This advisory covers a set of ten security vulnerabilities in Mozilla Thunderbird, including CVE-2024-10458 (permission leak via embed or object elements), CVE-2024-10459 (use-after-free in layout with accessibility), CVE-2024-10460 (confusing display of origin for external protocol handler prompt), CVE-2024-10461 (XSS due to Content-Disposition being ignored), CVE-2024-10462 (origin of permission prompt spoofed by long URL), CVE-2024-10463 (cross origin video frame leak), CVE-2024-10464 (history interface denial of service), CVE-2024-10465 (clipboard paste button persisted across tabs), CVE-2024-10466 (DOM push subscription message could hang Firefox), and CVE-2024-10467 (memory safety bugs). Red Hat has released updates for Thunderbird 128.4.0 on Red Hat Enterprise Linux 8.8 Extended Update Support to fix these issues. The advisory rates the overall impact as moderate and references fixes in Thunderbird 132 and ESR 128.4 upstream. No CVSS scores are provided in the advisory itself.

The vulnerabilities collectively could lead to denial of service conditions, cross-site scripting attacks, unauthorized permission leaks, use-after-free memory corruption, memory safety issues, UI spoofing, and potential hangs in the application. These issues could affect the confidentiality, integrity, and availability of the Thunderbird client when exploited. The advisory does not report known active exploitation in the wild.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 8.8 Extended Update Support that address these vulnerabilities. Users should apply these official security updates as detailed in the Red Hat advisory RHSA-2024:9018 and the referenced article https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the provided patches.