Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* firefox: thunderbird: Out-of-bounds access when resolving Promise objects (CVE-2025-4918)
* firefox: thunderbird: Out-of-bounds access when optimizing linear sums (CVE-2025-4919)
* firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details (CVE-2025-5267)
* firefox: thunderbird: Potential local code execution in ?Copy as cURL? command (CVE-2025-5264)
* firefox: thunderbird: Memory safety bugs (CVE-2025-5268)
* firefox: thunderbird: Script element events leaked cross-origin resource status (CVE-2025-52
Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link (CVE-2025-3909)
* thunderbird: Sender Spoofing via Malformed From Header in Thunderbird (CVE-2025-3875)
* thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (CVE-2025-3877)
* thunderbird: Tracking Links in Attachments Bypassed Remote Content Blocking (CVE-2025-3932)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE p
Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* thunderbird: User Interface (UI) Misrepresentation of attachment URL (CVE-2025-3523)
* thunderbird: Information Disclosure of /tmp directory listing (CVE-2025-2830)
* thunderbird: Leak of hashed Window credentials via crafted attachment URL (CVE-2025-3522)
* firefox: thunderbird: Privilege escalation in Firefox Updater (CVE-2025-2817)
* firefox: thunderbird: Unsafe attribute access during XPath parsing (CVE-2025-4087)
* firefox: thunderbird: Process isolation bypass using "javascript:" URI links in cross-origin frames (CVE-2025-4083)
* firef