Red Hat Product Security issued an advisory (RHSA-2025:8630) for Mozilla Thunderbird addressing nine security vulnerabilities (CVE-2025-4918, CVE-2025-4919, CVE-2025-5263, CVE-2025-5264, CVE-2025-5266, CVE-2025-5267, CVE-2025-5268, CVE-2025-5269, CVE-2025-5283). The issues include out-of-bounds access when resolving Promise objects and optimizing linear sums, a clickjacking vulnerability that could leak saved payment card details, potential local code execution via the 'Copy as cURL' command, multiple memory safety bugs, leakage of cross-origin resource status through script element events, and improper error handling isolation for script execution. These vulnerabilities affect the Thunderbird package in Red Hat Enterprise Linux 8.4 AUS. The advisory rates the update as Important and provides a security update to remediate these issues.

The vulnerabilities collectively pose risks including memory corruption (out-of-bounds access), potential leakage of sensitive information (saved payment card details), local code execution, and cross-origin information leaks. These could lead to unauthorized access or execution within the Thunderbird client, compromising user data confidentiality and integrity. However, no known exploits in the wild have been reported at this time.

A security update for Thunderbird is available for Red Hat Enterprise Linux 8.4 AUS. Users should apply the update as described in the Red Hat advisory RHSA-2025:8630 to remediate these vulnerabilities. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.