This advisory covers a set of nine security vulnerabilities impacting Mozilla Thunderbird in Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. The vulnerabilities include a race condition in the graphics component (CVE-2025-13012), mitigation bypasses in DOM security components (CVE-2025-13013, CVE-2025-13018), use-after-free bugs in audio/video and WebRTC components (CVE-2025-13014, CVE-2025-13020), same-origin policy bypasses in DOM workers and notifications components (CVE-2025-13017, CVE-2025-13019), a spoofing issue (CVE-2025-13015), and incorrect boundary conditions in the JavaScript WebAssembly component (CVE-2025-13016). These vulnerabilities affect Firefox components embedded in Thunderbird and have been addressed by Red Hat in updated Thunderbird packages for multiple architectures. The advisory references Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions and provides updated package versions for affected platforms.

The vulnerabilities collectively could allow attackers to bypass security mitigations, execute use-after-free exploits, bypass same-origin policies, cause race conditions, and spoof content within the Thunderbird mail client. These issues may lead to unauthorized code execution, information disclosure, or other security breaches within the context of Thunderbird. The advisory rates the overall impact as important, indicating a high security risk if unpatched.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions that address these vulnerabilities. Users should apply the Thunderbird update as described in the Red Hat advisory (RHSA-2025:22451) available at https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigations are specified beyond applying the official update.