This advisory covers a set of nine security vulnerabilities in Mozilla Thunderbird as packaged for Red Hat Enterprise Linux 9. The issues include a large branch table leading to truncated instructions (CVE-2025-8028), multiple memory safety bugs (CVE-2025-8035, CVE-2025-8034), incorrect URL stripping in Content Security Policy (CSP) reports (CVE-2025-8031), partial return value writes in the JavaScript engine (CVE-2025-8027), potential user-assisted code execution via the 'Copy as cURL' command (CVE-2025-8030), incorrect JavaScript state machine behavior for generators (CVE-2025-8033), XSLT documents bypassing CSP (CVE-2025-8032), and execution of javascript: URLs on object and embed tags (CVE-2025-8029). Red Hat has issued updated Thunderbird packages to address these vulnerabilities across multiple RHEL 9 variants and architectures.

The vulnerabilities collectively pose a high security risk, including potential memory corruption, code execution with user assistance, and bypasses of security policies such as CSP. These issues could allow attackers to execute arbitrary code, manipulate JavaScript execution, or bypass security restrictions within Thunderbird, potentially compromising the confidentiality, integrity, or availability of the affected system or user data.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 9 and its variants that address these vulnerabilities. Users and administrators should apply the security update as detailed in Red Hat advisory RHSA-2025:12187 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigations are specified beyond applying the official update.