Linux · Security advisory · February 10, 2025
RHSA-2025:1184: thunderbird security update
RHSA-2025:1184, released February 10, 2025, fixes 10 CVEs in thunderbird (version 0:128.7.0-1.el9_5). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
10
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0137
72nd percentile
Priority of the 10 CVEs
Patch now 0
Urgent 0
High 9
Routine 1
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| thunderbird | RHEL 9 | 0:128.7.0-1.el9_5 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2025-1009 | Use-after-free in XSLT | 9.8 | 0.0121 | None reported | |
| High | CVE-2025-1011 | A bug in WebAssembly code generation could result in a crash | 8.8 | 0.0063 | None reported | |
| High | CVE-2025-1016 | Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7 | 9.8 | 0.0059 | None reported | |
| High | CVE-2025-1017 | Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7 | 9.8 | 0.0058 | None reported | |
| High | CVE-2025-1010 | Use-after-free in Custom Highlight | 8.8 | 0.0046 | None reported | |
| High | CVE-2025-1012 | Use-after-free during concurrent delazification | 8.8 | 0.0045 | None reported | |
| High | CVE-2025-1014 | Certificate length was not properly checked | 8.8 | 0.0039 | None reported | |
| High | CVE-2025-1013 | Potential opening of private browsing tabs in normal browsing windows | 8.8 | 0.0033 | None reported | |
| High | CVE-2025-0510 | Address of e-mail sender can be spoofed by malicious email | 7.1 | 0.0029 | None reported | |
| Routine | CVE-2025-1015 | Unsanitized address book fields | 5.4 | 0.0137 | None reported |
Showing 1 to 10 of 10
1