Critical Security Update for Thunderbird: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:14640: Important: thunderbird security update. Affects thunderbird versions < 128.14.0-3.el9_6.alma.1. Fixed in 128.14.0-3.el9_6.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Mozilla Thunderbird is a standalone mail and newsgroup client that allows users to manage their email communications efficiently. It is known for its robust features, including customizable email management, advanced search capabilities, and support for various email protocols. However, recent vulnerabilities have been identified that could compromise the security and functionality of the application, making it essential for users to stay updated.
Vulnerability Detail
The vulnerabilities in Thunderbird stem from multiple components, including Graphics: WebRender, Audio/Video: GMP, and Graphics: Canvas2D. These issues can lead to denial-of-service attacks, sandbox escapes, and memory safety bugs. Specifically, CVE-2025-9182 can cause out-of-memory errors, while CVE-2025-9179 allows for potential sandbox escapes. Furthermore, CVE-2025-9180 presents a risk of same-origin policy bypass, and CVE-2025-9181 involves uninitialized memory in the JavaScript Engine. These vulnerabilities could allow attackers to exploit the application, leading to unauthorized access or data loss.
How To Fix
Minimum fixed version
128.14.0-3.el9_6.alma.1
This is the first release that contains the fix.
sudo dnf update thunderbirdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for these vulnerabilities. The best course of action is to apply the security update as soon as it is available.
Conclusion
The identified vulnerabilities in Thunderbird pose significant risks to users, necessitating immediate action to update the software to the latest patched version. By staying informed and proactive, users can safeguard their email communications against potential threats.
See every vulnerability recorded for thunderbird →
FAQ
The main vulnerabilities include denial-of-service due to out-of-memory errors, sandbox escape due to invalid pointers, same-origin policy bypass, and memory safety issues.
You can check your version of Thunderbird against the patched version 128.14.0-3.el9_6.alma.1. If you are running an earlier version, you are at risk.
While there are no specific workarounds, it is crucial to update as soon as possible to protect against potential exploits.
Detailed information can be found on the CVE pages for each vulnerability, which provide insights into their impact and mitigation strategies.
Vulert monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json, providing real-time alerts without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for thunderbird.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
