# thunderbird 1:128.12.0+build1-0ubuntu0.22.04.1: thunderbird 1:128.12.0+build1-0ubuntu0.22.04.1 for Ubuntu 22.04.1 LTS (jammy)

thunderbird 1:128.12.0+build1-0ubuntu0.22.04.1, released June 24, 2025, fixes 52 CVEs in thunderbird. None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/ubuntu-jammy-thunderbird-1-128.12.0-build1-0ubuntu0.22.04.1
- Platform: Linux
- Released: Jun 24, 2025
- Priority: High (Closes CVE-2025-0242, high severity)
- CVEs: 52, exploited: 0, on CISA KEV: 0

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [thunderbird](https://patchblox.com/security/data/product/linux/thunderbird.md) | Ubuntu 22.04.1 LTS (jammy) | 1:128.12.0+build1-0ubuntu0.22.04.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2025-0242](https://patchblox.com/security/data/cve/CVE-2025-0242.md) | High | Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6 | 8.8 | 0.1472 |  |
| [CVE-2025-4918](https://patchblox.com/security/data/cve/CVE-2025-4918.md) | High | Out-of-bounds access when resolving Promise objects | 9.8 | 0.0952 |  |
| [CVE-2025-4919](https://patchblox.com/security/data/cve/CVE-2025-4919.md) | High | Out-of-bounds access when optimizing linear sums | 8.8 | 0.0912 |  |
| [CVE-2025-6424](https://patchblox.com/security/data/cve/CVE-2025-6424.md) | High | Use-after-free in FontFaceSet | 9.8 | 0.0790 |  |
| [CVE-2025-1009](https://patchblox.com/security/data/cve/CVE-2025-1009.md) | High | Use-after-free in XSLT | 9.8 | 0.0120 |  |
| [CVE-2025-3028](https://patchblox.com/security/data/cve/CVE-2025-3028.md) | High | Use-after-free triggered by XSLTProcessor | 8.8 | 0.0087 |  |
| [CVE-2025-1011](https://patchblox.com/security/data/cve/CVE-2025-1011.md) | High | A bug in WebAssembly code generation could result in a crash | 8.8 | 0.0063 |  |
| [CVE-2025-5986](https://patchblox.com/security/data/cve/CVE-2025-5986.md) | High | Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links | 7.5 | 0.0061 |  |
| [CVE-2025-1016](https://patchblox.com/security/data/cve/CVE-2025-1016.md) | High | Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7 | 9.8 | 0.0059 |  |
| [CVE-2025-1017](https://patchblox.com/security/data/cve/CVE-2025-1017.md) | High | Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7 | 9.8 | 0.0058 |  |
| [CVE-2025-1937](https://patchblox.com/security/data/cve/CVE-2025-1937.md) | High | Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8 | 8.8 | 0.0056 |  |
| [CVE-2025-1931](https://patchblox.com/security/data/cve/CVE-2025-1931.md) | High | Use-after-free in WebTransportChild | 8.8 | 0.0054 |  |
| [CVE-2025-3030](https://patchblox.com/security/data/cve/CVE-2025-3030.md) | High | Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9 | 8.8 | 0.0051 |  |
| [CVE-2025-4091](https://patchblox.com/security/data/cve/CVE-2025-4091.md) | High | Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10 | 8.8 | 0.0051 |  |
| [CVE-2025-5268](https://patchblox.com/security/data/cve/CVE-2025-5268.md) | High | Memory safety bugs fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11 | 8.8 | 0.0051 |  |
| [CVE-2025-4093](https://patchblox.com/security/data/cve/CVE-2025-4093.md) | High | Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10 | 8.8 | 0.0049 |  |
| [CVE-2025-5269](https://patchblox.com/security/data/cve/CVE-2025-5269.md) | High | Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird 128.11 | 8.8 | 0.0048 |  |
| [CVE-2025-3909](https://patchblox.com/security/data/cve/CVE-2025-3909.md) | High | JavaScript Execution via Spoofed PDF Attachment and file:/// Link | 8.8 | 0.0047 |  |
| [CVE-2025-1010](https://patchblox.com/security/data/cve/CVE-2025-1010.md) | High | Use-after-free in Custom Highlight | 8.8 | 0.0046 |  |
| [CVE-2025-4083](https://patchblox.com/security/data/cve/CVE-2025-4083.md) | High | Process isolation bypass using "javascript:" URI links in cross-origin frames | 9.1 | 0.0046 |  |
| [CVE-2025-1934](https://patchblox.com/security/data/cve/CVE-2025-1934.md) | High | Unexpected GC during RegExp bailout processing | 8.8 | 0.0045 |  |
| [CVE-2025-1012](https://patchblox.com/security/data/cve/CVE-2025-1012.md) | High | Use-after-free during concurrent delazification | 8.8 | 0.0045 |  |
| [CVE-2025-1936](https://patchblox.com/security/data/cve/CVE-2025-1936.md) | High | Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents | 8.8 | 0.0045 |  |
| [CVE-2025-1932](https://patchblox.com/security/data/cve/CVE-2025-1932.md) | High | Inconsistent comparator in XSLT sorting led to out-of-bounds access | 8.8 | 0.0042 |  |
| [CVE-2025-1930](https://patchblox.com/security/data/cve/CVE-2025-1930.md) | High | AudioIPC StreamData could trigger a use-after-free in the Browser process | 8.8 | 0.0040 |  |
| [CVE-2025-3875](https://patchblox.com/security/data/cve/CVE-2025-3875.md) | High | Sender Spoofing via Malformed From Header in Thunderbird | 8.8 | 0.0040 |  |
| [CVE-2025-1014](https://patchblox.com/security/data/cve/CVE-2025-1014.md) | High | Certificate length was not properly checked | 8.8 | 0.0039 |  |
| [CVE-2025-3932](https://patchblox.com/security/data/cve/CVE-2025-3932.md) | High | Tracking Links in Attachments Bypassed Remote Content Blocking | 8.8 | 0.0039 |  |
| [CVE-2025-2830](https://patchblox.com/security/data/cve/CVE-2025-2830.md) | High | Information Disclosure of /tmp directory listing | 7.4 | 0.0036 |  |
| [CVE-2024-43097](https://patchblox.com/security/data/cve/CVE-2024-43097.md) | High | webkit2gtk3: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of p... | 7.8 | 0.0036 |  |
| [CVE-2025-26696](https://patchblox.com/security/data/cve/CVE-2025-26696.md) | High | Crafted email message incorrectly shown as being encrypted | 7.0 | 0.0036 |  |
| [CVE-2025-3029](https://patchblox.com/security/data/cve/CVE-2025-3029.md) | High | URL Bar Spoofing via non-BMP Unicode characters | 8.8 | 0.0036 |  |
| [CVE-2025-6429](https://patchblox.com/security/data/cve/CVE-2025-6429.md) | High | Incorrect parsing of URLs could have allowed embedding of youtube.com | 7.5 | 0.0035 |  |
| [CVE-2025-1935](https://patchblox.com/security/data/cve/CVE-2025-1935.md) | High | Clickjacking the registerProtocolHandler info-bar | 8.8 | 0.0034 |  |
| [CVE-2025-5266](https://patchblox.com/security/data/cve/CVE-2025-5266.md) | High | Script element events leaked cross-origin resource status | 8.8 | 0.0034 |  |
| [CVE-2025-1938](https://patchblox.com/security/data/cve/CVE-2025-1938.md) | High | Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8 | 8.8 | 0.0034 |  |
| [CVE-2025-3523](https://patchblox.com/security/data/cve/CVE-2025-3523.md) | High | User Interface (UI) Misrepresentation of attachment URL | 7.4 | 0.0033 |  |
| [CVE-2025-4087](https://patchblox.com/security/data/cve/CVE-2025-4087.md) | High | Unsafe attribute access during XPath parsing | 8.8 | 0.0032 |  |
| [CVE-2025-1933](https://patchblox.com/security/data/cve/CVE-2025-1933.md) | High | JIT corruption of WASM i32 return values on 64-bit CPUs | 8.8 | 0.0032 |  |
| [CVE-2025-1013](https://patchblox.com/security/data/cve/CVE-2025-1013.md) | High | Potential opening of private browsing tabs in normal browsing windows | 8.8 | 0.0032 |  |
| [CVE-2025-6425](https://patchblox.com/security/data/cve/CVE-2025-6425.md) | High | The WebCompat WebExtension shipped with Firefox exposed a persistent UUID | 7.5 | 0.0031 |  |
| [CVE-2025-5264](https://patchblox.com/security/data/cve/CVE-2025-5264.md) | High | Potential local code execution in “Copy as cURL” command | 8.8 | 0.0030 |  |
| [CVE-2025-5267](https://patchblox.com/security/data/cve/CVE-2025-5267.md) | High | Clickjacking vulnerability could have led to leaking saved payment card details | 8.8 | 0.0028 |  |
| [CVE-2025-3522](https://patchblox.com/security/data/cve/CVE-2025-3522.md) | High | Leak of hashed Window credentials via crafted attachment URL | 7.4 | 0.0028 |  |
| [CVE-2025-0510](https://patchblox.com/security/data/cve/CVE-2025-0510.md) | High | Address of e-mail sender can be spoofed by malicious email | 7.1 | 0.0028 |  |
| [CVE-2025-6430](https://patchblox.com/security/data/cve/CVE-2025-6430.md) | High | Content-Disposition header ignored when a file is included in an embed or object tag | 7.5 | 0.0027 |  |
| [CVE-2025-5263](https://patchblox.com/security/data/cve/CVE-2025-5263.md) | High | Error handling for script execution was incorrectly isolated from web content | 8.8 | 0.0026 |  |
| [CVE-2025-1015](https://patchblox.com/security/data/cve/CVE-2025-1015.md) | Routine | Unsanitized address book fields | 5.4 | 0.0138 |  |
| [CVE-2025-0238](https://patchblox.com/security/data/cve/CVE-2025-0238.md) | Routine | Use-after-free when breaking lines in text | 6.5 | 0.0079 |  |
| [CVE-2025-5265](https://patchblox.com/security/data/cve/CVE-2025-5265.md) | Routine | Potential local code execution in “Copy as cURL” command | 4.8 | 0.0021 |  |
| [CVE-2025-6426](https://patchblox.com/security/data/cve/CVE-2025-6426.md) | Routine | MozillaFirefox: (bmo#1964385) No warning when opening executable terminal files on macOS | n/a | 0.0021 |  |
| [CVE-2025-26695](https://patchblox.com/security/data/cve/CVE-2025-26695.md) | Routine | Downloading of OpenPGP keys from WKD used incorrect padding | 5.3 | 0.0016 |  |

---

Data as of 2026-11-14T14:09:31Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.