Red Hat Product Security released an advisory (RHSA-2025:4513) for Mozilla Thunderbird addressing three security flaws: UI misrepresentation of attachment URLs (CVE-2025-3523), information disclosure of the /tmp directory listing (CVE-2025-2830), and leakage of hashed Windows credentials via crafted attachment URLs (CVE-2025-3522). These vulnerabilities affect Thunderbird as distributed in Red Hat Enterprise Linux 9.2 Extended Update Support and related variants. The advisory provides updated Thunderbird packages (version 128.9.2-1.el9_2) that fix these issues. The vulnerabilities are rated with an overall security impact of Important by Red Hat. No CVSS scores are provided in the advisory, but the issues involve information disclosure and credential leakage risks. The vendor advisory includes detailed package information and instructions for applying the update.

The vulnerabilities allow potential attackers to misrepresent attachment URLs in the user interface, disclose contents of the /tmp directory, and leak hashed Windows credentials through crafted attachment URLs. These issues could lead to information disclosure and credential compromise if exploited. The advisory rates the security impact as Important, indicating a significant risk to confidentiality and user trust in Thunderbird's handling of attachments and temporary files.

Red Hat has released an official security update for Thunderbird version 128.9.2-1.el9_2 that addresses these vulnerabilities. Users of Red Hat Enterprise Linux 9.2 Extended Update Support and related variants should apply this update promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official patch. Patch status is confirmed as fixed in the updated Thunderbird package provided by Red Hat.