CVE-2025-3875

Publication date 14 May 2025

Last updated 16 April 2026

Ubuntu priority

Cvss 3 Severity Score

Description

Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats spoofed@example.com as the actual address. This vulnerability was fixed in Thunderbird 128.10.1 and Thunderbird 138.0.1.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
thunderbird	25.04 plucky	Not affected
	24.10 oracular	Ignored end of life, was needs-triage
	24.04 LTS noble	Not affected
	22.04 LTS jammy	Fixed 1:128.12.0+build1-0ubuntu0.22.04.1
	20.04 LTS focal	Not in release

Severity score breakdown

Parameter	Value
Base score	7.5 · High
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	None
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Related Ubuntu Security Notices (USN)

USN-7663-1
Thunderbird vulnerabilities
22 July 2025