This Red Hat security advisory addresses a set of vulnerabilities in Mozilla Thunderbird, including CVE-2024-10458 (permission leak via embed or object elements), CVE-2024-10459 (use-after-free in layout with accessibility), CVE-2024-10460 (confusing display of origin for external protocol handler prompt), CVE-2024-10461 (XSS due to Content-Disposition being ignored), CVE-2024-10462 (origin of permission prompt spoofed by long URL), CVE-2024-10463 (cross origin video frame leak), CVE-2024-10464 (denial of service via history interface), CVE-2024-10465 (clipboard paste button persisted across tabs), CVE-2024-10466 (DOM push subscription message could hang the application), and CVE-2024-10467 (memory safety bugs). These vulnerabilities affect Thunderbird as packaged for Red Hat Enterprise Linux 9 and related variants. The advisory references fixes included in Thunderbird 132 and ESR 128.4 releases. The update is rated as moderate severity by Red Hat Product Security.

The vulnerabilities collectively could allow denial of service conditions, cross-site scripting attacks, permission leaks, use-after-free memory corruption, memory safety issues, UI spoofing, and application hangs. These issues could impact the confidentiality, integrity, and availability of the Thunderbird client. However, no known exploits in the wild have been reported at this time.

Red Hat has released an updated Thunderbird package for Red Hat Enterprise Linux 9 and its extended support variants that addresses these vulnerabilities. Users should apply the security update as detailed in the Red Hat advisory RHSA-2024:8793 to remediate these issues. For update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.