Critical Security Update for Thunderbird: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:13676: Important: thunderbird security update. Affects thunderbird versions < 128.13.0-3.el8_10.alma.1. Fixed in 128.13.0-3.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Thunderbird is a standalone mail and newsgroup client known for its robust features, including email management, customizable interface, and support for various protocols. However, it has recently been identified as vulnerable to several security issues that could compromise user data and system integrity.
Vulnerability Detail
The vulnerabilities in Thunderbird stem from various memory safety bugs and incorrect handling of URLs and JavaScript execution. These issues could allow attackers to execute arbitrary code, leading to potential data breaches or system compromises. Specifically, vulnerabilities such as CVE-2025-8028 and CVE-2025-8035 highlight the risks associated with improper memory management and execution flow, which could be exploited by malicious actors.
How To Fix
Minimum fixed version
128.13.0-3.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update thunderbirdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for these vulnerabilities. The best course of action is to apply the available security update as soon as possible.
Conclusion
The recent vulnerabilities in Thunderbird pose significant risks to users, highlighting the importance of timely updates and security awareness. By updating to the latest version, users can protect themselves from potential exploits and maintain the integrity of their communications.
See every vulnerability recorded for thunderbird →
FAQ
The main vulnerabilities include memory safety bugs, incorrect URL handling, and potential code execution issues, as detailed in CVEs like CVE-2025-8028 and CVE-2025-8035.
You can check your version of Thunderbird by navigating to 'Help' > 'About Thunderbird' in the application. Compare it with the patched version 128.13.0-3.el8_10.alma.1.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check your application for vulnerabilities using the Vulert playground without signup.
If you cannot update immediately, ensure that you avoid opening suspicious emails or links and consider using alternative email clients until the update can be applied.
For more details, refer to the CVE pages associated with the vulnerabilities, which provide in-depth information about the impact and technical aspects.
Related vulnerabilities
Recent vulnerabilities recorded for thunderbird.
