This advisory covers a set of nine security vulnerabilities in Mozilla Thunderbird, specifically related to Firefox components integrated into the client. The issues include a race condition in the graphics component (CVE-2025-13012), multiple mitigation bypasses in DOM security components (CVE-2025-13013, CVE-2025-13018), use-after-free vulnerabilities in audio/video and WebRTC components (CVE-2025-13014, CVE-2025-13020), same-origin policy bypasses in DOM workers and notifications components (CVE-2025-13019, CVE-2025-13017), a spoofing issue (CVE-2025-13015), and incorrect boundary conditions in the JavaScript WebAssembly component (CVE-2025-13016). Red Hat has released an update for Thunderbird in Red Hat Enterprise Linux 9.4 Extended Update Support that addresses these vulnerabilities. The advisory references Red Hat Bugzilla entries for each CVE and provides updated package versions for multiple architectures. No CVSS base scores are provided in the advisory, but the overall impact is rated Important by Red Hat.

The vulnerabilities collectively could allow attackers to bypass security mitigations, cause use-after-free conditions potentially leading to memory corruption, bypass same-origin policies, exploit race conditions, and perform spoofing attacks within the Thunderbird mail client. These issues affect core components responsible for security enforcement, media handling, and script execution. Successful exploitation could compromise confidentiality, integrity, or availability of the affected system or user data. However, no known exploits in the wild have been reported at the time of this advisory.

Red Hat has released an official security update for Thunderbird in Red Hat Enterprise Linux 9.4 Extended Update Support that addresses all listed vulnerabilities. Users and administrators should apply the provided Thunderbird update packages promptly to remediate these issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. Since this is an official fix, no additional mitigation steps are required beyond applying the update.