Critical Security Update for Thunderbird: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:4229: Important: thunderbird security update. Affects thunderbird versions < 128.9.2-1.el9_5.alma.1. Fixed in 128.9.2-1.el9_5.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Thunderbird is a widely-used standalone mail and newsgroup client that allows users to manage their email communications efficiently. It offers features such as customizable email organization, advanced search capabilities, and support for various email protocols. However, recent vulnerabilities have been identified that could compromise user data and system security, necessitating immediate attention and remediation.
Vulnerability Detail
The vulnerabilities in Thunderbird include a User Interface (UI) misrepresentation of attachment URLs (CVE-2025-3523), which could mislead users about the nature of attachments. Additionally, there is an Information Disclosure vulnerability (CVE-2025-2830) that allows unauthorized access to the /tmp directory listing, potentially exposing sensitive files. Another critical issue is the leak of hashed Window credentials via crafted attachment URLs (CVE-2025-3522), which could enable attackers to gain unauthorized access to user accounts. These vulnerabilities stem from flaws in the way Thunderbird handles attachments and user credentials, posing significant risks to user privacy and security.
How To Fix
Minimum fixed version
128.9.2-1.el9_5.alma.1
This is the first release that contains the fix.
sudo dnf update thunderbirdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid opening attachments from unknown or untrusted sources until the update has been applied. Additionally, users should regularly check their email settings and be cautious of any suspicious emails that may contain crafted URLs.
Conclusion
In summary, the identified vulnerabilities in Thunderbird pose significant risks to user security and privacy. It is crucial for users to update to the latest patched version to mitigate these risks. By following the outlined steps and remaining vigilant, users can protect their information and maintain the integrity of their communications.
See every vulnerability recorded for thunderbird →
FAQ
These vulnerabilities can lead to unauthorized access to sensitive information, including user credentials and file listings, which could be exploited by attackers.
You can check your version of Thunderbird by navigating to 'Help' > 'About Thunderbird'. Compare your version with the patched version mentioned in the update.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can also check your application for vulnerabilities using the Vulert playground without signing up.
If you cannot update immediately, refrain from opening suspicious attachments and consider using alternative email clients until the update can be applied.
More details can be found on the CVE pages for each vulnerability: CVE-2025-2830, CVE-2025-3522, and CVE-2025-3523.
Related vulnerabilities
Recent vulnerabilities recorded for thunderbird.
