CVE-2025-4088
Publication date 29 April 2025
Last updated 7 May 2025
Ubuntu priority
A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any site that had invoked the Storage Access API. This enabled potential Cross-Site Request Forgery attacks across origins. This vulnerability affects Firefox < 138 and Thunderbird < 138.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| firefox | 25.04 plucky |
Not affected
|
| 24.10 oracular |
Not affected
|
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Vulnerable
|
|
| mozjs102 | 25.04 plucky | Not in release |
| 24.10 oracular | Not in release | |
| 24.04 LTS noble | Ignored | |
| 22.04 LTS jammy | Ignored | |
| 20.04 LTS focal | Not in release | |
| mozjs115 | 25.04 plucky | Ignored |
| 24.10 oracular | Ignored | |
| 24.04 LTS noble | Ignored | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| mozjs38 | 25.04 plucky | Not in release |
| 24.10 oracular | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic |
Needs evaluation
|
|
| mozjs52 | 25.04 plucky | Not in release |
| 24.10 oracular | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Ignored | |
| 18.04 LTS bionic | Ignored | |
| mozjs68 | 25.04 plucky | Not in release |
| 24.10 oracular | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Ignored | |
| mozjs78 | 25.04 plucky | Not in release |
| 24.10 oracular | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Ignored | |
| 20.04 LTS focal | Not in release | |
| mozjs91 | 25.04 plucky | Not in release |
| 24.10 oracular | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Ignored | |
| 20.04 LTS focal | Not in release | |
| thunderbird | 25.04 plucky |
Not affected
|
| 24.10 oracular |
Not affected
|
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy |
Vulnerable
|
|
| 20.04 LTS focal |
Vulnerable
|
Notes
mdeslaur
mozjs* contain a copy of the SpiderMonkey JavaScript engine. It is not feasible to backport security fixes to the mozjs* packages, as such, marking them as ignored. starting with Ubuntu 22.04, the firefox package is just a script that installs the Firefox snap starting with Ubuntu 24.04, the thunderbird package is just a script that installs the Thunderbird snap