thunderbird-128.9.2-1.el9_5.ML.1
エラータID: AXSA:2025-9897:08
リリース日:
2025/05/02 Friday - 09:42
題名:
thunderbird-128.9.2-1.el9_5.ML.1
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Thunderbird には、添付ファイル名の検証処理に問題があるため、
リモートの攻撃者により、細工された添付ファイル名の入力を介して、
/tmp ディレクトリ配下の情報の漏洩を可能とする脆弱性が存在します。
(CVE-2025-2830)
- Thunderbird には、入力された URL の検証処理およびサニタイズ処理
が欠落していることに起因して file:// などの 内部リソースにアクセス
するための URL を保護せずに解釈してしまうため、リモートの攻撃者
により、細工された URL の入力を介して、情報の漏洩を可能とする
脆弱性が存在します。(CVE-2025-3522)
- Thunderbird には、添付ファイルにマウスオーバーした際、最後の
添付ファイルのみのリンクを表示してしまう問題があるため、リモートの
攻撃者により、X-Mozilla-External-Attachment-URL ヘッダーに複数の
外部リンクによる添付ファイルが指定されるように細工されれたメール
の処理を介して、信頼できない情報元からの意図しないコンテンツの
ダウンロードを可能とする脆弱性が存在します。(CVE-2025-3523)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2025-2830
By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disclose sensitive information from the victim's system. This vulnerability is not limited to Linux; similar behavior has been observed on Windows as well. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.
By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disclose sensitive information from the victim's system. This vulnerability is not limited to Linux; similar behavior has been observed on Windows as well. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.
CVE-2025-3522
Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine file size, and navigates to it when the user clicks the attachment. Because the URL is not validated or sanitized, it can reference internal resources like chrome:// or SMB share file:// links, potentially leading to hashed Windows credential leakage and opening the door to more serious security issues. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.
Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine file size, and navigates to it when the user clicks the attachment. Because the URL is not validated or sanitized, it can reference internal resources like chrome:// or SMB share file:// links, potentially leading to hashed Windows credential leakage and opening the door to more serious security issues. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.
CVE-2025-3523
When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.
When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.
追加情報:
N/A
ダウンロード:
SRPMS
- thunderbird-128.9.2-1.el9_5.ML.1.src.rpm
MD5: b3bd852f17f02b6d2008f53b08c8716c
SHA-256: 215f6af44fec9e4fea740c02d327cdeacee70595e6900c6f24bc8fe2d24c1d7b
Size: 851.61 MB
Asianux Server 9 for x86_64
- thunderbird-128.9.2-1.el9_5.ML.1.x86_64.rpm
MD5: 496d35a54c5573ca5080316f8da033cc
SHA-256: 338275fa2ffc970e990e41dc67fabec3aded1e24dabe50057e1713840ec1cd78
Size: 118.02 MB
English