fkie_cve-2025-4083
Vulnerability from fkie_nvd
Published
2025-04-29 14:15
Modified
2025-05-09 19:33
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Summary
A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Firefox ESR < 115.23, Thunderbird < 138, and Thunderbird < 128.10.
References
security@mozilla.orghttps://bugzilla.mozilla.org/show_bug.cgi?id=1958350Permissions Required
security@mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2025-28/Vendor Advisory
security@mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2025-29/Vendor Advisory
security@mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2025-30/Vendor Advisory
security@mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2025-31/Vendor Advisory
security@mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2025-32/Vendor Advisory
Impacted products
Vendor Product Version
mozilla firefox *
mozilla firefox *
mozilla firefox *
mozilla thunderbird *
mozilla thunderbird *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
              "matchCriteriaId": "C120A37E-1333-4278-9527-4F370BC78EA8",
              "versionEndExcluding": "115.23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*",
              "matchCriteriaId": "EB8A8C7B-B65D-4DF5-BDB5-0C3C4E2DB72C",
              "versionEndExcluding": "138.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
              "matchCriteriaId": "78457AB7-7F72-41FA-99F5-EE6D2B2AC9F9",
              "versionEndExcluding": "128.10",
              "versionStartIncluding": "128.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*",
              "matchCriteriaId": "DC19822B-CC07-4C6F-BAAD-C7A9C4E73FA9",
              "versionEndExcluding": "128.10.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*",
              "matchCriteriaId": "D1E8CCF1-4E91-44CC-A652-B23D1337A485",
              "versionEndExcluding": "138.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document\u0027s process instead of the intended frame, potentially enabling a sandbox escape. This vulnerability affects Firefox \u003c 138, Firefox ESR \u003c 128.10, Firefox ESR \u003c 115.23, Thunderbird \u003c 138, and Thunderbird \u003c 128.10."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de aislamiento de procesos en Firefox se origin\u00f3 debido a una gesti\u00f3n inadecuada de las URI de JavaScript, lo que podr\u00eda permitir que el contenido se ejecutara en el proceso del documento de nivel superior en lugar del marco previsto, lo que podr\u00eda habilitar un escape de la zona protegida. Esta vulnerabilidad afecta a Firefox \u0026lt; 138, Firefox ESR \u0026lt; 128.10, Firefox ESR \u0026lt; 115.23, Thunderbird \u0026lt; 138 y Thunderbird ESR \u0026lt; 128.10."
    }
  ],
  "id": "CVE-2025-4083",
  "lastModified": "2025-05-09T19:33:33.723",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-04-29T14:15:35.003",
  "references": [
    {
      "source": "security@mozilla.org",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1958350"
    },
    {
      "source": "security@mozilla.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-28/"
    },
    {
      "source": "security@mozilla.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-29/"
    },
    {
      "source": "security@mozilla.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-30/"
    },
    {
      "source": "security@mozilla.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-31/"
    },
    {
      "source": "security@mozilla.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-32/"
    }
  ],
  "sourceIdentifier": "security@mozilla.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-653"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.