This Red Hat security advisory addresses five vulnerabilities in Mozilla Thunderbird, including CVE-2025-2817 (privilege escalation in Firefox Updater), CVE-2025-4087 (unsafe attribute access during XPath parsing), CVE-2025-4083 (process isolation bypass using "javascript:" URI links in cross-origin frames), and two memory safety bugs (CVE-2025-4091 and CVE-2025-4093) fixed in Thunderbird 128.10 and Firefox 138/ESR 128.10. The update is provided for Red Hat Enterprise Linux 9.2 Extended Update Support across multiple architectures. The advisory references fixes tracked under Red Hat Bugzilla entries and provides RPM packages for the patched Thunderbird version 128.10.0-1.el9_2.

The vulnerabilities collectively allow for privilege escalation, unsafe access to attributes during XPath parsing, bypass of process isolation protections, and memory safety issues that could lead to crashes or potential code execution. These issues affect the security and stability of the Thunderbird mail client on affected Red Hat Enterprise Linux 9.2 systems. Exploitation could compromise user data or system integrity. No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released an updated Thunderbird package version 128.10.0-1.el9_2 for Red Hat Enterprise Linux 9.2 Extended Update Support that addresses these vulnerabilities. Users should apply this official update promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. This update includes all relevant security fixes. No additional mitigations are specified or required beyond applying the update.