This advisory covers a set of nine security vulnerabilities in Mozilla Thunderbird related to the Firefox codebase, including CVE-2025-8027, CVE-2025-8028, CVE-2025-8029, CVE-2025-8030, CVE-2025-8031, CVE-2025-8032, CVE-2025-8033, CVE-2025-8034, and CVE-2025-8035. The issues include a large branch table leading to truncated instructions, multiple memory safety bugs, incorrect URL stripping in CSP reports, partial return value writes in the JavaScript engine, potential user-assisted code execution via the 'Copy as cURL' command, incorrect JavaScript state machine behavior for generators, CSP bypass via XSLT documents, and execution of javascript: URLs on object and embed tags. Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 8.8 and related update services to address these vulnerabilities.

The vulnerabilities collectively pose risks including memory safety errors that could lead to crashes or code execution, bypasses of security policies such as CSP, and potential user-assisted code execution. These issues could allow attackers to execute arbitrary code or bypass security restrictions within the Thunderbird client, potentially compromising user data or system integrity. The severity is rated as high by Red Hat Product Security.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 8.8 and related update services that address these vulnerabilities. Users and administrators should apply the provided security update as detailed in the Red Hat advisory RHSA-2025:13650 and the update instructions at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official update.