support for various email protocols. However, recent vulnerabilities have been identified that could compromise user security and privacy, necessitating immediate attention and remediation.
Vulnerability Detail
The identified vulnerabilities in Thunderbird include a User Interface (UI) misrepresentation of attachment URLs (CVE-2025-3523), which could mislead users about the safety of attachments. Additionally, there is an Information Disclosure vulnerability (CVE-2025-2830) that exposes the contents of the /tmp directory, potentially revealing sensitive information. Another critical issue is the leak of hashed Window credentials via crafted attachment URLs (CVE-2025-3522), which could allow attackers to gain unauthorized access to user credentials. These vulnerabilities could lead to significant security breaches if not addressed promptly.
How To Fix
Minimum fixed version
128.9.2-1.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update thunderbirdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to avoid opening attachments from unknown or untrusted sources until the update has been applied. Additionally, users can manually check the integrity of attachments before opening them.
Conclusion
The identified vulnerabilities in Thunderbird pose significant risks to user security and privacy. It is crucial for users to update to the latest patched version to mitigate these risks. By following the outlined steps and utilizing resources like Vulert, users can enhance their security posture against potential threats.
See every vulnerability recorded for thunderbird →
FAQ
The vulnerabilities include UI misrepresentation of attachment URLs, information disclosure of /tmp directory listings, and leakage of hashed Window credentials.
You can check your version of Thunderbird by navigating to the 'Help' menu and selecting 'About Thunderbird'. Compare your version with the patched version 128.9.2-1.el8_10.alma.1.
If an immediate update is not possible, refrain from opening attachments from unknown sources and consider using alternative email clients until the update can be applied.
More detailed information can be found on the CVE pages for CVE-2025-2830, CVE-2025-3522, and CVE-2025-3523.
Vulert allows you to monitor and alert in real-time for open-source vulnerabilities using just a manifest file like package-lock.json. You can check if your application is affected by visiting the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for thunderbird.
