- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202505-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Mozilla Thunderbird: Multiple Vulnerabilities Date: May 12, 2025 Bugs: #945051, #948114, #951564, #953022 ID: 202505-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. Background ========= Mozilla Thunderbird is a popular open-source email client from the Mozilla project. Affected packages ================ Package Vulnerable Unaffected --------------------------- ------------ ------------ mail-client/thunderbird < 128.9.0 >= 128.9.0 mail-client/thunderbird-bin < 128.9.0 >= 128.9.0 Description ========== Multiple vulnerabilities have been discovered in Mozilla Thunderbird. Please review the CVE identifiers referenced below for details. Impact ===== Please review the referenced CVE identifiers for details. Workaround ========= There is no known workaround at this time. Resolution ========= All Mozilla Thunderbird users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-bin-128.9.0" All Mozilla Thunderbird users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-128.9.0" References ========= [ 1 ] CVE-2024-11692 https://nvd.nist.gov/vuln/detail/CVE-2024-11692 [ 2 ] CVE-2024-11694 https://nvd.nist.gov/vuln/detail/CVE-2024-11694 [ 3 ] CVE-2024-11695 https://nvd.nist.gov/vuln/detail/CVE-2024-11695 [ 4 ] CVE-2024-11696 https://nvd.nist.gov/vuln/detail/CVE-2024-11696 [ 5 ] CVE-2024-11697 https://nvd.nist.gov/vuln/detail/CVE-2024-11697 [ 6 ] CVE-2024-11699 https://nvd.nist.gov/vuln/detail/CVE-2024-11699 [ 7 ] CVE-2024-11700 https://nvd.nist.gov/vuln/detail/CVE-2024-11700 [ 8 ] CVE-2024-11701 https://nvd.nist.gov/vuln/detail/CVE-2024-11701 [ 9 ] CVE-2024-11704 https://nvd.nist.gov/vuln/detail/CVE-2024-11704 [ 10 ] CVE-2024-11705 https://nvd.nist.gov/vuln/detail/CVE-2024-11705 [ 11 ] CVE-2024-11706 https://nvd.nist.gov/vuln/detail/CVE-2024-11706 [ 12 ] CVE-2024-11708 https://nvd.nist.gov/vuln/detail/CVE-2024-11708 [ 13 ] CVE-2024-43097 https://nvd.nist.gov/vuln/detail/CVE-2024-43097 [ 14 ] CVE-2024-50336 https://nvd.nist.gov/vuln/detail/CVE-2024-50336 [ 15 ] CVE-2025-0237 https://nvd.nist.gov/vuln/detail/CVE-2025-0237 [ 16 ] CVE-2025-0238 https://nvd.nist.gov/vuln/detail/CVE-2025-0238 [ 17 ] CVE-2025-0239 https://nvd.nist.gov/vuln/detail/CVE-2025-0239 [ 18 ] CVE-2025-0240 https://nvd.nist.gov/vuln/detail/CVE-2025-0240 [ 19 ] CVE-2025-0241 https://nvd.nist.gov/vuln/detail/CVE-2025-0241 [ 20 ] CVE-2025-0242 https://nvd.nist.gov/vuln/detail/CVE-2025-0242 [ 21 ] CVE-2025-0243 https://nvd.nist.gov/vuln/detail/CVE-2025-0243 [ 22 ] CVE-2025-1931 https://nvd.nist.gov/vuln/detail/CVE-2025-1931 [ 23 ] CVE-2025-1932 https://nvd.nist.gov/vuln/detail/CVE-2025-1932 [ 24 ] CVE-2025-1933 https://nvd.nist.gov/vuln/detail/CVE-2025-1933 [ 25 ] CVE-2025-1934 https://nvd.nist.gov/vuln/detail/CVE-2025-1934 [ 26 ] CVE-2025-1935 https://nvd.nist.gov/vuln/detail/CVE-2025-1935 [ 27 ] CVE-2025-1936 https://nvd.nist.gov/vuln/detail/CVE-2025-1936 [ 28 ] CVE-2025-1937 https://nvd.nist.gov/vuln/detail/CVE-2025-1937 [ 29 ] CVE-2025-1938 https://nvd.nist.gov/vuln/detail/CVE-2025-1938 [ 30 ] CVE-2025-3028 https://nvd.nist.gov/vuln/detail/CVE-2025-3028 [ 31 ] CVE-2025-3029 https://nvd.nist.gov/vuln/detail/CVE-2025-3029 [ 32 ] CVE-2025-3030 https://nvd.nist.gov/vuln/detail/CVE-2025-3030 [ 33 ] CVE-2025-3031 https://nvd.nist.gov/vuln/detail/CVE-2025-3031 [ 34 ] CVE-2025-3032 https://nvd.nist.gov/vuln/detail/CVE-2025-3032 [ 35 ] CVE-2025-3034 https://nvd.nist.gov/vuln/detail/CVE-2025-3034 [ 36 ] CVE-2025-26695 https://nvd.nist.gov/vuln/detail/CVE-2025-26695 [ 37 ] CVE-2025-26696 https://nvd.nist.gov/vuln/detail/CVE-2025-26696 [ 38 ] MFSA2024-63 [ 39 ] MFSA2024-64 [ 40 ] MFSA2024-65 [ 41 ] MFSA2024-67 [ 42 ] MFSA2024-68 [ 43 ] MFSA2025-01 [ 44 ] MFSA2025-02 [ 45 ] MFSA2025-05 [ 46 ] MFSA2025-14 [ 47 ] MFSA2025-16 [ 48 ] MFSA2025-18 [ 49 ] MFSA2025-20 [ 50 ] MFSA2025-22 [ 51 ] MFSA2025-23 [ 52 ] MFSA2025-24 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202505-03 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2025 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5