Red Hat issued a security advisory (RHSA-2025:22883) for Mozilla Thunderbird on Red Hat Enterprise Linux 8.6 addressing nine distinct vulnerabilities originally identified in Firefox components. The vulnerabilities include race conditions (CVE-2025-13012), mitigation bypasses in DOM security components (CVE-2025-13013, CVE-2025-13018), use-after-free bugs in Audio/Video and WebRTC components (CVE-2025-13014, CVE-2025-13020), same-origin policy bypasses in DOM Workers and Notifications components (CVE-2025-13019, CVE-2025-13017), a spoofing issue (CVE-2025-13015), and incorrect boundary conditions in JavaScript WebAssembly components (CVE-2025-13016). These vulnerabilities affect Thunderbird as packaged by Red Hat and are addressed by updated packages provided in the advisory. The vendor rates the update as important and provides detailed patch packages for Red Hat Enterprise Linux 8.6 variants. No CVSS scores are included in the advisory.

The vulnerabilities collectively could allow attackers to bypass security mitigations, exploit use-after-free conditions, bypass same-origin policies, cause race conditions, and perform spoofing attacks within the Thunderbird mail client environment. These issues may lead to unauthorized actions, information disclosure, or compromised integrity of the application. However, no known exploits in the wild have been reported. The impact is significant enough for Red Hat to rate the update as important.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 8.6 variants that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2025:22883 and the referenced article https://access.redhat.com/articles/11258 to remediate the issues. No additional mitigation steps are indicated beyond applying the official update.