Red Hat Security Advisory: thunderbird security update
Multiple security vulnerabilities affecting Mozilla Thunderbird have been addressed in a Red Hat security update. These include memory safety bugs, out-of-bounds read/write issues triggered by WebGL textures, cross-process information leaks via malicious IPC messages, use-after-free conditions, and improper handling of OBJECT tag type attributes. The update fixes these issues in Thunderbird ESR 140.4 and Thunderbird 144. The vulnerabilities have been rated with a high security impact by Red Hat Product Security.
AI Analysis
Technical Summary
Red Hat issued a security advisory (RHSA-2025:19943) for Mozilla Thunderbird addressing seven distinct vulnerabilities inherited from Firefox components. These include CVE-2025-11708 (use-after-free in MediaTrackGraphImpl::GetInstance()), CVE-2025-11709 (out-of-bounds read/write triggered by WebGL textures in a privileged process), CVE-2025-11710 (cross-process information leak via malicious IPC messages), CVE-2025-11711 (modification of some non-writable Object properties), CVE-2025-11712 (an OBJECT tag type attribute overriding browser behavior without content-type), CVE-2025-11714 and CVE-2025-11715 (memory safety bugs). The fixes are included in Thunderbird ESR 140.4 and Thunderbird 144 packages for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions across multiple architectures. No CVSS scores are provided in the advisory, but Red Hat rates the update as having an Important security impact.
Potential Impact
The vulnerabilities collectively impact the security and stability of Mozilla Thunderbird by enabling memory safety violations, information leaks, and potential unauthorized modification of object properties. These issues could lead to crashes, privilege escalation, or exposure of sensitive information within the Thunderbird mail client environment. The advisory does not report known exploits in the wild at the time of publication.
Mitigation Recommendations
Red Hat has released updated Thunderbird packages (version 140.4.0-2.el9_0) for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions on multiple architectures (ppc64le, x86_64, aarch64, s390x). Users should apply these official updates promptly to remediate the vulnerabilities. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated or required beyond applying the vendor-provided update.
Red Hat Security Advisory: thunderbird security update
Description
Multiple security vulnerabilities affecting Mozilla Thunderbird have been addressed in a Red Hat security update. These include memory safety bugs, out-of-bounds read/write issues triggered by WebGL textures, cross-process information leaks via malicious IPC messages, use-after-free conditions, and improper handling of OBJECT tag type attributes. The update fixes these issues in Thunderbird ESR 140.4 and Thunderbird 144. The vulnerabilities have been rated with a high security impact by Red Hat Product Security.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Red Hat issued a security advisory (RHSA-2025:19943) for Mozilla Thunderbird addressing seven distinct vulnerabilities inherited from Firefox components. These include CVE-2025-11708 (use-after-free in MediaTrackGraphImpl::GetInstance()), CVE-2025-11709 (out-of-bounds read/write triggered by WebGL textures in a privileged process), CVE-2025-11710 (cross-process information leak via malicious IPC messages), CVE-2025-11711 (modification of some non-writable Object properties), CVE-2025-11712 (an OBJECT tag type attribute overriding browser behavior without content-type), CVE-2025-11714 and CVE-2025-11715 (memory safety bugs). The fixes are included in Thunderbird ESR 140.4 and Thunderbird 144 packages for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions across multiple architectures. No CVSS scores are provided in the advisory, but Red Hat rates the update as having an Important security impact.
Potential Impact
The vulnerabilities collectively impact the security and stability of Mozilla Thunderbird by enabling memory safety violations, information leaks, and potential unauthorized modification of object properties. These issues could lead to crashes, privilege escalation, or exposure of sensitive information within the Thunderbird mail client environment. The advisory does not report known exploits in the wild at the time of publication.
Mitigation Recommendations
Red Hat has released updated Thunderbird packages (version 140.4.0-2.el9_0) for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions on multiple architectures (ppc64le, x86_64, aarch64, s390x). Users should apply these official updates promptly to remediate the vulnerabilities. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated or required beyond applying the vendor-provided update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:19943
- Cve Count
- 7
- Additional Cves
- ["CVE-2025-11709","CVE-2025-11710","CVE-2025-11711","CVE-2025-11712","CVE-2025-11714","CVE-2025-11715"]
Threat ID: 6a419cad27e9c79719ab9e19
Added to database: 06/28/2026, 22:14:05 UTC
Last enriched: 06/28/2026, 22:23:03 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.