This Red Hat security advisory addresses several vulnerabilities in Mozilla Thunderbird by upgrading it to version 115.11.0. The fixed issues include CVE-2024-4367 (arbitrary JavaScript execution in PDF.js), CVE-2024-4767 (IndexedDB files retained in private browsing mode), CVE-2024-4768 (permissions request bypass via clickjacking), CVE-2024-4769 (cross-origin response content-type distinction), CVE-2024-4770 (use-after-free when printing to PDF), and CVE-2024-4777 (memory safety bugs). These vulnerabilities stem from Firefox components embedded in Thunderbird and have been addressed in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. The advisory affects Red Hat Enterprise Linux 8.4 variants and related update services. No CVSS scores are provided in the advisory, but Red Hat rates the update as important.

The vulnerabilities fixed in this update could allow arbitrary JavaScript execution, privacy leaks through retained IndexedDB files in private browsing mode, bypass of permissions requests via clickjacking, information disclosure through cross-origin response content-type distinctions, use-after-free conditions leading to potential memory corruption, and other memory safety issues. These issues collectively pose a high security risk, potentially enabling code execution, privacy violations, or application crashes if exploited. However, no known exploits in the wild have been reported at this time.

A security update is available that upgrades Thunderbird to version 115.11.0, which addresses all listed vulnerabilities. Users and administrators should apply this update promptly. Before applying this update, ensure all previously released errata relevant to your system have been applied. Follow Red Hat's official guidance for applying updates at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the update.