Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* firefox: thunderbird: URL Bar Spoofing via non-BMP Unicode characters (CVE-2025-3029)
* firefox: thunderbird: Use-after-free triggered by XSLTProcessor (CVE-2025-3028)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9 (CVE-2025-3030)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (CVE-2025-5986)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8 (CVE-2025-1938)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8 (CVE-2025-1937)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* Thunderbird: 115.14/128.1 ()
* mozilla: Fullscreen notification dialog can be obscured by document content (CVE-2024-7518)
* mozilla: Out of bounds memory access in graphics shared memory handling (CVE-2024-7519)
* mozilla: Type confusion in WebAssembly (CVE-2024-7520)
* mozilla: Incomplete WebAssembly exception handing (CVE-2024-7521)
* mozilla: Out of bounds read in editor component (CVE-2024-7522)
* mozilla: Missing permission check when creating a StreamFilter (CVE-2024-7525)
* mozilla: Uninitialized memory used by WebGL (CVE-2024-7526)
* mozilla:
Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6 (CVE-2025-0243)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6 (CVE-2025-0242)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* thunderbird: Potential disclosure of plaintext in OpenPGP encrypted message (CVE-2024-11159)
* firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CVE-2024-11694)
* firefox: thunderbird: Unhandled Exception in Add-on Signature Verification (CVE-2024-11696)
* firefox: thunderbird: Select list elements could be shown over another site (CVE-2024-11692)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5 (CVE-2024-11699)
* firefox: thunderbird: URL Bar Spoofing
Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in the browser (CVE-2024-10464)
* firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response (CVE-2024-10461)
* firefox: thunderbird: Permission leak via embed or object elements (CVE-2024-10458)
* firefox: thunderbird: Use-after-free in layout with accessibility (CVE-2024-10459)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4 (CVE-2024-1
Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill) (CVE-2024-9680)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* thunderbird: 115.15/128.2 ()
* mozilla: Type confusion when looking up a property name in a "with" block (CVE-2024-8381)
* mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran (CVE-2024-8382)
* mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)
* mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385)
* mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)
* mozilla: Memory safety bu
Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* Mozilla: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13 (CVE-2024-6604)
* Mozilla: Race condition in permission assignment (CVE-2024-6601)
* Mozilla: Memory corruption in thread creation (CVE-2024-6603)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 115.12.1.
Security Fix(es):
* thunderbird: Use-after-free in networking (CVE-2024-5702)
* thunderbird: Use-after-free in JavaScript object transplant (CVE-2024-5688)
* thunderbird: External protocol handlers leaked by timing attack (CVE-2024-5690)
* thunderbird: Sandboxed iframes were able to bypass sandbox restrictions to open a new window (CVE-2024-5691)
* thunderbird: Cross-Origin Image leak via Offscreen Canvas (CVE-2024-5693)
* thunderbird: Memory Corruption in Text Fragments (CVE-2024-5696)
* thunderbird: Memory safety bu
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 115.11.0.
Security Fix(es):
* firefox: Arbitrary JavaScript execution in PDF.js (CVE-2024-4367)
* firefox: IndexedDB files retained in private browsing mode (CVE-2024-4767)
* firefox: Potential permissions request bypass via clickjacking (CVE-2024-4768)
* firefox: Cross-origin responses could be distinguished between script and
non-script content-types (CVE-2024-4769)
* firefox: Use-after-free could occur when printing to PDF (CVE-2024-4770)
* firefox: Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11, and
Thunderbird 1
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 115.10.0.
Security Fix(es):
* Mozilla: Denial of Service using HTTP/2 CONTINUATION frames (CVE-2024-3302)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 115.9.0.
Security Fix(es):
* nss: timing attack against RSA decryption (CVE-2023-5388)
* Mozilla: Crash in NSS TLS method (CVE-2024-0743)
* Mozilla: Leaking of encrypted email subjects to other conversations (CVE-2024-1936)
* Mozilla: JIT code failed to save return registers on Armv7-A (CVE-2024-2607)
* Mozilla: Integer overflow could have led to out of bounds write
(CVE-2024-2608)
* Mozilla: Improper handling of html and body tags enabled CSP nonce leakage
(CVE-2024-2610)
* Mozilla: Clickjacking vulnerability could have led to
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 115.7.0.
Security Fix(es):
* Mozilla: Out of bounds write in ANGLE (CVE-2024-0741)
* Mozilla: Failure to update user input timestamp (CVE-2024-0742)
* Mozilla: Crash when listing printers on Linux (CVE-2024-0746)
* Mozilla: Bypass of Content Security Policy when directive unsafe-inline was set (CVE-2024-0747)
* Mozilla: Phishing site popup could show local origin in address bar (CVE-2024-0749)
* Mozilla: Potential permissions request bypass via clickjacking (CVE-2024-0750)
* Mozilla: Privilege escalation through devtools (CVE-20
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 115.6.0.
Security Fix(es):
* Mozilla: Heap-buffer-overflow affecting WebGL <code>DrawElementsInstanced</code> method with Mesa VM driver (CVE-2023-6856)
* Mozilla: Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6 (CVE-2023-6864)
* Mozilla: S/MIME signature accepted despite mismatching message date (CVE-2023-50761)
* Mozilla: Truncated signed text was shown with a valid OpenPGP signature (CVE-2023-50762)
* Mozilla: Symlinks may resolve to smaller than expected buffers (CVE-2023-6857)
* Mozilla: Hea
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 115.5.0.
Security Fix(es):
* Mozilla: Out-of-bound memory access in WebGL2 blitFramebuffer (CVE-2023-6204)
* Mozilla: Use-after-free in MessagePort::Entangled (CVE-2023-6205)
* Mozilla: Clickjacking permission prompts using the fullscreen transition (CVE-2023-6206)
* Mozilla: Use-after-free in ReadableByteStreamQueueEntry::Buffer (CVE-2023-6207)
* Mozilla: Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5 (CVE-2023-6212)
* Mozilla: Using Selection API would copy contents into X11 primary selection.
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 102.15.1.
Security Fix(es):
* libwebp: Heap buffer overflow in WebP Codec (CVE-2023-4863)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.