Red Hat Product Security issued an important security advisory (RHSA-2025:8608) for Mozilla Thunderbird on Red Hat Enterprise Linux 10, addressing nine CVEs related to memory safety, out-of-bounds access, clickjacking, and script execution isolation. The vulnerabilities include CVE-2025-4918 and CVE-2025-4919 (out-of-bounds access), CVE-2025-5267 (clickjacking leading to potential leakage of saved payment card details), CVE-2025-5264 (potential local code execution in the 'Copy as cURL' command), and several memory safety bugs (CVE-2025-5268, CVE-2025-5269), among others. The advisory provides updated Thunderbird packages for various Red Hat Enterprise Linux 10 architectures and support levels. Detailed CVSS scores and impact specifics are available on the referenced CVE pages. The update is rated as important by Red Hat and is intended to remediate these security issues.

The vulnerabilities collectively could allow attackers to cause out-of-bounds memory access, potentially leading to crashes or arbitrary code execution, leak sensitive information such as saved payment card details via clickjacking, and exploit local code execution flaws. Memory safety bugs and improper isolation of script execution error handling increase the risk of unauthorized code execution or information disclosure within the Thunderbird client. These issues affect the confidentiality, integrity, and availability of the affected systems running Thunderbird on Red Hat Enterprise Linux 10.

Red Hat has released updated Thunderbird packages addressing these vulnerabilities as part of advisory RHSA-2025:8608. Users of Red Hat Enterprise Linux 10 should apply the provided security update promptly to remediate these issues. Detailed instructions and package information are available at https://access.redhat.com/articles/11258. No additional mitigation steps are specified beyond applying the official update.