This advisory covers three security vulnerabilities in Mozilla Thunderbird as packaged by Red Hat for Red Hat Enterprise Linux 10. CVE-2025-3029 is a URL bar spoofing vulnerability involving non-BMP Unicode characters that could mislead users about the destination of links. CVE-2025-3028 is a use-after-free vulnerability triggered by the XSLTProcessor component, which could lead to memory corruption. CVE-2025-3030 addresses multiple memory safety bugs fixed in Thunderbird 137 and Firefox 137 branches. Red Hat has released updated Thunderbird packages (version 128.9.0-2.el10_0) that include these fixes. The advisory references Red Hat's errata RHSA-2025:7493 and provides links for update instructions. The update is classified as Important, indicating a high severity level but not critical. No CVSS scores are provided in the advisory.

Successful exploitation of these vulnerabilities could allow an attacker to spoof URLs in the Thunderbird user interface, potentially misleading users to malicious sites (CVE-2025-3029). The use-after-free vulnerability (CVE-2025-3028) and memory safety bugs (CVE-2025-3030) could lead to memory corruption, which might be leveraged for arbitrary code execution or application crashes. However, no known exploits in the wild have been reported. The vulnerabilities affect the security and integrity of the Thunderbird mail client on affected Red Hat Enterprise Linux 10 systems.

Red Hat has released updated Thunderbird packages (version 128.9.0-2.el10_0) that address these vulnerabilities. Users and administrators should apply the security update promptly by following the instructions in the Red Hat advisory RHSA-2025:7493 and the referenced article https://access.redhat.com/articles/11258. Since this is an official fix from Red Hat, applying the update fully mitigates the described vulnerabilities. No additional mitigation steps are indicated by the vendor.