This Red Hat security advisory details an update to Mozilla Thunderbird that fixes six security vulnerabilities: CVE-2024-4367 (arbitrary JavaScript execution in PDF.js), CVE-2024-4767 (IndexedDB files retained in private browsing mode), CVE-2024-4768 (potential permissions request bypass via clickjacking), CVE-2024-4769 (cross-origin responses distinguished between script and non-script content-types), CVE-2024-4770 (use-after-free when printing to PDF), and CVE-2024-4777 (memory safety bugs). The update upgrades Thunderbird to version 115.11.0 on Red Hat Enterprise Linux 8.2 AUS. The advisory rates the security impact as moderate and recommends applying the update to remediate these issues.

The vulnerabilities fixed include arbitrary code execution via JavaScript in PDF rendering, privacy issues due to IndexedDB files persisting in private browsing mode, potential bypass of permissions requests through clickjacking, information disclosure through cross-origin response content-type distinctions, use-after-free memory corruption when printing PDFs, and other memory safety bugs. These issues could potentially allow attackers to execute arbitrary code, bypass security controls, or cause application instability if exploited.

A security update to Thunderbird version 115.11.0 is available and should be applied promptly. All running instances of Thunderbird must be restarted for the update to take effect. This update addresses all listed vulnerabilities. No additional mitigation steps are indicated by the vendor advisory.