This advisory covers several security fixes for Mozilla Thunderbird distributed with Red Hat Enterprise Linux 9.4 Extended Update Support. The vulnerabilities include sandbox escapes caused by use-after-free (CVE-2025-10527) and undefined behavior with invalid pointers (CVE-2025-10528) in the Graphics Canvas2D component, incorrect boundary conditions in the JavaScript garbage collection component (CVE-2025-10532), a same-origin policy bypass in the Layout component (CVE-2025-10529), memory safety bugs fixed in Thunderbird ESR 140.3 (CVE-2025-10537), information disclosure in the Networking Cache component (CVE-2025-10536), and an integer overflow in the SVG component (CVE-2025-10533). These vulnerabilities collectively pose risks including sandbox escapes, policy bypass, information disclosure, and memory corruption. The fixes are included in Thunderbird ESR 140.3.0-1.el9_4 and corresponding Firefox versions.

The vulnerabilities allow for potential sandbox escapes, which could enable an attacker to break out of restricted execution environments. The same-origin policy bypass could allow unauthorized access to web content. Memory safety bugs and integer overflow issues could lead to crashes or arbitrary code execution. Information disclosure vulnerabilities could leak sensitive data. Overall, these issues pose a high security risk to affected systems running vulnerable Thunderbird versions.

Red Hat has released an updated Thunderbird package (version 140.3.0-1.el9_4) for Red Hat Enterprise Linux 9.4 Extended Update Support that addresses these vulnerabilities. Users should apply this update promptly to remediate the security issues. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.