Skip to main content

Mozilla CVE-2025-1015

MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2025-02-04 security@mozilla.org
XSS Mozilla
5.4
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.4 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
SUSE
MEDIUM
qualitative
Red Hat
5.4 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
Patch released
Apr 04, 2026 - 20:30 nvd
Patch available
Analysis Generated
Mar 28, 2026 - 18:24 vuln.today
CVE Published
Feb 04, 2025 - 14:15 nvd
MEDIUM 5.4

DescriptionCVE.org

The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If another user imported the address book, clicking on the link could result in opening a web page inside Thunderbird, and that page could execute (unprivileged) JavaScript. This vulnerability affects Thunderbird < 128.7 and Thunderbird < 135.

AnalysisAI

The Thunderbird Address Book URI fields contained unsanitized links. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 25.2% and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If another user imported the address book, clicking on the link could result in opening a web page inside Thunderbird, and that page could execute (unprivileged) JavaScript. This vulnerability affects Thunderbird < 128.7 and Thunderbird < 135. Affected products include: Mozilla Thunderbird.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.

More in Mozilla

View all
CVE-2024-4367 HIGH POC
8.8 May 14

Arbitrary JavaScript execution in Mozilla's PDF.js library affects Firefox before 126, Firefox ESR before 115.11, and Th
CVE-2026-4689 CRITICAL POC
10.0 Mar 24

A sandbox escape vulnerability exists in Firefox's XPCOM component due to incorrect boundary conditions and integer over
CVE-2025-4918 CRITICAL POC
9.8 May 17

An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. Rated critical severity
CVE-2026-2796 CRITICAL POC
9.8 Feb 24

JIT miscompilation in Firefox WebAssembly before 148. The JIT compiler generates incorrect Wasm code, enabling type conf
CVE-2025-8043 CRITICAL POC
9.8 Jul 22

Firefox and Thunderbird URL truncation flaw enables spoofing attacks by displaying misleading origins in the address bar
CVE-2025-0247 CRITICAL
9.8 Jan 07

Memory safety bugs present in Firefox 133 and Thunderbird 133. Rated critical severity (CVSS 9.8), this vulnerability is
CVE-2025-0665 HIGH POC
7.0 Feb 05

A double-close vulnerability exists in libcurl when tearing down connection channels after threaded name resolution, cau
CVE-2025-1937 HIGH POC
7.5 Mar 04

Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7
CVE-2026-0889 HIGH POC
7.5 Jan 13

Service Workers in Mozilla Firefox and Thunderbird versions below 147 are vulnerable to remote denial-of-service attacks
CVE-2025-3028 MEDIUM POC
6.5 Apr 01

JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free. Rated mediu
CVE-2026-2761 CRITICAL
10.0 Feb 24

Second sandbox escape in Firefox WebRender component. CVSS 10.0 — independent path from CVE-2026-2760 to escape the cont
CVE-2025-2857 CRITICAL
10.0 Mar 27

Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in o

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2023-40000 HIGH POC
8.3
CVE-2025-52367 MEDIUM POC
5.4
CVE-2026-42897 MEDIUM POC
6.1
CVE-2025-27915 MEDIUM POC
5.4
CVE-2025-1232 HIGH POC
8.8
CVE-2025-48700 MEDIUM POC
6.1
CVE-2025-66376 HIGH
7.2
CVE-2025-44148 CRITICAL POC
9.8

Same technique XSS

View all
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8
CVE-2025-52367 MEDIUM POC
5.4
CVE-2026-42897 MEDIUM POC
6.1
CVE-2025-27915 MEDIUM POC
5.4
CVE-2025-1232 HIGH POC
8.8
CVE-2025-48700 MEDIUM POC
6.1
CVE-2024-6497 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6 SUSE Linux Enterprise Workstation Extension 15 SP6 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 SUSE Linux Enterprise Workstation Extension 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6 Fixed

Share

CVE-2025-1015 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy