thunderbird 1:128.12.0+build1-0ubuntu0.22.04.1: thunderbird 1:128.12.0+build1-0ubuntu0.22.04.1 for Ubuntu 22.04.1 LTS (jammy)

thunderbird 1:128.12.0+build1-0ubuntu0.22.04.1, released June 24, 2025, fixes 52 CVEs in thunderbird. None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Highest CVSS

9.8

Base score, 0 to 10

Highest EPSS

0.1472

96th percentile

Priority of the 52 CVEs

Patch now 0
                                Urgent 0
                                High 47
                                Routine 5

Fixed package versions

Product	Release	Fixed in
thunderbird	Ubuntu 22.04.1 LTS (jammy)	1:128.12.0+build1-0ubuntu0.22.04.1

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2025-0242	Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6	8.8	0.1472	None reported
High	CVE-2025-4918	Out-of-bounds access when resolving Promise objects	9.8	0.0952	None reported
High	CVE-2025-4919	Out-of-bounds access when optimizing linear sums	8.8	0.0912	None reported
High	CVE-2025-6424	Use-after-free in FontFaceSet	9.8	0.0790	None reported
High	CVE-2025-1009	Use-after-free in XSLT	9.8	0.0120	None reported
High	CVE-2025-3028	Use-after-free triggered by XSLTProcessor	8.8	0.0087	None reported
High	CVE-2025-1011	A bug in WebAssembly code generation could result in a crash	8.8	0.0063	None reported
High	CVE-2025-5986	Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links	7.5	0.0061	None reported
High	CVE-2025-1016	Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7	9.8	0.0059	None reported
High	CVE-2025-1017	Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7	9.8	0.0058	None reported
High	CVE-2025-1937	Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8	8.8	0.0056	None reported
High	CVE-2025-1931	Use-after-free in WebTransportChild	8.8	0.0054	None reported
High	CVE-2025-3030	Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9	8.8	0.0051	None reported
High	CVE-2025-4091	Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10	8.8	0.0051	None reported
High	CVE-2025-5268	Memory safety bugs fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11	8.8	0.0051	None reported
High	CVE-2025-4093	Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10	8.8	0.0049	None reported
High	CVE-2025-5269	Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird 128.11	8.8	0.0048	None reported
High	CVE-2025-3909	JavaScript Execution via Spoofed PDF Attachment and file:/// Link	8.8	0.0047	None reported
High	CVE-2025-1010	Use-after-free in Custom Highlight	8.8	0.0046	None reported
High	CVE-2025-4083	Process isolation bypass using "javascript:" URI links in cross-origin frames	9.1	0.0046	None reported
High	CVE-2025-1934	Unexpected GC during RegExp bailout processing	8.8	0.0045	None reported
High	CVE-2025-1012	Use-after-free during concurrent delazification	8.8	0.0045	None reported
High	CVE-2025-1936	Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents	8.8	0.0045	None reported
High	CVE-2025-1932	Inconsistent comparator in XSLT sorting led to out-of-bounds access	8.8	0.0042	None reported
High	CVE-2025-1930	AudioIPC StreamData could trigger a use-after-free in the Browser process	8.8	0.0040	None reported

Also fixes CVE-2025-0242

Mozilla Firefox ESR (sat) 140.13.0
Mozilla Firefox ESR (sat)
Mozilla Firefox ESR (ach) 140.3.0
Mozilla Firefox ESR (ach)
Mozilla Firefox ESR (af) 140.3.0
Mozilla Firefox ESR (af)
Mozilla Firefox ESR (an) 140.3.0
Mozilla Firefox ESR (an)
Mozilla Firefox ESR (ar) 140.3.0
Mozilla Firefox ESR (ar)
Mozilla Firefox ESR (ast) 140.3.0
Mozilla Firefox ESR (ast)
Mozilla Firefox ESR (az) 140.3.0
Mozilla Firefox ESR (az)
Mozilla Firefox ESR (be) 140.3.0
Mozilla Firefox ESR (be)

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/ubuntu-jammy-thunderbird-1-128.12.0-build1-0ubuntu0.22.04.1">thunderbird 1:128.12.0+build1-0ubuntu0.22.04.1 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.