CVE-2025-2817 json
Privilege escalation in Thunderbird Updater
published 2025-04-29 18 mo ago modified 2026-10-05 34 d ago also EUVD-2025-12689
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations on paths controlled by a non-privileged user and enabling privilege escalation. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, and Thunderbird 128.10.
Patch / fix
- mozilla firefox 115.23, 128.10, 138
- mozilla firefox_esr 115.23, 128.10, 138
- mozilla thunderbird 128.10, 138
- mozilla thunderbird_esr 128.10, 138
- thunderbird RHEL 10.0 128.10.0-1.el10_0
- firefox RHEL 10.0 128.10.0-1.el10_0
- firefox RHEL 9 128.10.0-1.el9_6
- firefox-x11 RHEL 9 128.10.0-1.el9_6
- thunderbird RHEL 8 128.10.0-1.el8_10
- thunderbird RHEL 9 128.10.0-1.el9_5
- firefox RHEL 8 128.10.0-1.el8_10
- firefox RHEL 9 128.10.0-1.el9_5
red hat advisories RHSA-2025:7695RHSA-2025:7694RHSA-2025:7693RHSA-2025:7691RHSA-2025:7692RHSA-2025:7690
- MozillaThunderbird SLE Workstation Extension 15 SP6, SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 128.10.0-150200.8.212.1
- MozillaFirefox SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +11 more 128.10.0-150200.152.179.1
- MozillaFirefox SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 128.10.0-112.255.1
suse advisories SUSE-SU-2025:1506-1SUSE-SU-2025:1436-1SUSE-SU-2025:1414-1
- MozillaFirefox openSUSE Tumbleweed 138.0-1.1
- MozillaThunderbird openSUSE Tumbleweed 128.10.0-1.1
- firefox-esr openSUSE Tumbleweed 128.10.0-1.1
opensuse advisories openSUSE-SU-2025:15045-1openSUSE-SU-2025:15042-1openSUSE-SU-2025:15040-1
- firefox AlmaLinux 9 128.10.0-1.el9_6.alma.1
- firefox-x11 AlmaLinux 9 128.10.0-1.el9_6.alma.1
- firefox AlmaLinux 10 128.10.0-1.el10_0
- thunderbird AlmaLinux 10 128.10.0-1.el10_0.alma.1
- thunderbird AlmaLinux 8 128.10.0-1.el8_10.alma.1
- firefox AlmaLinux 9 128.10.0-1.el9_5.alma.1
- firefox-x11 AlmaLinux 9 128.10.0-1.el9_5.alma.1
- firefox AlmaLinux 8 128.10.0-1.el8_10.alma.1
almalinux advisories ALSA-2025:7428ALSA-2025:7506ALSA-2025:7507ALSA-2025:4797ALSA-2025:4443ALSA-2025:4458
- firefox Rocky Linux 9 128.10.0-1.el9_5
- thunderbird Rocky Linux 9 128.10.0-1.el9_5
- firefox Rocky Linux 8 128.10.0-1.el8_10
- thunderbird Rocky Linux 8 128.10.0-1.el8_10
rocky linux advisories RLSA-2025:4443RLSA-2025:4460RLSA-2025:7428RLSA-2025:4458RLSA-2025:4797
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2025-2817 updated cvss 8.5
firefox: thunderbird: Privilege escalation in Firefox Updater
-
Red Hat Enterprise Linux 6 firefox, thunderbird Red Hat Enterprise Linux 7 thunderbirdaffected: no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 9 firefox-flatpak-container, thunderbird-flatpak-container Red Hat Enterprise Linux 10 firefox-flatpak-container, thunderbird-flatpak-containeraffected: no fix available
-
Red Hat Enterprise Linux AppStream (v. 8) firefox 128.10.0-1.el8_10, thunderbird 128.10.0-1.el8_10fixed: vendor fix RHSA-2025:4458
-
Red Hat Enterprise Linux AppStream (v. 9) firefox 128.10.0-1.el9_5, firefox 128.10.0-1.el9_6, firefox-x11 128.10.0-1.el9_5, firefox-x11 128.10.0-1.el9_6, thunderbird 128.10.0-1.el9_5fixed: vendor fix RHSA-2025:4443
-
Red Hat Enterprise Linux AppStream (v. 10) firefox 128.10.0-1.el10_0, thunderbird 128.10.0-1.el10_0fixed: vendor fix RHSA-2025:7506
-
Red Hat Enterprise Linux AppStream AUS (v. 8.2) firefox 128.10.0-1.el8_2, thunderbird 128.10.0-1.el8_2fixed: vendor fix RHSA-2025:7547
-
Red Hat Enterprise Linux AppStream AUS (v.8.4) firefox 128.10.0-1.el8_4, thunderbird 128.10.0-1.el8_4fixed: vendor fix RHSA-2025:7545
-
Red Hat Enterprise Linux AppStream AUS (v.8.6) firefox 128.10.0-1.el8_6, thunderbird 128.10.0-1.el8_6fixed: vendor fix RHSA-2025:7544
show 9 moreshow fewer
-
Red Hat Enterprise Linux AppStream E4S (v.8.4) firefox 128.10.0-1.el8_4, thunderbird 128.10.0-1.el8_4fixed: vendor fix RHSA-2025:7545
-
Red Hat Enterprise Linux AppStream E4S (v.8.6) firefox 128.10.0-1.el8_6, thunderbird 128.10.0-1.el8_6fixed: vendor fix RHSA-2025:7544
-
Red Hat Enterprise Linux AppStream E4S (v.9.0) firefox 128.10.0-1.el9_0, thunderbird 128.10.0-1.el9_0fixed: vendor fix RHSA-2025:4753
-
Red Hat Enterprise Linux AppStream EUS (v.8.8) firefox 128.10.0-1.el8_8, thunderbird 128.10.0-1.el8_8fixed: vendor fix RHSA-2025:7543
-
Red Hat Enterprise Linux AppStream EUS (v.9.2) firefox 128.10.0-1.el9_2, firefox-x11 128.10.0-1.el9_2, thunderbird 128.10.0-1.el9_2fixed: vendor fix RHSA-2025:4752
-
Red Hat Enterprise Linux AppStream EUS (v.9.4) firefox 128.10.0-1.el9_4, firefox-x11 128.10.0-1.el9_4, thunderbird 128.10.0-1.el9_4fixed: vendor fix RHSA-2025:4756
-
Red Hat Enterprise Linux AppStream TUS (v.8.4) firefox 128.10.0-1.el8_4, thunderbird 128.10.0-1.el8_4fixed: vendor fix RHSA-2025:7545
-
Red Hat Enterprise Linux AppStream TUS (v.8.6) firefox 128.10.0-1.el8_6, thunderbird 128.10.0-1.el8_6fixed: vendor fix RHSA-2025:7544
-
Red Hat Enterprise Linux Server (v. 7 ELS) firefox 128.10.0-1.el7_9fixed: vendor fix RHSA-2025:4751
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Mozilla Firefox
- Mozilla Thunderbird
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
mozilla.org
/security/advisories/mfsa2025-28/
vendor-advisory
-
mozilla.org
/security/advisories/mfsa2025-29/
vendor-advisory
-
mozilla.org
/security/advisories/mfsa2025-30/
vendor-advisory
-
mozilla.org
/security/advisories/mfsa2025-31/
vendor-advisory
-
mozilla.org
/security/advisories/mfsa2025-32/
vendor-advisory
-
bugzilla.mozilla.org
/show_bug.cgi?id=1917536
permissions-required
- lists.debian.org /debian-lts-announce/2025/05/msg00022.html
Sources
- CVE List CVE-2025-2817
- NVD CVE-2025-2817
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.