CVE-2025-3875

NameCVE-2025-3875
DescriptionThunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats spoofed@example.com as the actual address. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4167-1, DSA-5921-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
thunderbird (PTS)bullseye1:115.12.0-1~deb11u1vulnerable
bullseye (security)1:128.14.0esr-1~deb11u1fixed
bookworm, bookworm (security)1:128.14.0esr-1~deb12u1fixed
trixie (security), trixie1:128.14.0esr-1~deb13u1fixed
forky, sid1:128.14.0esr-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
thunderbirdsourcebullseye1:128.10.1esr-1~deb11u1DLA-4167-1
thunderbirdsourcebookworm1:128.10.1esr-1~deb12u1DSA-5921-1
thunderbirdsource(unstable)1:128.10.1esr-1

Notes

https://www.mozilla.org/en-US/security/advisories/mfsa2025-34/#CVE-2025-3875

Search for package or bug name: Reporting problems