SB2025072329 - Ubuntu update for thunderbird
Published: July 23, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 52 secuirty vulnerabilities.
1) Protection Mechanism Failure (CVE-ID: CVE-2025-6430)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to an error when handling embed or object tags. When a file download is specified via the Content-Disposition header, that directive would be ignored if the file was included via a <embed> or <object> tag, potentially making a website vulnerable to a cross-site scripting attack.
2) Input validation error (CVE-ID: CVE-2025-6429)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to incorrect parsing of embedded URLs that led to URLs being rewritten to the youtube.com domain. A remote attacker can use a specially crafted embed tag to bypass website security checks that restricted which domains users were allowed to embed.
3) Insufficient UI Warning of Dangerous Operations (CVE-ID: CVE-2025-6426)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to the terminal extension does not show a warning when opening an executable terminal filer on macOS. A remote attacker can trick the victim into executing an executable file and compromise the affected system.
Note, the vulnerability affects macOS installations only.
4) Information disclosure (CVE-ID: CVE-2025-6425)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the WebCompat extension shipped with Firefox allows to enumerate resources and obtain a persistent UUID that identifies the browser, and persists between containers and normal/private browsing mode, but not profiles.
5) Use-after-free (CVE-ID: CVE-2025-6424)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in FontFaceSet. A remote attacker can trick the victim into opening a specially crafted website and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
6) Input validation error (CVE-ID: CVE-2025-5986)
The vulnerability allows a remote attacker to gain access to sensitive information or perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input when handling mailbox:/// links. A remote attacker can create a specially crafted email mailbox:/// links and trigger unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. Additionally, this behavior can be use to leak Windows credentials via SMB links when the email is viewed in HTML mode.
Note, viewing the email in HTML mode is enough to load external content.
7) Buffer overflow (CVE-ID: CVE-2025-5269)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
8) Buffer overflow (CVE-ID: CVE-2025-5268)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
9) Insufficient UI Warning of Dangerous Operations (CVE-ID: CVE-2025-5267)
The vulnerability allows a remote attacker to perform clickjacking attacks.
The vulnerability exists due to an error in the UI that can lead to information disclosure. A remote attacker can perform a clickjacking attack and trick a user into leaking saved payment card details to a malicious page.
10) Information disclosure (CVE-ID: CVE-2025-5266)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to script elements loading cross-origin resources generated load and error
events, which leaked information. A remote attacker can gain access to sensitive information.
11) Input validation error (CVE-ID: CVE-2025-5265)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input within the "Copy as cURL" feature. A remote attacker can trick the victim into copying a specially crafted URL, trick the victim into using this command and execute arbitrary commands on the system.
The vulnerability affects Windows installations only.
12) Input validation error (CVE-ID: CVE-2025-5264)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input within the "Copy as cURL" feature. A remote attacker can trick the victim into copying a specially crafted URL, trick the victim into using this command and execute arbitrary commands on the system.
13) Improper error handling (CVE-ID: CVE-2025-5263)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to error handling for script execution is not correctly isolated from the web content. A remote attacker can trick the victim into opening a specially crafted website and obtain certain information cross-origin.
14) Out-of-bounds write (CVE-ID: CVE-2025-4921)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when manipulating a JavaScript object by confusing array index sizes. A remote attacker can trick the victim into visiting a specially crafted website, trigger an out-of-bounds write and execute arbitrary code on the target system.
15) Out-of-bounds write (CVE-ID: CVE-2025-4920)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing JavaScript "Promise" object. A remote attacker can trick the victim into visiting a specially crafted website, trigger an out-of-bounds write and execute arbitrary code on the target system.
16) Buffer overflow (CVE-ID: CVE-2025-4093)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
17) Buffer overflow (CVE-ID: CVE-2025-4091)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
18) Out-of-bounds read (CVE-ID: CVE-2025-4087)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to a boundary condition when parsing XPath content. A remote attacker can trick the victim into visiting a specially crafted website, trigger an out-of-bounds read error and execute arbitrary code on the system.
19) Protection Mechanism Failure (CVE-ID: CVE-2025-4083)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient process isolation when handling "javascript:" URI links. An attacker can trick the victim into clicking on a specially crafted link and execute content in the top-level document's process instead of the intended frame.
20) Information disclosure (CVE-ID: CVE-2025-3932)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to incorrect handling of tracking links. A remote attacker can create a specially crafted email message that showed a tracking link as an attachment. If the user attempted to open the attachment, Thunderbird automatically accessed the link.
21) Input validation error (CVE-ID: CVE-2025-3909)
The vulnerability allows a remote attacker to execute arbitrary JavaScript code.
The vulnerability exists due to incorrect handling of the X-Mozilla-External-Attachment-URL header. A remote attacker can create a nested email attachment, set its content type to application/pdf and force the application to execute arbitrary JavaScript code in the file:/// context.
22) Input validation error (CVE-ID: CVE-2025-3875)
The vulnerability allows a remote attacker to perform a spoofing attack
The vulnerability exists due to insufficient validation of email addresses. A remote attacker can spoof the sender email address via a specially crafted "From" field in the email..
23) Spoofing attack (CVE-ID: CVE-2025-3523)
The vulnerability allows a remote attacker to perform spoofing attack.
When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources.
24) Information disclosure (CVE-ID: CVE-2025-3522)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a missing URL validation when processing the X-Mozilla-External-Attachment-URL header to handle externally hosted attachments. A remote attacker can send a specially crafted email to the victim that contains a link with an internally referenced document, such as "chrome://" or "chrome://" and force Thunderbird to share hashed Windows credentials with that URL, leading to information disclosure.
25) Buffer overflow (CVE-ID: CVE-2025-3030)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
26) Spoofing attack (CVE-ID: CVE-2025-3029)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of non-BMP unicode characters. A remote attacker can use a specially crafted URL to spoof the URL bar in the browser.
27) Use-after-free (CVE-ID: CVE-2025-3028)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in XSLTProcessor. A remote attacker can trick the victim into visiting a specially crafted website, trigger a use-after-free error and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
28) Information disclosure (CVE-ID: CVE-2025-2830)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to an error when handling attachment in a multipart
message. A remote attacker can trick the victim into forwarding a specially crafted email and force Thunderbird to include in the message a
directory listing of /tmp.
29) Multiple Interpretations of UI Input (CVE-ID: CVE-2025-26696)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to improper validation of MIME email messages that claimed to contain an encrypted OpenPGP message. A remote attacker can force the application to incorrectly show the email message as being encrypted.
30) Cryptographic issues (CVE-ID: CVE-2025-26695)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to usage of incorrect padding when downloading OpenPGP key from a WKD server. A remote attacker on the local network can learn the length of the requested email address.
31) Buffer overflow (CVE-ID: CVE-2025-1938)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
32) Buffer overflow (CVE-ID: CVE-2025-1937)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can trick the victim into visiting a specially crafted web page, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
33) Input validation error (CVE-ID: CVE-2025-1936)
The vulnerability allows a remote attacker to bypass security restrictions.
The vulnerability exists due to insufficient validation of a null-byte character (e.g. %00) in the filename when retrieving local file content packaged in a ZIP archive via jar: URLs. The null and everything after it is ignored when retrieving the content from the archive, but the fake extension after the null is used to determine the type of content. A remote attacker can hide code in a web extension disguised as a safe file, such as an image.
34) Improper Restriction of Rendered UI Layers or Frames (CVE-ID: CVE-2025-1935)
The vulnerability allows a remote attacker to perform clickjacking attack.
The vulnerability exists due to the way the registerProtocolHandler info-bar handles events. A remote attacker can trick the victim into setting a malicious site as the default handler for a custom URL protocol.
35) Resource management error (CVE-ID: CVE-2025-1934)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper management of internal resources within the application. A remote attacker interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was not expecting it.
36) Buffer overflow (CVE-ID: CVE-2025-1933)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error on 64-bit CPUs, when the JIT compiles WASM i32 return values they can pick up bits from left over memory. A remote attacker can trick the victim into visiting a specially crafted web page, trigger memory corruption and execute arbitrary code on the target system.
37) Out-of-bounds write (CVE-ID: CVE-2025-1932)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to inconsistent comparison in xslt/txNodeSorter. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds write and execute arbitrary code on the target system.
38) Use-after-free (CVE-ID: CVE-2025-1931)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in WebTransportChild. A remote attacker can trick the victim into visiting a specially crafted website, trigger a use-after-free in the content process side of a WebTransport connection and execute arbitrary code on the system.
39) Use-after-free (CVE-ID: CVE-2025-1930)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in the Browser process when handling StreamData sent over AudioIPC. A remote attacker can trick the victim into visiting a specially crafted web page and execute arbitrary code on the system.
The vulnerability affects Firefox installations on Windows only.
40) Buffer overflow (CVE-ID: CVE-2025-1017)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
41) Buffer overflow (CVE-ID: CVE-2025-1016)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
42) Input validation error (CVE-ID: CVE-2025-1015)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient validation of user-supplied input when handling the Address Book URI fields. A remote attacker create and export an address book containing a malicious payload in a field, trick the victim into clicking on the link after importing the address book and a web page inside Thunderbird.
43) Improper certificate validation (CVE-ID: CVE-2025-1014)
The vulnerability allows a remote attacker to gain bypass implemented security restrictions.
The vulnerability exists due to improper certificate validation when adding certificates to a store. Firefox did not check certificate length, resulting only in trusted data being checked. A remote attacker can trick the victim into importing a malicious certificate into the certificate store and perform MitM attack.
44) Race condition (CVE-ID: CVE-2025-1013)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a race condition when opening private browsing tabs. A remote attacker can force the browser to open private browsing tabs in normal browsing windows and gain access to sensitive information.
45) Use-after-free (CVE-ID: CVE-2025-1012)
The vulnerability allows a remote attacker to compromise vulnerable system.
The
vulnerability exists due to a use-after-free error during concurrent delazification. A remote attacker can trick the victim into visiting a specially
crafted website and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
46) Code Injection (CVE-ID: CVE-2025-1011)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation during WebAssembly code generation. A remote attacker can trick the victim into visiting a specially crafted website and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
47) Use-after-free (CVE-ID: CVE-2025-1010)
The vulnerability allows a remote attacker to compromise vulnerable system.
The
vulnerability exists due to a use-after-free error in Custom Highlight API. A remote attacker can trick the victim into visiting a specially
crafted website and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
48) Use-after-free (CVE-ID: CVE-2025-1009)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling XSLT data. A remote attacker can trick the victim into visiting a specially crafted website and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
49) Spoofing attack (CVE-ID: CVE-2025-0510)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of a sender address if the From field of an email used the invalid group name syntax. A remote attacker can spoof the email content.
Note, the vulnerability is similar to #VU100312 (CVE-2024-49040).
50) Buffer overflow (CVE-ID: CVE-2025-0242)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
51) Use-after-free (CVE-ID: CVE-2025-0238)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when breaking lines in text. A remote attacker can trick the victim into visiting a specially crafted webpage and execute arbitrary code on the system.
52) Improper input validation (CVE-ID: CVE-2024-43097)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation within the System component. A local application can execute arbitrary code.
Remediation
Install update from vendor's website.