CVE-2025-0510: Address of e-mail sender can be spoofed by malicious email
Published Feb 4, 2025
·Updated
Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040.
Affected Software
4 affected componentsFixes available
Mozilla Thunderbird<128.7
128.7
Mozilla Thunderbird>=128.0.1<128.7.0
Mozilla Thunderbird>=131.0<135.0
Mozilla Thunderbird<135
135
Event History
Feb 4, 2025
CVE Published
via Mozilla·12:00 AM
CVE Published
via MITRE·01:58 PM
Data Sourced
via MITRE·01:58 PM
Description
Data Sourced
via NVD·02:15 PM
DescriptionSeverityWeaknessAffected Software
Data Sourced
via Red Hat·03:02 PM
DescriptionSeverityAffected Software
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
1
What is the severity of CVE-2025-0510?
CVE-2025-0510 is classified as a moderate severity vulnerability.
2
How do I fix CVE-2025-0510?
To fix CVE-2025-0510, update Thunderbird to version 135 or 128.7 or later.
3
What issue does CVE-2025-0510 cause in Thunderbird?
CVE-2025-0510 causes Thunderbird to display an incorrect sender address when an email's From field uses invalid group name syntax.
4
Which versions of Thunderbird are affected by CVE-2025-0510?
CVE-2025-0510 affects Thunderbird versions below 135 and 128.7.
5
Is there a workaround for CVE-2025-0510?
There are no known workarounds for CVE-2025-0510; the best approach is to update your software.