Red Hat Product Security has released an advisory (RHSA-2025:4665) for Mozilla Thunderbird vulnerabilities affecting Red Hat Enterprise Linux 8.6. The vulnerabilities include UI misrepresentation of attachment URLs (CVE-2025-3523), information disclosure of the /tmp directory listing (CVE-2025-2830), and leakage of hashed Windows credentials via crafted attachment URLs (CVE-2025-3522). These issues could potentially expose sensitive information or mislead users about attachment sources. Red Hat has provided updated Thunderbird packages (version 128.9.2-1.el8_6) to fix these vulnerabilities. The advisory rates the update as Important and directs users to apply the update as detailed in Red Hat's documentation.

The vulnerabilities collectively could lead to information disclosure, including exposure of temporary directory contents and hashed Windows credentials, as well as user interface misrepresentation that might mislead users about attachment URLs. This may increase the risk of unauthorized information access or phishing attacks. However, no known exploits in the wild have been reported at this time.

Red Hat has released updated Thunderbird packages (version 128.9.2-1.el8_6) for Red Hat Enterprise Linux 8.6 variants that address these vulnerabilities. Users should apply these official updates as per Red Hat's guidance at https://access.redhat.com/articles/11258 to remediate the issues. No additional mitigation steps are indicated by the vendor advisory.