vulnerability
Rocky Linux: CVE-2025-3523: thunderbird (RLSA-2025-7435)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:N/AC:H/Au:N/C:P/I:C/A:P) | Jul 29, 2025 | Jul 31, 2025 | Aug 13, 2025 |
Severity
7
CVSS
(AV:N/AC:H/Au:N/C:P/I:C/A:P)
Published
Jul 29, 2025
Added
Jul 31, 2025
Modified
Aug 13, 2025
Description
When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.
Solutions
rocky-upgrade-thunderbirdrocky-upgrade-thunderbird-debuginforocky-upgrade-thunderbird-debugsource
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.