CVE-2025-3523

Medium CVSS: 6.4

When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.

Vendor

Mozilla

Product

Thunderbird

CWE

CWE-451

Yayın Tarihi

2025-04-15 15:16:09

Güncelleme

2025-06-13 18:51:08

Source Identifier

security@mozilla.org

KEV Date Added

Kategoriler

CWE-451 Thunderbird MEDIUM Mozilla 2025

Referanslar

https://bugzilla.mozilla.org/show_bug.cgi?id=1958385 https://www.mozilla.org/security/advisories/mfsa2025-26/ https://www.mozilla.org/security/advisories/mfsa2025-27/

Benzer Kayıtlar

Medium

CVE-2026-3889

Spoofing issue in Thunderbird. This vulnerability affects Thunderbird < 149 and Thunderbird < 140.9.

High

CVE-2026-4371

A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside th…

High

CVE-2026-4722

Privilege escalation in the IPC component. This vulnerability affects Firefox < 149 and Thunderbird < 149.

Critical

CVE-2026-4723

Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 149 and Thunderbird < 149.

Critical

CVE-2026-4724

Undefined behavior in the Audio/Video component. This vulnerability affects Firefox < 149 and Thunderbird < 149.

Critical

CVE-2026-4725

Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149 and T…