Advisories · Technology

Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-5267 CVE record

CVSS 5.4 Medium

Clickjacking vulnerability could have led to leaking saved payment card details
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1021
Not analysed yet 27 May 2025
CVE-2025-5266 CVE record

CVSS 4.3 Medium

Script element events leaked cross-origin resource status
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 27 May 2025
CVE-2025-5265 CVE record

CVSS 4.8 Medium

Potential local code execution in “Copy as cURL” command
- Mozilla Firefox
- Mozilla Thunderbird
- Command injection
Not analysed yet 27 May 2025
CVE-2025-5264 CVE record

CVSS 4.8 Medium

Potential local code execution in “Copy as cURL” command
- Mozilla Firefox
- Mozilla Thunderbird
- Command injection
Not analysed yet 27 May 2025
CVE-2025-5263 CVE record

CVSS 4.3 Medium

Error handling for script execution was incorrectly isolated from web content
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 27 May 2025
CVE-2025-5262 CVE record

CVSS 7.5 High

Double free in Mozilla Thunderbird
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 May 2025
CVE-2025-4919 CVE record

CVSS 8.8 High

Out-of-bounds access when optimizing linear sums
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 17 May 2025
CVE-2025-4918 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Out-of-bounds access when resolving Promise objects
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 17 May 2025
CVE-2025-3932 CVE record

CVSS 6.5 Medium

Tracking Links in Attachments Bypassed Remote Content Blocking
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 14 May 2025
CVE-2025-3909 CVE record

CVSS 8.1 High

JavaScript Execution via Spoofed PDF Attachment and file:/// Link
- Mozilla Thunderbird
- CWE-356
Not analysed yet 14 May 2025
CVE-2025-3875 CVE record

CVSS 7.5 High

Sender Spoofing via Malformed From Header in Thunderbird
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 14 May 2025
CVE-2025-4093 CVE record

CVSS 8.1 High

Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Apr 2025
CVE-2025-4092 CVE record

CVSS 6.5 Medium

Memory safety bugs fixed in Firefox 138 and Thunderbird 138
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Apr 2025
CVE-2025-4091 CVE record

CVSS 8.1 High

Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Apr 2025
CVE-2025-4090 CVE record

CVSS 5.3 Medium

Leaked library paths in Thunderbird for Android
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 29 Apr 2025
CVE-2025-4089 CVE record

CVSS 5.1 Medium

Potential local code execution in "copy as cURL" command
- Mozilla Firefox
- Mozilla Thunderbird
- Command injection
Not analysed yet 29 Apr 2025
CVE-2025-4088 CVE record

CVSS 6.5 Medium

Cross-site request forgery via storage access API redirects
- Mozilla Firefox
- Mozilla Thunderbird
- Cross-site request forgery (CSRF)
Not analysed yet 29 Apr 2025
CVE-2025-4087 CVE record

CVSS 4.8 Medium

Unsafe attribute access during XPath parsing
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Apr 2025
CVE-2025-4086 CVE record

CVSS 6.5 Medium

Specially crafted filename could be used to obscure download type
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-451
Not analysed yet 29 Apr 2025
CVE-2025-4085 CVE record

CVSS 7.1 High

Potential information leakage and privilege escalation in UITour actor
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 29 Apr 2025
CVE-2025-4084 CVE record

CVSS 5.7 Medium

Potential local code execution in "copy as cURL" command
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-116
Not analysed yet 29 Apr 2025
CVE-2025-4083 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Process isolation bypass using "javascript:" URI links in cross-origin frames
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-653
Not analysed yet 29 Apr 2025
CVE-2025-4082 CVE record

CVSS 5.9 Medium

WebGL shader attribute memory corruption in Thunderbird for macOS
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Apr 2025
CVE-2025-2817 CVE record

CVSS 8.8 High

Privilege escalation in Thunderbird Updater
- Mozilla Firefox
- Mozilla Thunderbird
- Path traversal
Not analysed yet 29 Apr 2025
CVE-2025-3523 CVE record

CVSS 6.4 Medium

User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird
- CWE-451
Not analysed yet 15 Apr 2025
CVE-2025-2830 CVE record

CVSS 6.3 Medium

Information Disclosure of /tmp directory listing
- Mozilla Thunderbird
- Path traversal
Not analysed yet 15 Apr 2025
CVE-2025-3522 CVE record

CVSS 6.3 Medium

Leak of hashed Window credentials via crafted attachment URL
- Mozilla Thunderbird
- Open redirect
Not analysed yet 15 Apr 2025
CVE-2025-3034 CVE record

CVSS 8.1 High

Memory safety bugs fixed in Firefox 137 and Thunderbird 137
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 1 Apr 2025
CVE-2025-3033 CVE record

CVSS 7.7 High

Opening local .url files could lead to another file being opened
- Mozilla Firefox
- Mozilla Thunderbird
- Path traversal
Not analysed yet 1 Apr 2025
CVE-2025-3032 CVE record

CVSS 7.4 High

Leaking file descriptors from the fork server
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-403
Not analysed yet 1 Apr 2025
CVE-2025-3031 CVE record

CVSS 6.5 Medium

JIT optimization bug with different stack slot sizes
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 1 Apr 2025
CVE-2025-3030 CVE record

CVSS 8.1 High

Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Apr 2025
CVE-2025-3029 CVE record

CVSS 7.3 High

URL Bar Spoofing via non-BMP Unicode characters
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 1 Apr 2025
CVE-2025-3028 CVE record

CVSS 6.5 Medium

Use-after-free triggered by XSLTProcessor
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Apr 2025
CVE-2025-26695 CVE record

CVSS 5.3 Medium

Downloading of OpenPGP keys from WKD used incorrect padding
- Mozilla Thunderbird
Not analysed yet 10 Mar 2025
CVE-2025-26696 CVE record

CVSS 7.0 High

Crafted email message incorrectly shown as being encrypted
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 10 Mar 2025
CVE-2025-1943 CVE record

CVSS 8.2 High

Memory safety bugs fixed in Firefox 136 and Thunderbird 136
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 4 Mar 2025
CVE-2025-1938 CVE record

CVSS 6.5 Medium

Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 4 Mar 2025
CVE-2025-1937 CVE record

CVSS 7.5 High

Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1260
Not analysed yet 4 Mar 2025
CVE-2025-1936 CVE record

CVSS 7.3 High

Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-158
Not analysed yet 4 Mar 2025
CVE-2025-1935 CVE record

CVSS 4.3 Medium

Clickjacking the registerProtocolHandler info-bar
- Mozilla Firefox
- Mozilla Thunderbird
- Cross-site scripting (XSS)
Not analysed yet 4 Mar 2025
CVE-2025-1942 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Disclosure of uninitialized memory when .toUpperCase() causes string to get longer
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 4 Mar 2025
CVE-2025-1934 CVE record

CVSS 6.5 Medium

Unexpected GC during RegExp bailout processing
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 4 Mar 2025
CVE-2025-1933 CVE record

CVSS 7.6 High

JIT corruption of WASM i32 return values on 64-bit CPUs
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 4 Mar 2025
CVE-2025-1932 CVE record

CVSS 8.1 High

Inconsistent comparator in XSLT sorting led to out-of-bounds access
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 4 Mar 2025
CVE-2025-1931 CVE record

CVSS 7.5 High

Use-after-free in WebTransportChild
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 4 Mar 2025
CVE-2025-1930 CVE record

CVSS 8.8 High

AudioIPC StreamData could trigger a use-after-free in the Browser process
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 4 Mar 2025
CVE-2025-1015 CVE record

CVSS 5.4 Medium

Unsanitized address book fields
- Mozilla Thunderbird
- Cross-site scripting (XSS)
Not analysed yet 4 Feb 2025
CVE-2025-1020 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Firefox 135 and Thunderbird 135
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 4 Feb 2025
CVE-2025-1017 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 4 Feb 2025
CVE-2025-1016 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 4 Feb 2025
CVE-2025-0510 CVE record

CVSS 6.5 Medium

Address of e-mail sender can be spoofed by malicious email
- Mozilla Thunderbird
- CWE-345
Not analysed yet 4 Feb 2025
CVE-2025-1014 CVE record

CVSS 8.8 High

Certificate length was not properly checked
- Mozilla Firefox
- Mozilla Thunderbird
- Weak cryptography or TLS
Not analysed yet 4 Feb 2025
CVE-2025-1013 CVE record

CVSS 6.5 Medium

Potential opening of private browsing tabs in normal browsing windows
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
Not analysed yet 4 Feb 2025
CVE-2025-1019 CVE record

CVSS 4.3 Medium

Fullscreen notification not properly displayed
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1021
Not analysed yet 4 Feb 2025
CVE-2025-1012 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free during concurrent delazification
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 4 Feb 2025
CVE-2025-1011 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

A bug in WebAssembly code generation could result in a crash
- Mozilla Firefox
- Mozilla Thunderbird
- Code injection
Not analysed yet 4 Feb 2025
CVE-2025-1018 CVE record

CVSS 7.3 High

Fullscreen notification is not displayed when fullscreen is re-requested
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1021
Not analysed yet 4 Feb 2025
CVE-2025-1010 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in Custom Highlight
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 4 Feb 2025
CVE-2025-1009 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in XSLT
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 4 Feb 2025