This advisory covers three security vulnerabilities in Mozilla Thunderbird as distributed by Red Hat for RHEL 8.4. CVE-2025-3523 involves UI misrepresentation of attachment URLs, potentially misleading users about attachment sources. CVE-2025-2830 concerns information disclosure through listing of the /tmp directory. CVE-2025-3522 involves leakage of hashed Windows credentials via crafted attachment URLs. Red Hat has released Thunderbird version 128.9.2-1.el8_4 to address these issues. The update is classified as important and applies to multiple RHEL 8.4 variants. No CVSS scores are provided in the advisory. No known exploits in the wild have been reported at this time.

Successful exploitation of these vulnerabilities could lead to user interface deception, unauthorized disclosure of temporary directory contents, and leakage of hashed Windows credentials. This could facilitate further attacks such as phishing or credential compromise. The vulnerabilities affect Thunderbird mail client users on Red Hat Enterprise Linux 8.4 systems. The overall security impact is rated as important by Red Hat, indicating a high risk if unpatched.

Red Hat has released an official security update for Thunderbird version 128.9.2-1.el8_4 that addresses these vulnerabilities. Users should apply this update promptly to remediate the issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. Since this is a packaged product update, patching the Thunderbird package as provided by Red Hat is the recommended mitigation. No additional vendor advisories indicate that no action is required or that the issues are already mitigated.