CVE-2025-1012 Affecting thunderbird package, versions *
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-DEBIAN11-THUNDERBIRD-8688087
- published5 Feb 2025
- disclosed4 Feb 2025
Introduced: 4 Feb 2025
NewCVE-2025-1012 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
How to fix?
There is no fixed version for Debian:11 thunderbird.
NVD Description
Note: Versions mentioned in the description apply only to the upstream thunderbird package and not the thunderbird package as distributed by Debian.
See How to fix? for Debian:11 relevant fixed versions and status.
A race during concurrent delazification could have led to a use-after-free. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
References
- https://security-tracker.debian.org/tracker/CVE-2025-1012
- https://bugzilla.mozilla.org/show_bug.cgi?id=1939710
- https://www.mozilla.org/security/advisories/mfsa2025-07/
- https://www.mozilla.org/security/advisories/mfsa2025-08/
- https://www.mozilla.org/security/advisories/mfsa2025-09/
- https://www.mozilla.org/security/advisories/mfsa2025-10/
- https://www.mozilla.org/security/advisories/mfsa2025-11/