Red Hat issued a security advisory (RHSA-2024:2903) for Mozilla Thunderbird, upgrading it to version 115.11.0 to fix six security vulnerabilities originally identified in Firefox components. These include CVE-2024-4367 (arbitrary JavaScript execution in PDF.js), CVE-2024-4767 (IndexedDB files retained in private browsing mode), CVE-2024-4768 (permissions request bypass via clickjacking), CVE-2024-4769 (cross-origin response content-type distinction), CVE-2024-4770 (use-after-free when printing to PDF), and CVE-2024-4777 (memory safety bugs). The advisory covers Red Hat Enterprise Linux 9.2 Extended Update Support and related variants. The update is rated as important/high impact and addresses multiple CWE categories including use-after-free and memory safety issues.

The vulnerabilities fixed in this update could allow arbitrary JavaScript execution, privacy leaks via retained IndexedDB files in private browsing, bypass of permissions requests through clickjacking, information disclosure through cross-origin response content-type distinctions, use-after-free memory corruption when printing PDFs, and other memory safety issues. These flaws collectively pose risks of code execution, privacy compromise, and application instability in affected Thunderbird versions prior to 115.11.0.

A fixed version, Thunderbird 115.11.0, is available from Red Hat for affected products including Red Hat Enterprise Linux 9.2 Extended Update Support. Users should apply this update promptly to remediate the vulnerabilities. Prior errata relevant to the system should be applied before this update. Refer to the Red Hat advisory RHSA-2024:2903 for detailed update instructions.