CVE-2025-5986 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2025-5986 Interim 1 5 2025-08-05T23:39:49Z current 2025-06-11T23:19:45Z 2025-08-05T23:39:49Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2025-5986 A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. This vulnerability affects Thunderbird < 128.11.1 and Thunderbird < 139.0.2. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/suse-liberty-linux-updates/2025-July/001759.html E-Mail link for RHSA-2025:10196 https://lists.suse.com/pipermail/suse-liberty-linux-updates/2025-July/001762.html E-Mail link for RHSA-2025:10246 https://lists.suse.com/pipermail/sle-updates/2025-June/040535.html E-Mail link for SUSE-SU-2025:02158-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SLES-LTSS-TERADATA 15 SP2 SUSE Liberty Linux 8 SUSE Liberty Linux 9 SUSE Linux Enterprise Module for Desktop Applications 15 SP6 SUSE Linux Enterprise Workstation Extension 15 SP6 SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Workstation Extension 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS SUSE Linux Enterprise Module for Desktop Applications 15 SP6 SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Module for Package Hub 15 SP6 SUSE Linux Enterprise Module for Package Hub 15 SP7 SUSE Linux Enterprise Server 11 SP4 LTSS SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Server 15 SP5-LTSS SUSE Linux Enterprise Module for Desktop Applications 15 SP6 SUSE Linux Enterprise Workstation Extension 15 SP6 SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Workstation Extension 15 SP7 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server Teradata 12 SP3 SUSE Linux Enterprise Server Teradata 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP5 SUSE Linux Enterprise Module for Desktop Applications 15 SP6 SUSE Linux Enterprise Workstation Extension 15 SP6 SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Workstation Extension 15 SP7 openSUSE Leap 15.6 openSUSE Tumbleweed MozillaFirefox MozillaFirefox-branding-upstream MozillaFirefox-buildsymbols MozillaFirefox-devel MozillaFirefox-translations-common MozillaFirefox-translations-other MozillaThunderbird-128.11.1-150200.8.224.1 MozillaThunderbird-128.11.1-2.1 MozillaThunderbird-openpgp-librnp-128.11.1-2.1 MozillaThunderbird-translations-common-128.11.1-150200.8.224.1 MozillaThunderbird-translations-common-128.11.1-2.1 MozillaThunderbird-translations-other-128.11.1-150200.8.224.1 MozillaThunderbird-translations-other-128.11.1-2.1 thunderbird-128.12.0-1.el8_10 thunderbird-128.12.0-1.el9_6 thunderbird-128.12.0-1.el8_10 as a component of SUSE Liberty Linux 8 thunderbird-128.12.0-1.el9_6 as a component of SUSE Liberty Linux 9 MozillaThunderbird-128.11.1-150200.8.224.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP6 MozillaThunderbird-translations-common-128.11.1-150200.8.224.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP6 MozillaThunderbird-translations-other-128.11.1-150200.8.224.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP6 MozillaThunderbird-128.11.1-150200.8.224.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP7 MozillaThunderbird-translations-common-128.11.1-150200.8.224.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP7 MozillaThunderbird-translations-other-128.11.1-150200.8.224.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP7 MozillaThunderbird-128.11.1-150200.8.224.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP6 MozillaThunderbird-translations-common-128.11.1-150200.8.224.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP6 MozillaThunderbird-translations-other-128.11.1-150200.8.224.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP6 MozillaThunderbird-128.11.1-150200.8.224.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 MozillaThunderbird-translations-common-128.11.1-150200.8.224.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 MozillaThunderbird-translations-other-128.11.1-150200.8.224.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 MozillaThunderbird-128.11.1-150200.8.224.1 as a component of openSUSE Leap 15.6 MozillaThunderbird-translations-common-128.11.1-150200.8.224.1 as a component of openSUSE Leap 15.6 MozillaThunderbird-translations-other-128.11.1-150200.8.224.1 as a component of openSUSE Leap 15.6 MozillaThunderbird-128.11.1-2.1 as a component of openSUSE Tumbleweed MozillaThunderbird-openpgp-librnp-128.11.1-2.1 as a component of openSUSE Tumbleweed MozillaThunderbird-translations-common-128.11.1-2.1 as a component of openSUSE Tumbleweed MozillaThunderbird-translations-other-128.11.1-2.1 as a component of openSUSE Tumbleweed MozillaFirefox as a component of SLES-LTSS-TERADATA 15 SP2 MozillaFirefox as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS MozillaFirefox-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS MozillaFirefox-translations-other as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS MozillaFirefox as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS MozillaFirefox-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS MozillaFirefox-translations-other as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS MozillaFirefox as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS MozillaFirefox-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS MozillaFirefox-translations-other as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS MozillaFirefox as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS MozillaFirefox-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS MozillaFirefox-translations-other as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS MozillaFirefox as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP6 MozillaFirefox-devel as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP6 MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP6 MozillaFirefox-translations-other as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP6 MozillaFirefox as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7 MozillaFirefox-devel as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7 MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7 MozillaFirefox-translations-other as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7 MozillaFirefox as a component of SUSE Linux Enterprise Server 11 SP4 LTSS MozillaFirefox as a component of SUSE Linux Enterprise Server 12 SP2-LTSS MozillaFirefox-devel as a component of SUSE Linux Enterprise Server 12 SP2-LTSS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server 12 SP2-LTSS MozillaFirefox as a component of SUSE Linux Enterprise Server 12 SP4-LTSS MozillaFirefox-devel as a component of SUSE Linux Enterprise Server 12 SP4-LTSS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server 12 SP4-LTSS MozillaFirefox as a component of SUSE Linux Enterprise Server 12 SP5-LTSS MozillaFirefox-devel as a component of SUSE Linux Enterprise Server 12 SP5-LTSS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server 12 SP5-LTSS MozillaFirefox as a component of SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security MozillaFirefox as a component of SUSE Linux Enterprise Server 15 SP1-LTSS MozillaFirefox-devel as a component of SUSE Linux Enterprise Server 15 SP1-LTSS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server 15 SP1-LTSS MozillaFirefox-translations-other as a component of SUSE Linux Enterprise Server 15 SP1-LTSS MozillaFirefox as a component of SUSE Linux Enterprise Server 15 SP2-LTSS MozillaFirefox-devel as a component of SUSE Linux Enterprise Server 15 SP2-LTSS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server 15 SP2-LTSS MozillaFirefox-translations-other as a component of SUSE Linux Enterprise Server 15 SP2-LTSS MozillaFirefox as a component of SUSE Linux Enterprise Server 15 SP3-LTSS MozillaFirefox-devel as a component of SUSE Linux Enterprise Server 15 SP3-LTSS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server 15 SP3-LTSS MozillaFirefox-translations-other as a component of SUSE Linux Enterprise Server 15 SP3-LTSS MozillaFirefox as a component of SUSE Linux Enterprise Server 15 SP4-LTSS MozillaFirefox-devel as a component of SUSE Linux Enterprise Server 15 SP4-LTSS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server 15 SP4-LTSS MozillaFirefox-translations-other as a component of SUSE Linux Enterprise Server 15 SP4-LTSS MozillaFirefox as a component of SUSE Linux Enterprise Server 15 SP5-LTSS MozillaFirefox-devel as a component of SUSE Linux Enterprise Server 15 SP5-LTSS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server 15 SP5-LTSS MozillaFirefox-translations-other as a component of SUSE Linux Enterprise Server 15 SP5-LTSS MozillaFirefox as a component of SUSE Linux Enterprise Server 15-LTSS MozillaFirefox-devel as a component of SUSE Linux Enterprise Server 15-LTSS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server 15-LTSS MozillaFirefox-translations-other as a component of SUSE Linux Enterprise Server 15-LTSS MozillaFirefox as a component of SUSE Linux Enterprise Server Teradata 12 SP3 MozillaFirefox as a component of SUSE Linux Enterprise Server Teradata 15 SP4 MozillaFirefox as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 MozillaFirefox-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 MozillaFirefox-translations-other as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 MozillaFirefox as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 MozillaFirefox-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 MozillaFirefox-translations-other as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 MozillaFirefox as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 MozillaFirefox-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 MozillaFirefox-translations-other as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 MozillaFirefox as a component of openSUSE Leap 15.6 MozillaFirefox-branding-upstream as a component of openSUSE Leap 15.6 MozillaFirefox-buildsymbols as a component of openSUSE Leap 15.6 MozillaFirefox-devel as a component of openSUSE Leap 15.6 MozillaFirefox-translations-common as a component of openSUSE Leap 15.6 MozillaFirefox-translations-other as a component of openSUSE Leap 15.6 A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. This vulnerability affects Thunderbird < 128.11.1 and Thunderbird < 139.0.2. CVE-2025-5986 SUSE Liberty Linux 8:thunderbird-128.12.0-1.el8_10 SUSE Liberty Linux 9:thunderbird-128.12.0-1.el9_6 SUSE Linux Enterprise Module for Package Hub 15 SP6:MozillaThunderbird-128.11.1-150200.8.224.1 SUSE Linux Enterprise Module for Package Hub 15 SP6:MozillaThunderbird-translations-common-128.11.1-150200.8.224.1 SUSE Linux Enterprise Module for Package Hub 15 SP6:MozillaThunderbird-translations-other-128.11.1-150200.8.224.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-128.11.1-150200.8.224.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-common-128.11.1-150200.8.224.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:MozillaThunderbird-translations-other-128.11.1-150200.8.224.1 SUSE Linux Enterprise Workstation Extension 15 SP6:MozillaThunderbird-128.11.1-150200.8.224.1 SUSE Linux Enterprise Workstation Extension 15 SP6:MozillaThunderbird-translations-common-128.11.1-150200.8.224.1 SUSE Linux Enterprise Workstation Extension 15 SP6:MozillaThunderbird-translations-other-128.11.1-150200.8.224.1 SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-128.11.1-150200.8.224.1 SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-common-128.11.1-150200.8.224.1 SUSE Linux Enterprise Workstation Extension 15 SP7:MozillaThunderbird-translations-other-128.11.1-150200.8.224.1 openSUSE Leap 15.6:MozillaThunderbird-128.11.1-150200.8.224.1 openSUSE Leap 15.6:MozillaThunderbird-translations-common-128.11.1-150200.8.224.1 openSUSE Leap 15.6:MozillaThunderbird-translations-other-128.11.1-150200.8.224.1 openSUSE Tumbleweed:MozillaThunderbird-128.11.1-2.1 openSUSE Tumbleweed:MozillaThunderbird-openpgp-librnp-128.11.1-2.1 openSUSE Tumbleweed:MozillaThunderbird-translations-common-128.11.1-2.1 openSUSE Tumbleweed:MozillaThunderbird-translations-other-128.11.1-2.1 SLES-LTSS-TERADATA 15 SP2:MozillaFirefox SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:MozillaFirefox SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:MozillaFirefox-devel SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:MozillaFirefox-translations-common SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:MozillaFirefox-translations-other SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-devel SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-devel SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-common SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:MozillaFirefox-translations-other SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-devel SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-common SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:MozillaFirefox-translations-other SUSE Linux Enterprise Module for Desktop Applications 15 SP6:MozillaFirefox SUSE Linux Enterprise Module for Desktop Applications 15 SP6:MozillaFirefox-devel SUSE Linux Enterprise Module for Desktop Applications 15 SP6:MozillaFirefox-translations-common SUSE Linux Enterprise Module for Desktop Applications 15 SP6:MozillaFirefox-translations-other SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-devel SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-common SUSE Linux Enterprise Module for Desktop Applications 15 SP7:MozillaFirefox-translations-other SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security:MozillaFirefox SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-devel SUSE Linux Enterprise Server 12 SP5-LTSS:MozillaFirefox-translations-common SUSE Linux Enterprise Server 15 SP2-LTSS:MozillaFirefox SUSE Linux Enterprise Server 15 SP2-LTSS:MozillaFirefox-devel SUSE Linux Enterprise Server 15 SP2-LTSS:MozillaFirefox-translations-common SUSE Linux Enterprise Server 15 SP2-LTSS:MozillaFirefox-translations-other SUSE Linux Enterprise Server 15 SP3-LTSS:MozillaFirefox SUSE Linux Enterprise Server 15 SP3-LTSS:MozillaFirefox-devel SUSE Linux Enterprise Server 15 SP3-LTSS:MozillaFirefox-translations-common SUSE Linux Enterprise Server 15 SP3-LTSS:MozillaFirefox-translations-other SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-devel SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-devel SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-common SUSE Linux Enterprise Server 15 SP5-LTSS:MozillaFirefox-translations-other SUSE Linux Enterprise Server Teradata 12 SP3:MozillaFirefox SUSE Linux Enterprise Server Teradata 15 SP4:MozillaFirefox SUSE Linux Enterprise Server for SAP Applications 15 SP3:MozillaFirefox SUSE Linux Enterprise Server for SAP Applications 15 SP3:MozillaFirefox-devel SUSE Linux Enterprise Server for SAP Applications 15 SP3:MozillaFirefox-translations-common SUSE Linux Enterprise Server for SAP Applications 15 SP3:MozillaFirefox-translations-other SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-devel SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-devel SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-common SUSE Linux Enterprise Server for SAP Applications 15 SP5:MozillaFirefox-translations-other openSUSE Leap 15.6:MozillaFirefox openSUSE Leap 15.6:MozillaFirefox-branding-upstream openSUSE Leap 15.6:MozillaFirefox-buildsymbols openSUSE Leap 15.6:MozillaFirefox-devel openSUSE Leap 15.6:MozillaFirefox-translations-common openSUSE Leap 15.6:MozillaFirefox-translations-other important 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H