| CVE-2025-5269 |
Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10
|
8.1
Élevée
|
27 mai 2025 |
| CVE-2025-5268 |
Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10
|
8.1
Élevée
|
27 mai 2025 |
| CVE-2025-5267 |
A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious…
|
5.4
Moyenne
|
27 mai 2025 |
| CVE-2025-5266 |
Script elements loading cross-origin resources generated load and error events which leaked information enabling…
|
4.3
Moyenne
|
27 mai 2025 |
| CVE-2025-5265 |
Due to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user…
|
4.8
Moyenne
|
27 mai 2025 |
| CVE-2025-5264 |
Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into…
|
4.8
Moyenne
|
27 mai 2025 |
| CVE-2025-5263 |
Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin…
|
4.3
Moyenne
|
27 mai 2025 |
| CVE-2025-5262 |
A double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the…
|
7.5
Élevée
|
27 mai 2025 |
| CVE-2025-4919 |
An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes
|
8.8
Élevée
|
17 mai 2025 |
| CVE-2025-4918 |
An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object
|
9.8
Critique
|
17 mai 2025 |
| CVE-2025-3932 |
It was possible to craft an email that showed a tracking link as an attachment
|
6.5
Moyenne
|
14 mai 2025 |
| CVE-2025-3909 |
Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the…
|
8.1
Élevée
|
14 mai 2025 |
| CVE-2025-3875 |
Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address…
|
7.5
Élevée
|
14 mai 2025 |
| CVE-2025-4093 |
Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9
|
8.1
Élevée
|
29 avr. 2025 |
| CVE-2025-4092 |
Memory safety bugs present in Firefox 137 and Thunderbird 137
|
6.5
Moyenne
|
29 avr. 2025 |
| CVE-2025-4091 |
Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9
|
8.1
Élevée
|
29 avr. 2025 |
| CVE-2025-4090 |
A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat
|
5.3
Moyenne
|
29 avr. 2025 |
| CVE-2025-4089 |
Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into…
|
5.1
Moyenne
|
29 avr. 2025 |
| CVE-2025-4088 |
A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to…
|
6.5
Moyenne
|
29 avr. 2025 |
| CVE-2025-4087 |
A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null…
|
4.8
Moyenne
|
29 avr. 2025 |
| CVE-2025-4086 |
A specially crafted filename containing a large number of encoded newline characters could obscure the file's…
|
6.5
Moyenne
|
29 avr. 2025 |
| CVE-2025-4085 |
An attacker with control over a content process could potentially leverage the privileged UITour actor to leak sensitive…
|
7.1
Élevée
|
29 avr. 2025 |
| CVE-2025-4084 |
Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user…
|
5.7
Moyenne
|
29 avr. 2025 |
| CVE-2025-4083 |
A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow…
|
9.1
Critique
|
29 avr. 2025 |
| CVE-2025-4082 |
Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other…
|
5.9
Moyenne
|
29 avr. 2025 |