thunderbird vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the thunderbird package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Use After Free	<0:128.11.0-1.el9_6
H CVE-2025-5269	<0:128.11.0-1.el9_6
H CVE-2025-5268	<0:128.11.0-1.el9_6
H CVE-2025-5267	<0:128.11.0-1.el9_6
H CVE-2025-5266	<0:128.11.0-1.el9_6
H CVE-2025-5264	<0:128.11.0-1.el9_6
H CVE-2025-5263	<0:128.11.0-1.el9_6
H CVE-2025-4919	<0:128.11.0-1.el9_6
H CVE-2025-4918	<0:128.11.0-1.el9_6
H CVE-2025-10537	<0:140.3.0-1.el9_6
H CVE-2025-10536	<0:140.3.0-1.el9_6
H CVE-2025-10533	<0:140.3.0-1.el9_6
H CVE-2025-10532	<0:140.3.0-1.el9_6
H CVE-2025-10529	<0:140.3.0-1.el9_6
H CVE-2025-10528	<0:140.3.0-1.el9_6
H CVE-2025-10527	<0:140.3.0-1.el9_6
H CVE-2025-6430	<0:128.12.0-1.el9_6
H CVE-2025-6429	<0:128.12.0-1.el9_6
H CVE-2025-6425	<0:128.12.0-1.el9_6
H CVE-2025-6424	<0:128.12.0-1.el9_6
H CVE-2025-5986	<0:128.12.0-1.el9_6
H CVE-2025-3932	<0:128.10.1-1.el9_6
H CVE-2025-3909	<0:128.10.1-1.el9_6
H CVE-2025-3877	<0:128.10.1-1.el9_6
H CVE-2025-3875	<0:128.10.1-1.el9_6
H CVE-2025-8035	<0:128.13.0-3.el9_6
H CVE-2025-8034	<0:128.13.0-3.el9_6
H CVE-2025-8033	<0:128.13.0-3.el9_6
H CVE-2025-8032	<0:128.13.0-3.el9_6
H CVE-2025-8031	<0:128.13.0-3.el9_6
H CVE-2025-8030	<0:128.13.0-3.el9_6
H CVE-2025-8029	<0:128.13.0-3.el9_6
H CVE-2025-8028	<0:128.13.0-3.el9_6
H CVE-2025-8027	<0:128.13.0-3.el9_6
H CVE-2025-9185	<0:128.14.0-3.el9_6
H CVE-2025-9182	<0:128.14.0-3.el9_6
H CVE-2025-9181	<0:128.14.0-3.el9_6
H CVE-2025-9180	<0:128.14.0-3.el9_6
H CVE-2025-9179	<0:128.14.0-3.el9_6
H CVE-2025-3523	<0:128.10.0-1.el9_5
H CVE-2025-3522	<0:128.10.0-1.el9_5
H CVE-2025-2830	<0:128.10.0-1.el9_5
H CVE-2025-4093	<0:128.10.0-1.el9_5
H CVE-2025-4091	<0:128.10.0-1.el9_5
H CVE-2025-4087	<0:128.10.0-1.el9_5
H CVE-2025-4083	<0:128.10.0-1.el9_5
H CVE-2025-2817	<0:128.10.0-1.el9_5
M Out-of-bounds Write	<0:128.4.0-1.el9_4
M CVE-2024-10466	<0:128.4.0-1.el9_4
M Authentication Bypass	<0:128.4.0-1.el9_4
M Out-of-bounds Read	<0:128.4.0-1.el9_4
M Information Exposure	<0:128.4.0-1.el9_4
M Authentication Bypass	<0:128.4.0-1.el9_4
M Cross-site Scripting (XSS)	<0:128.4.0-1.el9_4
M CVE-2024-10460	<0:128.4.0-1.el9_4
M Use After Free	<0:128.4.0-1.el9_4
M CVE-2024-10458	<0:128.4.0-1.el9_4
H Use After Free	<0:128.3.1-1.el9_4
H Use After Free	<0:128.2.0-1.el9_4.0.1
H Out-of-bounds Write	<0:128.2.0-1.el9_4.0.1
H Open Redirect	<0:128.2.0-1.el9_4.0.1
H Access of Resource Using Incompatible Type ('Type Confusion')	<0:128.2.0-1.el9_4.0.1
H Out-of-bounds Write	<0:128.2.0-1.el9_4.0.1
H CVE-2024-8382	<0:128.2.0-1.el9_4.0.1
H Access of Resource Using Incompatible Type ('Type Confusion')	<0:128.2.0-1.el9_4.0.1
H CVE-2024-7652	<0:128.2.0-1.el9_4.0.1
H CVE-2024-6604	<0:115.13.0-3.el9_4
H CVE-2024-6603	<0:115.13.0-3.el9_4
H CVE-2024-6601	<0:115.13.0-3.el9_4
H CVE-2024-5702	<0:115.12.1-1.el9_4
H CVE-2024-5700	<0:115.12.1-1.el9_4
H CVE-2024-5696	<0:115.12.1-1.el9_4
H CVE-2024-5693	<0:115.12.1-1.el9_4
H CVE-2024-5691	<0:115.12.1-1.el9_4
H Information Exposure	<0:115.12.1-1.el9_4
H CVE-2024-5688	<0:115.12.1-1.el9_4
H Out-of-bounds Write	<0:115.11.0-1.el9_4
H CVE-2024-4770	<0:115.11.0-1.el9_4
H CVE-2024-4769	<0:115.11.0-1.el9_4
H CVE-2024-4768	<0:115.11.0-1.el9_4
H Incomplete Cleanup	<0:115.11.0-1.el9_4
H CVE-2024-4367	<0:115.11.0-1.el9_4
L Allocation of Resources Without Limits or Throttling	<0:115.10.0-2.el9_3
H Out-of-bounds Write	<0:115.3.1-1.el9_2
H Out-of-bounds Write	<0:115.3.1-1.el9_2
H Use After Free	<0:115.3.1-1.el9_2
H Out-of-bounds Write	<0:115.3.1-1.el9_2
H Use After Free	<0:115.3.1-1.el9_2
H Out-of-bounds Write	<0:102.14.0-1.el9_2
H Out-of-bounds Write	<0:102.14.0-1.el9_2
H CVE-2023-4055	<0:102.14.0-1.el9_2
H Out-of-bounds Write	<0:102.14.0-1.el9_2
H Race Condition	<0:102.14.0-1.el9_2
H Out-of-bounds Read	<0:102.14.0-1.el9_2
H CVE-2023-4047	<0:102.14.0-1.el9_2
H CVE-2023-4046	<0:102.14.0-1.el9_2
H Origin Validation Error	<0:102.14.0-1.el9_2
H CVE-2023-3417	<0:102.14.0-1.el9_2
H Out-of-bounds Write	<0:102.12.0-1.el9_2
H Improper Certificate Validation	<0:102.12.0-1.el9_2
H CVE-2023-29550	<0:102.10.0-2.el9_1
H CVE-2023-29548	<0:102.10.0-2.el9_1
H Improper Encoding or Escaping of Output	<0:102.10.0-2.el9_1
H NULL Pointer Dereference	<0:102.10.0-2.el9_1
H Use After Free	<0:102.10.0-2.el9_1
H CVE-2023-29535	<0:102.10.0-2.el9_1
H CVE-2023-29533	<0:102.10.0-2.el9_1
H Resource Exhaustion	<0:102.10.0-2.el9_1
H Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')	<0:102.10.0-2.el9_1
H Out-of-bounds Write	<0:102.10.0-2.el9_1
H Improper Certificate Validation	<0:102.10.0-2.el9_1
H Out-of-bounds Write	<0:102.9.0-1.el9_1
H CVE-2023-28164	<0:102.9.0-1.el9_1
H Incorrect Type Conversion or Cast	<0:102.9.0-1.el9_1
H CVE-2023-25752	<0:102.9.0-1.el9_1
H CVE-2023-25751	<0:102.9.0-1.el9_1
H Resource Exhaustion	<0:102.8.0-2.el9_1
H Out-of-bounds Write	<0:102.8.0-2.el9_1
H Out-of-bounds Write	<0:102.8.0-2.el9_1
H Authentication Bypass	<0:102.8.0-2.el9_1
H CVE-2023-25742	<0:102.8.0-2.el9_1
H Use After Free	<0:102.8.0-2.el9_1
H CVE-2023-25737	<0:102.8.0-2.el9_1
H Use After Free	<0:102.8.0-2.el9_1
H Out-of-bounds Write	<0:102.8.0-2.el9_1
H CVE-2023-25730	<0:102.8.0-2.el9_1
H CVE-2023-25729	<0:102.8.0-2.el9_1
H CVE-2023-25728	<0:102.8.0-2.el9_1
H CVE-2023-0767	<0:102.8.0-2.el9_1
H Improper Certificate Validation	<0:102.7.1-2.el9_1
H Out-of-bounds Write	<0:102.7.1-1.el9_1
H CVE-2023-23603	<0:102.7.1-1.el9_1
H Improper Check for Unusual or Exceptional Conditions	<0:102.7.1-1.el9_1
H Origin Validation Error	<0:102.7.1-1.el9_1
H Improper Encoding or Escaping of Output	<0:102.7.1-1.el9_1
H CVE-2023-23598	<0:102.7.1-1.el9_1
H CVE-2022-46877	<0:102.7.1-1.el9_1
H CVE-2022-46871	<0:102.7.1-1.el9_1

Vulnerability

Vulnerable Version

<0:128.11.0-1.el9_6

<0:128.11.0-1.el9_6

<0:128.11.0-1.el9_6

<0:128.11.0-1.el9_6

<0:128.11.0-1.el9_6

<0:128.11.0-1.el9_6

<0:128.11.0-1.el9_6

<0:128.11.0-1.el9_6

<0:128.11.0-1.el9_6

<0:140.3.0-1.el9_6

<0:140.3.0-1.el9_6

<0:140.3.0-1.el9_6

<0:140.3.0-1.el9_6

<0:140.3.0-1.el9_6

<0:140.3.0-1.el9_6

<0:140.3.0-1.el9_6

<0:128.12.0-1.el9_6

<0:128.12.0-1.el9_6

<0:128.12.0-1.el9_6

<0:128.12.0-1.el9_6

<0:128.12.0-1.el9_6

<0:128.10.1-1.el9_6

<0:128.10.1-1.el9_6

<0:128.10.1-1.el9_6

<0:128.10.1-1.el9_6

<0:128.13.0-3.el9_6

<0:128.13.0-3.el9_6

<0:128.13.0-3.el9_6

<0:128.13.0-3.el9_6

<0:128.13.0-3.el9_6

<0:128.13.0-3.el9_6

<0:128.13.0-3.el9_6

<0:128.13.0-3.el9_6

<0:128.13.0-3.el9_6

<0:128.14.0-3.el9_6

<0:128.14.0-3.el9_6

<0:128.14.0-3.el9_6

<0:128.14.0-3.el9_6

<0:128.14.0-3.el9_6

<0:128.10.0-1.el9_5

<0:128.10.0-1.el9_5

<0:128.10.0-1.el9_5

<0:128.10.0-1.el9_5

<0:128.10.0-1.el9_5

<0:128.10.0-1.el9_5

<0:128.10.0-1.el9_5

<0:128.10.0-1.el9_5

<0:128.4.0-1.el9_4

<0:128.4.0-1.el9_4

Authentication Bypass

<0:128.4.0-1.el9_4

Out-of-bounds Read

<0:128.4.0-1.el9_4

Information Exposure

<0:128.4.0-1.el9_4

Authentication Bypass

<0:128.4.0-1.el9_4

Cross-site Scripting (XSS)

<0:128.4.0-1.el9_4

<0:128.4.0-1.el9_4

<0:128.4.0-1.el9_4

<0:128.4.0-1.el9_4

<0:128.3.1-1.el9_4

<0:128.2.0-1.el9_4.0.1

Out-of-bounds Write

<0:128.2.0-1.el9_4.0.1

Open Redirect

<0:128.2.0-1.el9_4.0.1

Access of Resource Using Incompatible Type ('Type Confusion')

<0:128.2.0-1.el9_4.0.1

Out-of-bounds Write

<0:128.2.0-1.el9_4.0.1

CVE-2024-8382

<0:128.2.0-1.el9_4.0.1

Access of Resource Using Incompatible Type ('Type Confusion')

<0:128.2.0-1.el9_4.0.1

CVE-2024-7652

<0:128.2.0-1.el9_4.0.1

<0:115.13.0-3.el9_4

<0:115.13.0-3.el9_4

<0:115.13.0-3.el9_4

<0:115.12.1-1.el9_4

<0:115.12.1-1.el9_4

<0:115.12.1-1.el9_4

<0:115.12.1-1.el9_4

<0:115.12.1-1.el9_4

<0:115.12.1-1.el9_4

<0:115.12.1-1.el9_4

<0:115.11.0-1.el9_4

<0:115.11.0-1.el9_4

<0:115.11.0-1.el9_4

<0:115.11.0-1.el9_4

<0:115.11.0-1.el9_4

<0:115.11.0-1.el9_4

Allocation of Resources Without Limits or Throttling

<0:115.10.0-2.el9_3

<0:115.3.1-1.el9_2

<0:115.3.1-1.el9_2

<0:115.3.1-1.el9_2

<0:115.3.1-1.el9_2

<0:115.3.1-1.el9_2

<0:102.14.0-1.el9_2

<0:102.14.0-1.el9_2

<0:102.14.0-1.el9_2

<0:102.14.0-1.el9_2

<0:102.14.0-1.el9_2

<0:102.14.0-1.el9_2

<0:102.14.0-1.el9_2

<0:102.14.0-1.el9_2

Origin Validation Error

<0:102.14.0-1.el9_2

CVE-2023-3417

<0:102.14.0-1.el9_2

Out-of-bounds Write

<0:102.12.0-1.el9_2

Improper Certificate Validation

<0:102.12.0-1.el9_2

CVE-2023-29550

<0:102.10.0-2.el9_1

CVE-2023-29548

<0:102.10.0-2.el9_1

Improper Encoding or Escaping of Output

<0:102.10.0-2.el9_1

NULL Pointer Dereference

<0:102.10.0-2.el9_1

<0:102.10.0-2.el9_1

<0:102.10.0-2.el9_1

<0:102.10.0-2.el9_1

<0:102.10.0-2.el9_1

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

<0:102.10.0-2.el9_1

Out-of-bounds Write

<0:102.10.0-2.el9_1

Improper Certificate Validation

<0:102.10.0-2.el9_1

Out-of-bounds Write

<0:102.9.0-1.el9_1

CVE-2023-28164

<0:102.9.0-1.el9_1

Incorrect Type Conversion or Cast

<0:102.9.0-1.el9_1

<0:102.9.0-1.el9_1

<0:102.9.0-1.el9_1

<0:102.8.0-2.el9_1

<0:102.8.0-2.el9_1

<0:102.8.0-2.el9_1

Authentication Bypass

<0:102.8.0-2.el9_1

<0:102.8.0-2.el9_1

<0:102.8.0-2.el9_1

<0:102.8.0-2.el9_1

<0:102.8.0-2.el9_1

<0:102.8.0-2.el9_1

<0:102.8.0-2.el9_1

<0:102.8.0-2.el9_1

<0:102.8.0-2.el9_1

<0:102.8.0-2.el9_1

Improper Certificate Validation

<0:102.7.1-2.el9_1

Out-of-bounds Write

<0:102.7.1-1.el9_1

CVE-2023-23603

<0:102.7.1-1.el9_1

Improper Check for Unusual or Exceptional Conditions

<0:102.7.1-1.el9_1

Origin Validation Error

<0:102.7.1-1.el9_1

Improper Encoding or Escaping of Output

<0:102.7.1-1.el9_1

CVE-2023-23598

<0:102.7.1-1.el9_1

CVE-2022-46877

<0:102.7.1-1.el9_1

CVE-2022-46871

<0:102.7.1-1.el9_1