Red Hat Product Security released an advisory (RHSA-2025:4512) addressing three vulnerabilities in Mozilla Thunderbird. The issues include UI misrepresentation of attachment URLs (CVE-2025-3523), information disclosure of the /tmp directory listing (CVE-2025-2830), and leakage of hashed Windows credentials through crafted attachment URLs (CVE-2025-3522). These vulnerabilities could lead to information disclosure and credential leakage. The advisory provides updated Thunderbird packages for Red Hat Enterprise Linux 9.4 Extended Update Support across multiple architectures. No CVSS scores are provided in the advisory, but the severity is rated as Important by Red Hat.

The vulnerabilities allow attackers to misrepresent attachment URLs in the user interface, disclose contents of the /tmp directory, and leak hashed Windows credentials via crafted attachment URLs. This could lead to unauthorized information disclosure and potential credential compromise on affected systems running vulnerable versions of Thunderbird.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 9.4 Extended Update Support to address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2025:4512 and the referenced article https://access.redhat.com/articles/11258. Since this is an on-premises product, remediation requires applying the vendor-provided update. Patch status is confirmed by the vendor advisory.