This Red Hat security advisory upgrades Thunderbird to version 115.11.0 to fix six security vulnerabilities tracked under CVE-2024-4367, CVE-2024-4767, CVE-2024-4768, CVE-2024-4769, CVE-2024-4770, and CVE-2024-4777. The vulnerabilities include arbitrary JavaScript execution in PDF.js, IndexedDB files not being cleared in private browsing mode, a permissions request bypass via clickjacking, the ability to distinguish cross-origin responses by content-type, a use-after-free condition when printing to PDF, and multiple memory safety bugs. These issues stem from Firefox components integrated into Thunderbird and have been fixed in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. The update is available for Red Hat Enterprise Linux 8.8 Extended Update Support and related platforms.

The vulnerabilities fixed in this update could allow an attacker to execute arbitrary JavaScript code, bypass permissions requests, distinguish cross-origin content types, and cause use-after-free conditions leading to potential memory corruption. These issues may compromise user privacy and security when handling PDF files, private browsing sessions, or permissions dialogs within Thunderbird. The memory safety bugs also pose risks of crashes or exploitation. Red Hat rates the security impact as important, indicating a high risk to affected systems if unpatched.

Red Hat has released an official security update upgrading Thunderbird to version 115.11.0 that addresses all listed vulnerabilities. Users should apply this update promptly. Before applying, ensure all previously released errata relevant to your system are installed. Detailed update instructions are available from Red Hat's official documentation. No additional mitigations are required beyond applying the update.