红帽产品勘误 RHSA-2025:17345 - Security Advisory
发布：
2025-10-06
已更新：
2025-10-06

RHSA-2025:17345 - Security Advisory

概述

Important: thunderbird security update

类型/严重性

Security Advisory: Important

Red Hat Insights 补丁分析

识别并修复受此公告影响的系统。

查看受影响的系统

标题

An update for thunderbird is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

描述

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: thunderbird: Sandbox escape due to use-after-free in the Graphics: Canvas2D component (CVE-2025-10527)
  • firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component (CVE-2025-10532)
  • firefox: thunderbird: Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component (CVE-2025-10528)
  • firefox: thunderbird: Same-origin policy bypass in the Layout component (CVE-2025-10529)
  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143 (CVE-2025-10537)
  • firefox: thunderbird: Information disclosure in the Networking: Cache component (CVE-2025-10536)
  • firefox: thunderbird: Integer overflow in the SVG component (CVE-2025-10533)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

解决方案

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

受影响的产品

  • Red Hat Enterprise Linux Server - AUS 9.2 x86_64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x

修复

  • BZ - 2395745 - CVE-2025-10527 firefox: thunderbird: Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  • BZ - 2395754 - CVE-2025-10532 firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component
  • BZ - 2395755 - CVE-2025-10528 firefox: thunderbird: Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component
  • BZ - 2395756 - CVE-2025-10529 firefox: thunderbird: Same-origin policy bypass in the Layout component
  • BZ - 2395759 - CVE-2025-10537 firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143
  • BZ - 2395764 - CVE-2025-10536 firefox: thunderbird: Information disclosure in the Networking: Cache component
  • BZ - 2395766 - CVE-2025-10533 firefox: thunderbird: Integer overflow in the SVG component

Red Hat Enterprise Linux Server - AUS 9.2

SRPM
thunderbird-140.3.0-1.el9_2.src.rpm SHA-256: 059a883e847c63d2d4b875a1e15b8eeece7878a55278f7adedebf69db76dd766
x86_64
thunderbird-140.3.0-1.el9_2.x86_64.rpm SHA-256: 2736c5792878a2e8a5d918ab12131cd61045ef61f35d1586f39a65c3f3bff119
thunderbird-debuginfo-140.3.0-1.el9_2.x86_64.rpm SHA-256: f1fd729a58af2b71e5643aae10f1db5e351577262415851473df4260c403f2f5
thunderbird-debugsource-140.3.0-1.el9_2.x86_64.rpm SHA-256: 3cbece38d05457882cc2ca6065758fc79d42d2cb7bc6f864dd77e6a178e802a3

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2

SRPM
thunderbird-140.3.0-1.el9_2.src.rpm SHA-256: 059a883e847c63d2d4b875a1e15b8eeece7878a55278f7adedebf69db76dd766
ppc64le
thunderbird-140.3.0-1.el9_2.ppc64le.rpm SHA-256: 870f9bfd235c469190a20108cd8cad431ba7c9fe11de1e081d10eb8eddfd6524
thunderbird-debuginfo-140.3.0-1.el9_2.ppc64le.rpm SHA-256: 5c610e54813cf440e8ab7db1b17ab39b76ab136855da94115eeb81e051ade491
thunderbird-debugsource-140.3.0-1.el9_2.ppc64le.rpm SHA-256: 6b17ad557ec7306da670895a7141e7ba6e1f951672d8fd28ef0a15d3b9ccccd7

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2

SRPM
thunderbird-140.3.0-1.el9_2.src.rpm SHA-256: 059a883e847c63d2d4b875a1e15b8eeece7878a55278f7adedebf69db76dd766
x86_64
thunderbird-140.3.0-1.el9_2.x86_64.rpm SHA-256: 2736c5792878a2e8a5d918ab12131cd61045ef61f35d1586f39a65c3f3bff119
thunderbird-debuginfo-140.3.0-1.el9_2.x86_64.rpm SHA-256: f1fd729a58af2b71e5643aae10f1db5e351577262415851473df4260c403f2f5
thunderbird-debugsource-140.3.0-1.el9_2.x86_64.rpm SHA-256: 3cbece38d05457882cc2ca6065758fc79d42d2cb7bc6f864dd77e6a178e802a3

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2

SRPM
thunderbird-140.3.0-1.el9_2.src.rpm SHA-256: 059a883e847c63d2d4b875a1e15b8eeece7878a55278f7adedebf69db76dd766
aarch64
thunderbird-140.3.0-1.el9_2.aarch64.rpm SHA-256: a29f5271ba5ca4f29fa27abe14648748303d572a0d8fda5aab98f3917dcbec5d
thunderbird-debuginfo-140.3.0-1.el9_2.aarch64.rpm SHA-256: 33a9bb40db941e95d0c2105c36744e339a26a4a3e7dfb2d8779d705e37bbeee3
thunderbird-debugsource-140.3.0-1.el9_2.aarch64.rpm SHA-256: 43a1de4089df5685ed00f0a29620ba3fa1011615a411e75dbeacafd44673a920

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2

SRPM
thunderbird-140.3.0-1.el9_2.src.rpm SHA-256: 059a883e847c63d2d4b875a1e15b8eeece7878a55278f7adedebf69db76dd766
s390x
thunderbird-140.3.0-1.el9_2.s390x.rpm SHA-256: 27e0a9ff7628f8711fa8c5a00fb640997af25c89a257354074bc198f2cd6163f
thunderbird-debuginfo-140.3.0-1.el9_2.s390x.rpm SHA-256: 020245deddf4b59d3213f0530288a262c0cdda1dec5275fc8dc928b4d3caaba6
thunderbird-debugsource-140.3.0-1.el9_2.s390x.rpm SHA-256: ec9d49dd346ba21c15d00530d4430bc9a3b1e2f12288bc913cb207eff8b43156

Red Hat 安全团队联络方式为 secalert@redhat.com。 更多联络细节请参考 https://access.redhat.com/security/team/contact/。