Critical Memory Safety Vulnerabilities in Thunderbird - Update Required
Summary
ALSA-2025:2899: Important: thunderbird security update. Affects thunderbird versions < 128.8.0-2.el9_5.alma.1. Fixed in 128.8.0-2.el9_5.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Thunderbird is a standalone mail and newsgroup client that allows users to manage their email accounts efficiently. It offers features such as advanced message filtering, a customizable interface, and support for various email protocols. However, recent vulnerabilities have been identified that compromise the memory safety of the application, potentially exposing users to security risks.
Vulnerability Detail
The vulnerabilities identified in Thunderbird are related to memory safety bugs that could allow an attacker to execute arbitrary code or crash the application. These issues stem from flaws in the memory management of the software, which can be exploited if a user interacts with malicious content. The vulnerabilities are tracked under CVE-2025-1937 and CVE-2025-1938, both of which have been addressed in the latest security updates.
How To Fix
Minimum fixed version
128.8.0-2.el9_5.alma.1
This is the first release that contains the fix.
sudo dnf update thunderbirdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid opening untrusted emails or attachments until the update is applied. This reduces the risk of exploitation through the identified vulnerabilities.
Conclusion
In summary, Mozilla Thunderbird has critical memory safety vulnerabilities that require immediate attention. Users are advised to update to the latest version to protect against potential exploits. Additionally, Vulert offers a convenient way to monitor for such vulnerabilities in your applications.
See every vulnerability recorded for thunderbird →
FAQ
The vulnerabilities are memory safety bugs that could allow attackers to execute arbitrary code or crash the application, identified as CVE-2025-1937 and CVE-2025-1938.
You can check your version of Thunderbird by going to the 'Help' menu and selecting 'About Thunderbird'. Compare it with the patched version 128.8.0-2.el9_5.alma.1.
If you cannot update immediately, avoid opening suspicious emails or attachments to minimize the risk of exploitation.
More information can be found on the CVE pages for CVE-2025-1937 and CVE-2025-1938, which detail the vulnerabilities and their impacts.
Vulert monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json, providing real-time alerts without requiring code access or installation.
Related vulnerabilities
Recent vulnerabilities recorded for thunderbird.
