CVE-2025-3909

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

A permission leak could have occurred from a trusted site to an untrusted site via embed or object elements. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10458)

An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10459)

The origin of an external protocol handler prompt could have been obscured using a data: URL within an iframe. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10460)

In multipart/x-mixed-replace responses, Content-Disposition: attachment in the response header was not respected and did not force a download, which could allow XSS attacks. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10461)

Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10462)

Video frames could have been leaked between origins in some situations. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10463)

Repeated writes to history interface attributes could have been used to cause a Denial of Service condition in the browser. This was addressed by introducing rate-limiting to this API. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10464)

A clipboard "paste" button could persist across tabs which allowed a spoofing attack. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10465)

By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10466)

Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10467)

Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird < 128.4.3 and Thunderbird < 132.0.1.(CVE-2024-11159)

Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and memory corruption due to a flaw in Apple's GPU driver.
This bug only affected the application on Apple M series hardware. Other platforms were unaffected. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Firefox ESR < 115.18, Thunderbird < 133, Thunderbird < 128.5, and Thunderbird < 115.18.(CVE-2024-11691)

An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.(CVE-2024-11692)

The executable file warning was not presented when downloading .library-ms files.
Note: This issue only affected Windows operating systems. Other operating systems are unaffected. This vulnerability affects…

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

• thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link (CVE-2025-3909)

• thunderbird: Sender Spoofing via Malformed From Header in Thunderbird (CVE-2025-3875)

• thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (CVE-2025-3877)

• thunderbird: Tracking Links in Attachments Bypassed Remote Content Blocking (CVE-2025-3932)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

• thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link (CVE-2025-3909)

• thunderbird: Sender Spoofing via Malformed From Header in Thunderbird (CVE-2025-3875)

• thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (CVE-2025-3877)

• thunderbird: Tracking Links in Attachments Bypassed Remote Content Blocking (CVE-2025-3932)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

• thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link (CVE-2025-3909)

• thunderbird: Sender Spoofing via Malformed From Header in Thunderbird (CVE-2025-3875)

• thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (CVE-2025-3877)

• thunderbird: Tracking Links in Attachments Bypassed Remote Content Blocking (CVE-2025-3932)

• firefox: thunderbird: Out-of-bounds access when resolving Promise objects (CVE-2025-4918)

• firefox: thunderbird: Out-of-bounds access when optimizing linear sums (CVE-2025-4919)

• firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details (CVE-2025-5267)

• firefox: thunderbird: Potential local code execution in ?Copy as cURL? command (CVE-2025-5264)

• firefox: thunderbird: Memory safety bugs (CVE-2025-5268)

• firefox: thunderbird: Script element events leaked cross-origin resource status (CVE-2025-5266)

• firefox: thunderbird: Error handling for script execution was incorrectly isolated from web content (CVE-2025-5263)

• firefox: thunderbird: Memory safety bug (CVE-2025-5269)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment (message/rfc822) and setting its content type to application/pdf, Thunderbird may incorrectly render it as HTML when opened, allowing the embedded JavaScript to run without requiring a file download. This behavior relies on Thunderbird auto-saving the attachment to /tmp and linking to it via the file:/// protocol, potentially enabling JavaScript execution as part of the HTML. This vulnerability was fixed in Thunderbird 128.10.1 and Thunderbird 138.0.1.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

• thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link (CVE-2025-3909)
• thunderbird: Sender Spoofing via Malformed From Header in Thunderbird (CVE-2025-3875)
• thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (CVE-2025-3877)
• thunderbird: Tracking Links in Attachments Bypassed Remote Content Blocking (CVE-2025-3932)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

• thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link (CVE-2025-3909)
• thunderbird: Sender Spoofing via Malformed From Header in Thunderbird (CVE-2025-3875)
• thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (CVE-2025-3877)
• thunderbird: Tracking Links in Attachments Bypassed Remote Content Blocking (CVE-2025-3932)
• firefox: thunderbird: Out-of-bounds access when resolving Promise objects (CVE-2025-4918)
• firefox: thunderbird: Out-of-bounds access when optimizing linear sums (CVE-2025-4919)
• firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details (CVE-2025-5267)
• firefox: thunderbird: Potential local code execution in ?Copy as cURL? command (CVE-2025-5264)
• firefox: thunderbird: Memory safety bugs (CVE-2025-5268)
• firefox: thunderbird: Script element events leaked cross-origin resource status (CVE-2025-5266)
• firefox: thunderbird: Error handling for script execution was incorrectly isolated from web content (CVE-2025-5263)
• firefox: thunderbird: Memory safety bug (CVE-2025-5269)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2024-0742: assertion failure in nsPresContext::UserInputEventsAllowed (Document::SetIsInitialDocument sticky-bit)
• CVE-2025-2830: path traversal via malformed attachment filename in multipart message (directory guard in MimePart._fetchAttachment + mimedrft.cpp)
• CVE-2025-3909: predictable tempfile path enables JavaScript execution from attachment opened in file:/// context (per-PID tempdir, 0o700)
• CVE-2025-3932: tracking links in attachments bypass remote-content blocking (scheme allowlist + FeedMsg http(s) carve-out in AttachmentInfo.isEmpty)

Sender Spoofing via Malformed From Header in Thunderbird. (CVE-2025-3875) Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links. (CVE-2025-3877) JavaScript Execution via Spoofed PDF Attachment and file:/// Link. (CVE-2025-3909) Tracking Links in Attachments Bypassed Remote Content Blocking. (CVE-2025-3932) Out-of-bounds access when resolving Promise objects. (CVE-2025-4918) Out-of-bounds access when optimizing linear sums. (CVE-2025-4919)

These are all security issues fixed in the MozillaThunderbird-128.10.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaThunderbird fixes the following issues:

Update to Mozilla Thunderbird 128.10.1.

Security fixes:

• MFSA 2025-34 (bsc#1243216)
  • CVE-2025-3875: Sender Spoofing via Malformed From Header in Thunderbird.
  • CVE-2025-3877: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links.
  • CVE-2025-3909: JavaScript Execution via Spoofed PDF Attachment and file:/// Link.
  • CVE-2025-3932: Tracking Links in Attachments Bypassed Remote Content Blocking.

Other bug fixes:

• Fixed: standalone message windows/tabs that no longer responded after folder compaction.
• Fixed: Thunderbird could crash when importing Outlook messages.
• Visual and UX improvements.

This update for MozillaThunderbird fixes the following issues:

Update to Mozilla Thunderbird 128.10.1.

Security fixes:

• MFSA 2025-34 (bsc#1243216)
  • CVE-2025-3875: Sender Spoofing via Malformed From Header in Thunderbird.
  • CVE-2025-3877: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links.
  • CVE-2025-3909: JavaScript Execution via Spoofed PDF Attachment and file:/// Link.
  • CVE-2025-3932: Tracking Links in Attachments Bypassed Remote Content Blocking.

Other bug fixes:

• Fixed: standalone message windows/tabs that no longer responded after folder compaction.
• Fixed: Thunderbird could crash when importing Outlook messages.
• Visual and UX improvements.

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, cross-site tracing, or execute arbitrary code.