Red Hat issued a security advisory (RHSA-2024:2913) for Mozilla Thunderbird, upgrading it to version 115.11.0 to fix six security vulnerabilities originally identified in Firefox components. These include CVE-2024-4367 (arbitrary JavaScript execution in PDF.js), CVE-2024-4767 (IndexedDB files retained in private browsing mode), CVE-2024-4768 (permissions request bypass via clickjacking), CVE-2024-4769 (cross-origin response content-type distinction), CVE-2024-4770 (use-after-free when printing to PDF), and CVE-2024-4777 (memory safety bugs). The advisory covers Red Hat Enterprise Linux 7 products and related variants. The update addresses these issues by upgrading Thunderbird to version 115.11.0, which includes fixes also present in Firefox 126 and Firefox ESR 115.11.

The vulnerabilities fixed include arbitrary code execution via JavaScript in PDF.js, privacy issues with IndexedDB files in private browsing, bypass of permissions requests through clickjacking, information disclosure via cross-origin response content-type distinctions, use-after-free memory corruption when printing PDFs, and other memory safety bugs. These issues could potentially allow attackers to execute arbitrary code, bypass security controls, or cause application crashes. The overall security impact is rated as Important by Red Hat, indicating a high risk if unpatched.

Red Hat has released an official security update upgrading Thunderbird to version 115.11.0 that addresses all listed vulnerabilities. Users of affected Red Hat Enterprise Linux 7 variants should apply this update promptly. Before applying this update, ensure all previously released errata relevant to the system have been applied. Refer to Red Hat's official documentation for update instructions at https://access.redhat.com/articles/11258. No additional mitigation beyond applying the update is indicated by the vendor.