This advisory covers a set of nine security vulnerabilities impacting Mozilla Thunderbird as packaged by Red Hat for Enterprise Linux 9.6. The vulnerabilities include a race condition in the graphics component (CVE-2025-13012), mitigation bypasses in DOM security components (CVE-2025-13013, CVE-2025-13018), use-after-free bugs in audio/video and WebRTC components (CVE-2025-13014, CVE-2025-13020), incorrect boundary conditions in the JavaScript WebAssembly component (CVE-2025-13016), same-origin policy bypasses in DOM workers and notifications components (CVE-2025-13019, CVE-2025-13017), and a spoofing issue (CVE-2025-13015). These vulnerabilities affect Firefox components embedded in Thunderbird and have been addressed by Red Hat in the thunderbird package update to version 140.5.0-1.el9_6. The advisory references Red Hat Enterprise Linux 9.6 Extended Update Support and related variants. No CVSS scores are provided in the advisory, but the overall impact is rated as important.

The vulnerabilities collectively could allow an attacker to bypass security mitigations, cause use-after-free conditions potentially leading to arbitrary code execution, bypass same-origin policy restrictions, exploit race conditions, and perform spoofing attacks within the Thunderbird mail client environment. These issues affect core components related to DOM security, audio/video processing, WebAssembly, WebRTC, and graphics rendering. Successful exploitation could compromise the confidentiality, integrity, or availability of the affected system or user data.

Red Hat has released an updated thunderbird package (version 140.5.0-1.el9_6) for Red Hat Enterprise Linux 9.6 Extended Update Support and related variants that addresses these vulnerabilities. Users should apply this official security update promptly to remediate the issues. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation actions are specified or required beyond applying the update.