PT-2025-30485 · Mozilla+4 · Thunderbird+4

Viktor Bocz · Published 2025-07-22 · Updated 2026-02-02 · CVE-2025-8036

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 141 Thunderbird versions prior to 140.1

Description Thunderbird cached Cross-Origin Resource Sharing (CORS) preflight responses across IP address changes, which allowed bypassing CORS protections with DNS rebinding. DNS rebinding is a security risk that occurs when a DNS server returns different IP addresses for the same domain name, potentially allowing an attacker to bypass security restrictions.

Recommendations Update Thunderbird to version 141 or later. Update Thunderbird to version 140.1 or later.

Fix

Weakness Enumeration

CWE-350

Related Identifiers

ALT-PU-2025-10124

ALT-PU-2025-11495

ALT-PU-2025-11497

ALT-PU-2025-9988

BDU:2025-09460

CVE-2025-8036

OESA-2025-2340

OESA-2025-2341

OESA-2025-2359

OESA-2025-2360

OESA-2025-2361

OPENSUSE-SU-2025:15371-1

OPENSUSE-SU-2025:15383-1

OPENSUSE-SU-2025:15386-1

SUSE-SU-2025:02529-1

SUSE-SU-2025:02531-1

SUSE-SU-2025:02546-1

SUSE-SU-2025_02529-1

SUSE-SU-2025_02531-1

USN-7991-1

Affected Products

Alt Linux

Linuxmint

Suse

Thunderbird

Ubuntu

References · 207

• https://ubuntu.com/security/CVE-2025-13015 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-0887 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11711 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10533 · Security Note
• https://ubuntu.com/security/CVE-2026-0891 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-14328 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2025-61 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15383-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2359 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-8039 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02529-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11715 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-8038 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2340 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-6434 · Vendor Advisory