Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component (CVE-2025-9182)
* thunderbird: firefox: Sandbox escape due to invalid pointer in the Audio/Video: GMP component (CVE-2025-9179)
* thunderbird: firefox: Same-origin policy bypass in the Graphics: Canvas2D component (CVE-2025-9180)
* thunderbird: firefox: Uninitialized memory in the JavaScript Engine component (CVE-2025-9181)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 (CVE-2025-9185)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A new phishing campaign has been observed leveraging a .gov domain to deceive employees into believing they owe an unpaid toll. The scam uses urgency and fear tactics, threatening penalties or vehicle registration holds if the balance is not paid immediately. The threat actors utilize the GovDelivery system to increase legitimacy, despite using Indiana's instance for a Texas-related scam. The phishing link leads to a fake website that collects personal information and credit card details. The campaign exploits fear of consequences and mimics a well-known service, highlighting the importance of integrating human expertise into email security processes to identify threats that bypass conventional malicious indicators.
A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Meeting Room Booking System v1.0 allows attackers to send an excessive amount of email for a legitimate user, leading to a possible Denial of Service (DoS) via a large amount of generated e-mail messages.
Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in the browser (CVE-2024-10464)
* firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response (CVE-2024-10461)
* firefox: thunderbird: Permission leak via embed or object elements (CVE-2024-10458)
* firefox: thunderbird: Use-after-free in layout with accessibility (CVE-2024-10459)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4 (CVE-2024-10467)
* firefox: thunderbird: Clipboard "paste" button persisted across tabs (CVE-2024-10465)
* firefox: DOM push subscription message could hang Firefox (CVE-2024-10466)
* firefox: thunderbird: Cross origin video frame leak (CVE-2024-10463)
* firefox: thunderbird: Origin of permission prompt could be spoofed by long URL (CVE-2024-10462)
* firefox: thunderbird: Confusing display of origin for external protocol handler prompt (CVE-2024-10460)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Mozilla Thunderbird is a standalone mail and newsgroup client.
* thunderbird: 115.16/128.3 ()
* firefox: thunderbird: Specially crafted WebTransport requests could lead
to denial of service (CVE-2024-9399)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 131 and
Thunderbird 131 (CVE-2024-9403)
* firefox: thunderbird: Potential directory upload bypass via clickjacking
(CVE-2024-9397)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 131, Firefox
ESR 115.16, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
(CVE-2024-9401)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 131, Firefox
ESR 128.3, Thunderbird 131, and Thunderbird 128.3 (CVE-2024-9402)
* firefox: thunderbird: External protocol handlers could be enumerated via
popups (CVE-2024-9398)
* firefox: thunderbird: Potential memory corruption during JIT compilation
(CVE-2024-9400)
* firefox: thunderbird: Potential memory corruption may occur when cloning
certain objects (CVE-2024-9396)
* firefox: thunderbird: Cross-origin access to PDF contents through
multipart responses (CVE-2024-9393)
* firefox: thunderbird: Cross-origin access to JSON contents through
multipart responses (CVE-2024-9394)
* firefox: thunderbird: Compromised content process can bypass site
isolation (CVE-2024-9392)
* firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill)
(CVE-2024-9680)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Release of RHACS 4.5 provides these changes:
New features:
* Scanner V4 is generally available
* Vulnerability Management 2.0 is generally available
* Compliance updates
* Built-in email notifier in RHACS Cloud Service
* roxctl installation GitHub action
* Bring your own PKI for signature verification
* Build-time network policy tools updates
* Enhanced RHACS Cloud Service experience
This releases updates the following items to patch vulnerabilities:
* (CVE-2024-28849) The `follow-redirect` module was updated to 1.15.6.
* (CVE-2024-29903) Updated `cosign` to 2.2.4.
* (CVE-2024-29902) Updated `cosign` to 2.2.4.
For more information on new features and other details, see https://docs.openshift.com/acs/4.5/release_notes/45-release-notes.html.
