Thunderbird 137 Security Update: Fixes 7 Vulnerabilities including CVE-2025-3028 UAF

Critical Vulnerability Information Vulnerability Overview Announcement Date: April 1, 2025 Severity: High Product: Thunderbird Fixed Version: Thunderbird 137 Specific Vulnerability Details 1. CVE-2025-3028: Use-after-free triggered by XSLTProcessor - Reporter: Ivan Fratric (Google Project Zero) - Severity: High - Description: Running JavaScript code during document transformation using XSLTProcessor may lead to a use-after-free vulnerability. - Reference: Bug 1941602 2. CVE-2025-3031: JIT optimization bug with different stack slot sizes - Reporter: anbu - Severity: Medium - Description: An attacker can read 32-bit values overflowing on the stack in JIT-compiled functions. - Reference: Bug 1947141 3. CVE-2025-3032: File descriptor leakage from fork server - Reporter: Thinker Li - Severity: Medium - Description: File descriptor leakage from the fork server to the web content process may enable privilege escalation attacks. - Reference: Bug 1949987 4. CVE-2025-3029: URL bar spoofing via non-BMP Unicode characters - Reporter: Renwa Hiwa - Severity: Medium - Description: A forged URL containing specific Unicode characters may hide the true origin of a page, leading to potential spoofing attacks. - Reference: Bug 1952213 5. CVE-2025-3033: Opening a local .url file may cause another file to be opened - Reporter: Ameen Basha M K - Severity: Low - Description: On Windows, clicking a malicious .url shortcut may result in an unintended file being opened. This vulnerability affects only Thunderbird on Windows; other operating systems are unaffected. - Reference: Bug 1958056 6. CVE-2025-3030: Memory safety bugs in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9 - Reporter: Sylvestre Ledru, Paul Bone, and Mozilla Fuzzing Team - Severity: High - Description: Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs show evidence of memory corruption, and we assume that with sufficient effort, some could be exploited to execute arbitrary code. - Reference: Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9 7. CVE-2025-3034: Memory safety bugs in Firefox 137 and Thunderbird 137 - Reporter: Andrew McCreight and Mozilla Fuzzing Team - Severity: High - Description: Memory safety bugs present in Firefox 136 and Thunderbird 136. Some of these bugs show evidence of memory corruption, and we assume that with sufficient effort, some could be exploited to execute arbitrary code. - Reference: Memory safety bugs fixed in Firefox 137 and Thunderbird 137

Goal Reached Thanks to every supporter — we hit 100%!

Thunderbird 137 Security Update: Fixes 7 Vulnerabilities including CVE-2025-3028 UAF