Red Hat issued a security advisory (RHSA-2024:3784) for Mozilla Thunderbird, upgrading it to version 115.11.0 to fix six security vulnerabilities originally identified in Firefox components. These include CVE-2024-4367 (arbitrary JavaScript execution in PDF.js), CVE-2024-4767 (IndexedDB files retained in private browsing mode), CVE-2024-4768 (permissions request bypass via clickjacking), CVE-2024-4769 (cross-origin response content-type distinction), CVE-2024-4770 (use-after-free when printing to PDF), and CVE-2024-4777 (memory safety bugs). The update applies to Red Hat Enterprise Linux 8.10 and related platforms. The advisory rates the impact as moderate and recommends updating to Thunderbird 115.11.0. No exploits in the wild are currently known.

The vulnerabilities collectively could allow arbitrary JavaScript execution, privacy issues due to retained IndexedDB files in private browsing, bypass of permissions requests via clickjacking, information disclosure through cross-origin response content-type distinctions, use-after-free memory corruption when printing to PDF, and other memory safety issues. These could potentially lead to unauthorized code execution or information leakage. However, the Red Hat advisory rates the overall impact as moderate and no active exploitation has been reported.

A security update is available that upgrades Thunderbird to version 115.11.0, which addresses all listed vulnerabilities. Red Hat recommends applying this update after ensuring all previously released errata relevant to the system have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigation actions are indicated by the vendor advisory.