This advisory covers a security update for Mozilla Thunderbird provided by Red Hat, upgrading the software to version 115.11.0. It fixes six distinct vulnerabilities originally identified in Firefox components that Thunderbird shares, including CVE-2024-4367 (arbitrary JavaScript execution in PDF.js), CVE-2024-4767 (IndexedDB files retained in private browsing mode), CVE-2024-4768 (permissions request bypass via clickjacking), CVE-2024-4769 (cross-origin response content-type distinction), CVE-2024-4770 (use-after-free when printing to PDF), and CVE-2024-4777 (memory safety bugs). The update is classified as important by Red Hat and applies to Red Hat Enterprise Linux 8.6 Extended Update Support versions prior to 115.11.0.

Exploitation of these vulnerabilities could allow arbitrary JavaScript execution, privacy breaches through retained IndexedDB files in private browsing, bypassing of permission requests, information disclosure via cross-origin response handling, use-after-free memory corruption potentially leading to crashes or code execution, and other memory safety issues. The overall impact is rated high, indicating significant risk to confidentiality, integrity, and availability if unpatched.

A security update is available that upgrades Thunderbird to version 115.11.0, which addresses all listed vulnerabilities. Users of affected Red Hat Enterprise Linux 8.6 Extended Update Support versions should apply this update promptly. Red Hat advises ensuring all previously released errata relevant to the system are applied before updating. No additional mitigations are indicated by the vendor advisory.