The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disclose sensitive information from the victim's system. This vulnerability is not limited to Linux; similar behavior has been observed on Windows as well. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade thunderbird | Apr 29, 2025 | Apr 15, 2025 |
| Amazon Linux Ami 2 | — | Upgrade thunderbird-debuginfoUpgrade thunderbird | May 30, 2025 | Apr 15, 2025 |
| Debian | — | Upgrade thunderbird | May 5, 2025 | Apr 15, 2025 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 128.9.2Upgrade to the latest version of Mozilla Thunderbird | Apr 16, 2025 | Apr 15, 2025 |
| Oracle_linux | — | Upgrade thunderbird | Apr 29, 2025 | Apr 15, 2025 |
| Redhat_linux | — | Upgrade thunderbird-debugsourceUpgrade thunderbird-debuginfoUpgrade thunderbirdNo solution exists | Apr 29, 2025 | Apr 15, 2025 |
| Rocky_linux | — | Upgrade thunderbird-debugsourceUpgrade thunderbirdUpgrade thunderbird-debuginfo | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade MozillaThunderbird-translations-otherUpgrade MozillaThunderbird-translations-commonUpgrade MozillaThunderbird | Apr 25, 2025 | Apr 15, 2025 |
| Ubuntu | — | Upgrade thunderbird | Jul 23, 2025 | Apr 15, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub