Rapid7

vulnerability

Red Hat: CVE-2025-3875: thunderbird: Sender Spoofing via Malformed From Header in Thunderbird (Multiple Advisories)

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:C/I:N/A:N)
Published
May 14, 2025
Added
May 29, 2025
Modified
Jun 12, 2026

Description

The Mozilla Foundation's Security Advisory describes the following issue: Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name [email protected] [email protected]", Thunderbird treats [email protected] as the actual address.

Solutions

redhat-upgrade-thunderbirdredhat-upgrade-thunderbird-debuginforedhat-upgrade-thunderbird-debugsource
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.