Red Hat Security Advisory: thunderbird security update
Multiple security vulnerabilities affecting Mozilla Thunderbird have been addressed in a Red Hat security advisory. These include memory safety bugs, out-of-bounds read/write, use-after-free conditions, cross-process information leaks, and improper handling of object properties. The vulnerabilities are fixed in Thunderbird ESR 140.4 and Thunderbird 144. The advisory covers Red Hat Enterprise Linux 9.2 and related variants. The update is rated as important by Red Hat Product Security.
AI Analysis
Technical Summary
This Red Hat security advisory addresses several vulnerabilities in Mozilla Thunderbird related to memory safety (CVE-2025-11714, CVE-2025-11715), out-of-bounds read/write triggered by WebGL textures (CVE-2025-11709), cross-process information leaks via malicious IPC messages (CVE-2025-11710), use-after-free in MediaTrackGraphImpl::GetInstance() (CVE-2025-11708), an OBJECT tag type attribute overriding browser behavior without content-type (CVE-2025-11712), and modification of some non-writable object properties (CVE-2025-11711). These issues are fixed in Thunderbird ESR 140.4 and Thunderbird 144. The advisory applies to Red Hat Enterprise Linux 9.2 and its variants, with updated packages available. No known exploits in the wild have been reported.
Potential Impact
The vulnerabilities could allow memory corruption, information leakage, and unauthorized modification of object properties within Thunderbird, potentially leading to crashes or privilege escalation. The impact is rated as important by Red Hat, indicating a significant security risk if unpatched. No known active exploitation has been reported.
Mitigation Recommendations
Red Hat has released updated Thunderbird packages (version 140.4.0-2.el9_2) for Red Hat Enterprise Linux 9.2 and related variants that address these vulnerabilities. Users should apply the available official updates as described in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate these issues. Since an official fix is available, applying the update is the recommended mitigation.
Red Hat Security Advisory: thunderbird security update
Description
Multiple security vulnerabilities affecting Mozilla Thunderbird have been addressed in a Red Hat security advisory. These include memory safety bugs, out-of-bounds read/write, use-after-free conditions, cross-process information leaks, and improper handling of object properties. The vulnerabilities are fixed in Thunderbird ESR 140.4 and Thunderbird 144. The advisory covers Red Hat Enterprise Linux 9.2 and related variants. The update is rated as important by Red Hat Product Security.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This Red Hat security advisory addresses several vulnerabilities in Mozilla Thunderbird related to memory safety (CVE-2025-11714, CVE-2025-11715), out-of-bounds read/write triggered by WebGL textures (CVE-2025-11709), cross-process information leaks via malicious IPC messages (CVE-2025-11710), use-after-free in MediaTrackGraphImpl::GetInstance() (CVE-2025-11708), an OBJECT tag type attribute overriding browser behavior without content-type (CVE-2025-11712), and modification of some non-writable object properties (CVE-2025-11711). These issues are fixed in Thunderbird ESR 140.4 and Thunderbird 144. The advisory applies to Red Hat Enterprise Linux 9.2 and its variants, with updated packages available. No known exploits in the wild have been reported.
Potential Impact
The vulnerabilities could allow memory corruption, information leakage, and unauthorized modification of object properties within Thunderbird, potentially leading to crashes or privilege escalation. The impact is rated as important by Red Hat, indicating a significant security risk if unpatched. No known active exploitation has been reported.
Mitigation Recommendations
Red Hat has released updated Thunderbird packages (version 140.4.0-2.el9_2) for Red Hat Enterprise Linux 9.2 and related variants that address these vulnerabilities. Users should apply the available official updates as described in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate these issues. Since an official fix is available, applying the update is the recommended mitigation.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:19944
- Cve Count
- 7
- Additional Cves
- ["CVE-2025-11709","CVE-2025-11710","CVE-2025-11711","CVE-2025-11712","CVE-2025-11714","CVE-2025-11715"]
Threat ID: 6a419cae27e9c79719aba42e
Added to database: 06/28/2026, 22:14:06 UTC
Last enriched: 06/28/2026, 22:23:24 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 19
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.