CVE-2025-3909

Katalog CVE

CVSS 8.1 · High EPSS 0,47%

Kerentanan Product UI does not Warn User of Unsafe Actions pada mozilla thunderbird. Skor CVSS 3.1 8.1 (High) menurut CISA ADP.

Deskripsi (NVD)

Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment (message/rfc822) and setting its content type to application/pdf, Thunderbird may incorrectly render it as HTML when opened, allowing the embedded JavaScript to run without requiring a file download. This behavior relies on Thunderbird auto-saving the attachment to /tmp and linking to it via the file:/// protocol, potentially enabling JavaScript execution as part of the HTML. This vulnerability was fixed in Thunderbird 128.10.1 and Thunderbird 138.0.1.

Rincian

Terbit di NVD

14 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-356: Product UI does not Warn User of Unsafe Actions

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 38,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.mozilla.org/security/advisories/mfsa2025-34/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2025-35/ advisory vendor
• https://bugzilla.mozilla.org/show_bug.cgi?id=1958376 permissions required
• https://lists.debian.org/debian-lts-announce/2025/05/msg00022.html