The Red Hat security advisory RHSA-2024:9017 addresses multiple vulnerabilities in Mozilla Thunderbird, including CVE-2024-10458 (permission leak via embed or object elements), CVE-2024-10459 (use-after-free in layout with accessibility), CVE-2024-10460 (confusing display of origin for external protocol handler prompt), CVE-2024-10461 (XSS due to Content-Disposition being ignored), CVE-2024-10462 (origin of permission prompt spoofed by long URL), CVE-2024-10463 (cross origin video frame leak), CVE-2024-10464 (history interface causing denial of service), CVE-2024-10465 (clipboard paste button persisted across tabs), CVE-2024-10466 (DOM push subscription message could hang Firefox), and CVE-2024-10467 (memory safety bugs). These vulnerabilities affect Thunderbird as packaged for Red Hat Enterprise Linux 8.6 and related update services. The advisory provides updated Thunderbird packages (version 128.4.0-1.el8_6) to remediate these issues.

The vulnerabilities collectively could lead to unauthorized permission leaks, denial of service conditions, cross-site scripting attacks, use-after-free memory corruption, UI spoofing, and memory safety issues within Thunderbird. These could potentially impact the confidentiality, integrity, and availability of the mail client. The advisory rates the overall security impact as moderate.

Red Hat has released updated Thunderbird packages (version 128.4.0-1.el8_6) for Red Hat Enterprise Linux 8.6 and related update services that address these vulnerabilities. Users and administrators should apply these official security updates promptly to remediate the issues. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigations beyond applying the update are specified.