CVE-2025-3932

NameCVE-2025-3932
DescriptionIt was possible to craft an email that showed a tracking link as an attachment. If the user attempted to open the attachment, Thunderbird automatically accessed the link. The configuration to block remote content did not prevent that. Thunderbird has been fixed to no longer allow access to web pages listed in the X-Mozilla-External-Attachment-URL header of an email. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4167-1, DSA-5921-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
thunderbird (PTS)bullseye1:115.12.0-1~deb11u1vulnerable
bullseye (security)1:128.11.0esr-1~deb11u1fixed
bookworm1:128.10.0esr-1~deb12u1vulnerable
bookworm (security)1:128.11.0esr-1~deb12u1fixed
sid, trixie1:128.11.0esr-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
thunderbirdsourcebullseye1:128.10.1esr-1~deb11u1DLA-4167-1
thunderbirdsourcebookworm1:128.10.1esr-1~deb12u1DSA-5921-1
thunderbirdsource(unstable)1:128.10.1esr-1

Notes

https://www.mozilla.org/en-US/security/advisories/mfsa2025-34/#CVE-2025-3932

Search for package or bug name: Reporting problems