This advisory covers a set of nine security vulnerabilities impacting Mozilla Thunderbird as distributed by Red Hat Enterprise Linux 8. The vulnerabilities include race conditions (CVE-2025-13012), mitigation bypasses in DOM security components (CVE-2025-13013, CVE-2025-13018), use-after-free bugs in Audio/Video and WebRTC components (CVE-2025-13014, CVE-2025-13020), same-origin policy bypasses in DOM workers and notifications components (CVE-2025-13019, CVE-2025-13017), a spoofing issue (CVE-2025-13015), and incorrect boundary conditions in JavaScript WebAssembly (CVE-2025-13016). Red Hat has released updated Thunderbird packages to address these issues. The advisory references Red Hat Enterprise Linux 8 and its Extended Life Cycle 8.10 variants across multiple hardware architectures. No CVSS scores are provided in the advisory, but the overall severity is rated as Important by Red Hat.

The vulnerabilities collectively could allow attackers to bypass security mitigations, cause use-after-free conditions potentially leading to memory corruption, bypass same-origin policies, cause race conditions, and spoof content within Thunderbird. These issues could impact the confidentiality, integrity, and security boundaries of the application. The exact impact depends on the specific vulnerability but generally includes potential unauthorized access or execution of malicious code within the context of Thunderbird.

Red Hat has released updated Thunderbird packages that address all listed vulnerabilities. Users of Red Hat Enterprise Linux 8 and its Extended Life Cycle variants should apply the security update promptly. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. Since this is an official Red Hat security advisory with fixes available, applying the vendor-provided update is the recommended remediation. No additional mitigations are specified or required beyond applying the update.