It was possible to craft an email that showed a tracking link as an attachment. If the user attempted to open the attachment, Thunderbird automatically accessed the link. The configuration to block remote content did not prevent that. Thunderbird has been fixed to no longer allow access to web pages listed in the X-Mozilla-External-Attachment-URL header of an email. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1960412 | Permissions Required |
| https://www.mozilla.org/security/advisories/mfsa2025-34/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-35/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
05 Jun 2025, 14:26
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mozilla thunderbird
Mozilla |
|
| CPE | cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* | |
| References | () https://www.mozilla.org/security/advisories/mfsa2025-35/ - Vendor Advisory | |
| References | () https://www.mozilla.org/security/advisories/mfsa2025-34/ - Vendor Advisory | |
| References | () https://bugzilla.mozilla.org/show_bug.cgi?id=1960412 - Permissions Required |
14 May 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-14 17:15
Updated : 2025-06-05 14:26
NVD link : CVE-2025-3932
Mitre link : CVE-2025-3932
JSON object : View
Products Affected
mozilla
- thunderbird
CWE
No CWE.