This Red Hat security advisory addresses a set of vulnerabilities in Mozilla Thunderbird, including CVE-2024-10458 and nine other related CVEs. The issues range from permission leaks via embed or object elements, use-after-free bugs in layout accessibility, XSS vulnerabilities due to improper handling of Content-Disposition headers, denial of service via the history interface, cross-origin video frame leaks, spoofing of permission prompt origins, and memory safety bugs. These vulnerabilities have been fixed in Thunderbird 128.4 and Firefox 132 releases. The advisory applies to Red Hat Enterprise Linux 8.2 and provides updated Thunderbird packages to mitigate these risks.

The vulnerabilities collectively could allow attackers to cause denial of service conditions, execute cross-site scripting attacks, leak permissions, exploit use-after-free memory errors, and spoof UI elements related to permission prompts. These issues could affect the confidentiality, integrity, and availability of the Thunderbird client and potentially impact user security and privacy. The security impact is rated as Moderate by Red Hat.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 8.2 (Thunderbird 128.4) that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2024:9016 and the related article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigation steps are indicated beyond applying the official update.