This Red Hat advisory addresses multiple vulnerabilities in Mozilla Thunderbird, including CVE-2024-10458 (permission leak via embed or object elements), CVE-2024-10459 (use-after-free in layout with accessibility), CVE-2024-10460 (confusing display of origin for external protocol handler prompt), CVE-2024-10461 (XSS due to Content-Disposition being ignored), CVE-2024-10462 (origin of permission prompt spoofed by long URL), CVE-2024-10463 (cross origin video frame leak), CVE-2024-10464 (history interface denial of service), CVE-2024-10465 (clipboard paste button persisted across tabs), CVE-2024-10466 (DOM push subscription message hang), and CVE-2024-10467 (memory safety bugs). These vulnerabilities affect Thunderbird versions prior to 128.4.0 as packaged for Red Hat Enterprise Linux 8.4. Red Hat has released updated packages (thunderbird-128.4.0-1.el8_4) to remediate these issues. The advisory rates the security impact as moderate and provides detailed fixes for each CVE.

The vulnerabilities collectively could lead to denial of service conditions, cross-site scripting attacks, permission leaks, use-after-free memory corruption, memory safety issues, UI spoofing, and potential hangs in the application. These issues may affect the confidentiality, integrity, and availability of the Thunderbird client. However, no known exploits in the wild have been reported at the time of this advisory. The overall severity is moderate.

Red Hat has released updated Thunderbird packages (version 128.4.0-1.el8_4) for Red Hat Enterprise Linux 8.4 variants that address these vulnerabilities. Users should apply these official updates promptly to remediate the security issues. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the vendor-provided patches.