This Red Hat security advisory addresses nine vulnerabilities in Mozilla Thunderbird as packaged for Red Hat Enterprise Linux 9.4 Extended Update Support. The issues include a large branch table leading to truncated instructions (CVE-2025-8028), multiple memory safety bugs (CVE-2025-8035, CVE-2025-8034), incorrect URL stripping in CSP reports (CVE-2025-8031), partial return value writing in the JavaScript engine stack (CVE-2025-8027), potential user-assisted code execution via the 'Copy as cURL' command (CVE-2025-8030), incorrect JavaScript state machine for generators (CVE-2025-8033), XSLT documents bypassing CSP (CVE-2025-8032), and execution of javascript: URLs on object and embed tags (CVE-2025-8029). The advisory provides updated Thunderbird packages to fix these issues. The vulnerabilities collectively represent a high severity risk, with potential impacts on memory safety and code execution within the Thunderbird client.

The vulnerabilities include memory safety bugs that could lead to crashes or potentially exploitable conditions, incorrect handling of URLs in security policies that could weaken protections, and flaws in the JavaScript engine that may allow partial data corruption or user-assisted code execution. These issues could allow attackers to execute arbitrary code or bypass security controls in the context of the Thunderbird mail client, increasing the risk of compromise or data exposure. The Red Hat advisory rates the overall impact as important, reflecting significant but not critical risk.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 9.4 Extended Update Support that address all identified vulnerabilities. Users should apply these official updates promptly to remediate the security issues. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the vendor-provided patches.