PT-2025-16349 · Mozilla+11 · Thunderbird+11
Dario Weißer
·
Publicado
2025-04-15
·
Atualizado
2025-07-22
·
CVE-2025-2830
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Thunderbird versions prior to 137.0.2
Thunderbird versions prior to 128.9.2
Description
The issue allows an attacker to disclose sensitive information from the victim's system by crafting a malformed file name for an attachment in a multipart message, tricking Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This behavior is not limited to Linux and has also been observed on Windows.
Recommendations
For versions prior to 137.0.2, update to version 137.0.2 or later.
For versions prior to 128.9.2, update to version 128.9.2 or later.
As a temporary workaround, consider avoiding the use of malformed file names for attachments in multipart messages until a patch is available.
Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Thunderbird
Ubuntu