This advisory covers a set of nine security vulnerabilities in Mozilla Thunderbird as packaged by Red Hat for RHEL 9.0 Update Services for SAP Solutions. The vulnerabilities include a large branch table issue leading to truncated instructions (CVE-2025-8028), multiple memory safety bugs (CVE-2025-8034, CVE-2025-8035), incorrect URL stripping in Content Security Policy (CSP) reports (CVE-2025-8031), partial return value writes in the JavaScript engine stack (CVE-2025-8027), potential user-assisted code execution via the 'Copy as cURL' command (CVE-2025-8030), incorrect JavaScript state machine behavior for generators (CVE-2025-8033), CSP bypass via XSLT documents (CVE-2025-8032), and execution of javascript: URLs on object and embed tags (CVE-2025-8029). Red Hat has released an update to address these issues in Thunderbird version 128.13.0-3.el9_0 for multiple architectures. No CVSS scores are provided in the advisory, but the overall impact is rated as important.

The vulnerabilities collectively impact the security of Mozilla Thunderbird by potentially allowing memory corruption, partial code execution, bypass of security policies such as CSP, and user-assisted code execution. These issues could lead to compromised confidentiality, integrity, or availability of the mail client or the underlying system if exploited. The exact impact varies per vulnerability but includes risks such as truncated instructions, memory safety violations, and execution of malicious JavaScript code.

Red Hat has released an official security update for Thunderbird (version 128.13.0-3.el9_0) that addresses all listed vulnerabilities. Users of Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions should apply this update promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated or required beyond applying the vendor-provided update.