Thunderbird 140 Security Update: Fixes 10 CVEs including RCE and Memory Corruption

Critical Vulnerability Information Vulnerability Overview Announcement Date: May 27, 2025 Impact: Critical Product: Thunderbird 139 Fixed Version: Thunderbird 140 Specific Vulnerability Details 1. CVE-2025-5262: Double Free in libvpx Encoder - Reporter: Randall Jesup - Impact: Critical - Description: A double-free issue exists in the function of libvpx when initialization of the WebM decoder fails. This could lead to memory corruption and potentially exploitable crashes. 2. CVE-2025-5263: Script Execution Error Handling Fails to Properly Isolate Web Content - Reporter: Jingyang - Impact: Moderate - Description: Script execution error handling does not properly isolate web content, potentially enabling unauthorized disclosure attacks. 3. CVE-2025-5264: Potential Local Code Execution in "Copy as cURL" Command - Reporter: Ameer Basha M K - Impact: Moderate - Description: Due to insufficient escaping of command-line objects in the "Copy as cURL" feature, attackers could trick users into using this command, leading to local code execution on the user’s system. 4. CVE-2025-5265: Potential Local Code Execution in "Copy as cURL" Command - Reporter: Ameer Basha M K - Impact: Moderate - Description: Due to insufficient escaping of newline characters in the "Copy as cURL" feature, attackers could trick users into using this command, leading to local code execution on the user’s system. 5. CVE-2025-5266: Script Element Events Leak Cross-Origin Resource Status - Reporter: Jakub Szymaszek - Impact: Moderate - Description: Script elements referencing cross-origin resources generate local errors and error events, which may leak information and trigger XSS attacks. 6. CVE-2025-5270: SNI Sometimes Sent Unencrypted - Reporter: shihui - Impact: Low - Description: In some cases, SNI may be sent unencrypted even when encrypted SNI is enabled. 7. CVE-2025-5271: Devtools Preview Ignores CSP Headers - Reporter: Satoko Hagi - Impact: Low - Description: Devtools ignores CSP headers during response preview, potentially enabling content injection attacks. 8. CVE-2025-5267: Clickjacking Vulnerability May Lead to Exposure of Saved Payment Card Details - Reporter: Ameer Basha M K - Impact: Low - Description: A clickjacking vulnerability could be exploited to trick users into revealing saved payment card details on malicious pages. 9. CVE-2025-5268: Memory Safety Vulnerabilities Fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11 - Reporter: Mozilla Fuzzing Team, Andrew Clements - Impact: Moderate - Description: Memory safety vulnerabilities present in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11 show evidence of memory corruption, and some may have been exploited to execute arbitrary code with sufficient effort. 10. CVE-2025-5272: Memory Safety Vulnerabilities Fixed in Firefox 139 and Thunderbird 139 - Reporter: Mozilla Fuzzing Team, Andrew Clements - Impact: Moderate - Description: Memory safety vulnerabilities present in Firefox 139 and Thunderbird 139.

Goal Reached Thanks to every supporter — we hit 100%!

Thunderbird 140 Security Update: Fixes 10 CVEs including RCE and Memory Corruption