Red Hat Product Security issued an advisory (RHSA-2024:9019) for Mozilla Thunderbird addressing ten security vulnerabilities (CVE-2024-10458 through CVE-2024-10467). The flaws include a permission leak via embed or object elements, use-after-free in layout with accessibility, XSS due to ignored Content-Disposition headers, denial of service via the history interface, memory safety bugs, clipboard UI persistence issues, DOM push subscription hangs, cross-origin video frame leaks, and spoofing of permission prompt origins. These issues affect Thunderbird as packaged for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions on multiple architectures (ppc64le, x86_64, aarch64, s390x). The advisory provides updated Thunderbird packages (version 128.4.0-1.el9_0) that fix these vulnerabilities.

The vulnerabilities collectively could allow attackers to cause denial of service conditions, execute cross-site scripting attacks, leak permissions, trigger use-after-free memory corruption, cause application hangs, leak cross-origin video frames, and spoof permission prompts. These issues may lead to reduced confidentiality, integrity, and availability of the Thunderbird client. However, no known exploits in the wild have been reported at the time of the advisory. The overall security impact is rated as moderate by Red Hat.

Red Hat has released updated Thunderbird packages (version 128.4.0-1.el9_0) for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions that address these vulnerabilities. Users should apply these official updates promptly to remediate the issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.