Red Hat Security Advisory: thunderbird security update
Multiple security vulnerabilities have been identified and addressed in Mozilla Thunderbird as packaged for Red Hat Enterprise Linux 8.6. These include out-of-bounds memory access, clickjacking leading to potential leakage of saved payment card details, local code execution risks, memory safety bugs, and improper isolation of script execution errors from web content. Red Hat has released an important security update to fix these issues in Thunderbird version 128.11.0-1.el8_6. The update is available for various Red Hat Enterprise Linux 8.6 variants including Extended Update Support, Advanced Mission Critical Update Support, Update Services for SAP Solutions, and Telecommunications Update Service. Users of affected Red Hat Enterprise Linux 8.6 systems should apply the update to mitigate these vulnerabilities.
AI Analysis
Technical Summary
Red Hat Product Security issued an important security advisory (RHSA-2025:8629) addressing multiple vulnerabilities in Mozilla Thunderbird as distributed in Red Hat Enterprise Linux 8.6. The fixed issues include out-of-bounds access when resolving Promise objects (CVE-2025-4918) and optimizing linear sums (CVE-2025-4919), a clickjacking vulnerability potentially leaking saved payment card details (CVE-2025-5267), potential local code execution via the 'Copy as cURL' command (CVE-2025-5264), several memory safety bugs (CVE-2025-5268, CVE-2025-5269), leakage of cross-origin resource status through script element events (CVE-2025-5266), and improper isolation of script execution error handling from web content (CVE-2025-5263). These vulnerabilities collectively represent significant security risks in Thunderbird. Red Hat has released updated Thunderbird packages (version 128.11.0-1.el8_6) to address these issues. The advisory covers multiple Red Hat Enterprise Linux 8.6 variants and architectures including x86_64 and ppc64le. No known exploits in the wild have been reported at the time of the advisory.
Potential Impact
The vulnerabilities fixed include out-of-bounds memory accesses that could lead to crashes or potential code execution, a clickjacking flaw that might expose saved payment card details, local code execution risks via Thunderbird's 'Copy as cURL' feature, and multiple memory safety bugs that could compromise application stability or security. Additionally, improper isolation of script execution errors and leakage of cross-origin resource status could lead to information disclosure or security bypass. Collectively, these issues pose a high security risk to users of affected Thunderbird versions on Red Hat Enterprise Linux 8.6 systems.
Mitigation Recommendations
Red Hat has released updated Thunderbird packages (version 128.11.0-1.el8_6) that address all listed vulnerabilities. Users running affected Red Hat Enterprise Linux 8.6 variants should apply these security updates promptly. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations beyond applying the official update are indicated by the vendor advisory.
Red Hat Security Advisory: thunderbird security update
Description
Multiple security vulnerabilities have been identified and addressed in Mozilla Thunderbird as packaged for Red Hat Enterprise Linux 8.6. These include out-of-bounds memory access, clickjacking leading to potential leakage of saved payment card details, local code execution risks, memory safety bugs, and improper isolation of script execution errors from web content. Red Hat has released an important security update to fix these issues in Thunderbird version 128.11.0-1.el8_6. The update is available for various Red Hat Enterprise Linux 8.6 variants including Extended Update Support, Advanced Mission Critical Update Support, Update Services for SAP Solutions, and Telecommunications Update Service. Users of affected Red Hat Enterprise Linux 8.6 systems should apply the update to mitigate these vulnerabilities.
Affected software
pkg:rpm/redhat/thunderbirdRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Red Hat Product Security issued an important security advisory (RHSA-2025:8629) addressing multiple vulnerabilities in Mozilla Thunderbird as distributed in Red Hat Enterprise Linux 8.6. The fixed issues include out-of-bounds access when resolving Promise objects (CVE-2025-4918) and optimizing linear sums (CVE-2025-4919), a clickjacking vulnerability potentially leaking saved payment card details (CVE-2025-5267), potential local code execution via the 'Copy as cURL' command (CVE-2025-5264), several memory safety bugs (CVE-2025-5268, CVE-2025-5269), leakage of cross-origin resource status through script element events (CVE-2025-5266), and improper isolation of script execution error handling from web content (CVE-2025-5263). These vulnerabilities collectively represent significant security risks in Thunderbird. Red Hat has released updated Thunderbird packages (version 128.11.0-1.el8_6) to address these issues. The advisory covers multiple Red Hat Enterprise Linux 8.6 variants and architectures including x86_64 and ppc64le. No known exploits in the wild have been reported at the time of the advisory.
Potential Impact
The vulnerabilities fixed include out-of-bounds memory accesses that could lead to crashes or potential code execution, a clickjacking flaw that might expose saved payment card details, local code execution risks via Thunderbird's 'Copy as cURL' feature, and multiple memory safety bugs that could compromise application stability or security. Additionally, improper isolation of script execution errors and leakage of cross-origin resource status could lead to information disclosure or security bypass. Collectively, these issues pose a high security risk to users of affected Thunderbird versions on Red Hat Enterprise Linux 8.6 systems.
Mitigation Recommendations
Red Hat has released updated Thunderbird packages (version 128.11.0-1.el8_6) that address all listed vulnerabilities. Users running affected Red Hat Enterprise Linux 8.6 variants should apply these security updates promptly. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations beyond applying the official update are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:8629
- Cve Count
- 9
- Additional Cves
- ["CVE-2025-4919","CVE-2025-5263","CVE-2025-5264","CVE-2025-5266","CVE-2025-5267","CVE-2025-5268","CVE-2025-5269","CVE-2025-5283"]
Threat ID: 6a4049e327e9c797198330d5
Added to database: 06/27/2026, 22:08:35 UTC
Last enriched: 06/27/2026, 22:30:23 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 32
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.