PT-2025-4128 · Mozilla+10 · Thunderbird+10
R3M0T3Nu11
·
Published
2025-02-04
·
Updated
2025-10-08
·
CVE-2025-1015
CVSS v2.0
6.4
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Thunderbird versions prior to 128.7
Description
The Thunderbird Address Book URI fields contained unsanitized links, which could be used by an attacker to create and export an address book containing a malicious payload in a field, such as the "Other" field of the Instant Messaging section. If another user imported the address book, clicking on the link could result in opening a web page inside Thunderbird, and that page could execute unprivileged JavaScript.
Recommendations
For Thunderbird versions prior to 128.7, update to version 128.7 or later to resolve the issue. As a temporary workaround, consider avoiding the import of address books from untrusted sources to minimize the risk of exploitation. Restrict access to the Address Book URI fields to prevent the creation and export of malicious address books.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Thunderbird
Ubuntu