Linux · Security advisory · January 9, 2025
RHSA-2025:0147: thunderbird security update
RHSA-2025:0147, released January 9, 2025, fixes 7 CVEs in thunderbird (version 0:128.6.0-3.el9_5). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
7
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.1472
96th percentile
Priority of the 7 CVEs
Patch now 0
Urgent 0
High 3
Routine 4
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| thunderbird | RHEL 9 | 0:128.6.0-3.el9_5 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2025-0242 | Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6 | 8.8 | 0.1472 | None reported | |
| High | CVE-2025-0241 | Memory corruption when using JavaScript Text Segmentation | 7.7 | 0.0073 | None reported | |
| High | CVE-2025-0243 | Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6 | 7.5 | 0.0025 | None reported | |
| Routine | CVE-2025-0238 | Use-after-free when breaking lines in text | 6.5 | 0.0079 | None reported | |
| Routine | CVE-2025-0240 | Compartment mismatch when parsing JavaScript JSON module | 6.5 | 0.0067 | None reported | |
| Routine | CVE-2025-0237 | WebChannel APIs susceptible to confused deputy attack | 6.8 | 0.0060 | None reported | |
| Routine | CVE-2025-0239 | Alt-Svc ALPN validation failure when redirected | 5.4 | 0.0023 | None reported |
Showing 1 to 7 of 7
1