Red Hat issued a security advisory (RHSA-2024:2913) for Mozilla Thunderbird, upgrading it to version 115.11.0 to fix six security vulnerabilities tracked under CVE-2024-4367, CVE-2024-4767, CVE-2024-4768, CVE-2024-4769, CVE-2024-4770, and CVE-2024-4777. These vulnerabilities include arbitrary JavaScript execution in PDF.js, IndexedDB data leakage in private browsing, clickjacking-based permissions bypass, cross-origin content-type information leaks, use-after-free bugs during PDF printing, and memory safety issues. The fixes align with those applied in Firefox 126 and Firefox ESR 115.11. The advisory covers Red Hat Enterprise Linux 7 and its variants. No known exploits in the wild have been reported at the time of the advisory.

The vulnerabilities fixed in this update could allow an attacker to execute arbitrary JavaScript code, bypass permissions requests, leak information about cross-origin responses, cause use-after-free memory corruption, and expose IndexedDB files despite private browsing mode. These issues collectively pose risks to confidentiality, integrity, and potentially availability of the Thunderbird client. The update mitigates these risks by addressing memory safety and access control flaws. Red Hat rates the security impact as Important (high severity).

Red Hat has released Thunderbird version 115.11.0 containing fixes for these vulnerabilities. Users should apply this update promptly. Before applying, ensure all previously released errata relevant to the system are installed. Detailed update instructions are available at Red Hat's official documentation (https://access.redhat.com/articles/11258). There are no indications that additional mitigations beyond applying the update are required.