Red Hat Product Security issued an important security advisory (RHSA-2025:8599) for Mozilla Thunderbird included in Red Hat Enterprise Linux 9.4 Extended Update Support. The advisory addresses multiple vulnerabilities: out-of-bounds access when resolving Promise objects (CVE-2025-4918) and optimizing linear sums (CVE-2025-4919), a clickjacking vulnerability that could leak saved payment card details (CVE-2025-5267), potential local code execution via the 'Copy as cURL' command (CVE-2025-5264), several memory safety bugs (CVE-2025-5268, CVE-2025-5269), leakage of cross-origin resource status through script element events (CVE-2025-5266), and improper isolation of script execution error handling from web content (CVE-2025-5263). The advisory includes fixes for these issues in Thunderbird version 128.11.0-1.el9_4 packages for multiple architectures. No CVSS scores are provided in the advisory; however, the overall impact is rated as Important by Red Hat.

The vulnerabilities include out-of-bounds memory access which can lead to crashes or potential code execution, clickjacking that could expose saved payment card details, local code execution risks via Thunderbird's 'Copy as cURL' feature, memory safety bugs that may cause instability or exploitation, and leakage of cross-origin resource status information. These issues collectively pose risks to confidentiality, integrity, and availability of the affected systems running Thunderbird. Exploitation could allow attackers to execute arbitrary code locally or leak sensitive information.

Red Hat has released an updated Thunderbird package (version 128.11.0-1.el9_4) for Red Hat Enterprise Linux 9.4 Extended Update Support that addresses these vulnerabilities. Users should apply this official update promptly to remediate the security issues. For detailed instructions on applying the update, refer to Red Hat's advisory at https://access.redhat.com/articles/11258. No additional mitigations beyond applying the update are specified in the advisory.