CVE-2025-26695
EUVD-2025-770510.03.2025, 19:15
When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested email address. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| mozilla | thunderbird | 𝑥 < 128.8.0 |
| mozilla | thunderbird | 129.0 ≤ 𝑥 < 136.0 |
𝑥
= Vulnerable software versions
Debian Releases
Debian Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| thunderbird |
|
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| MozillaThunderbird |
| ||||||||||||||||
| MozillaThunderbird-translations-common |
| ||||||||||||||||
| MozillaThunderbird-translations-other |
|