This advisory covers three security vulnerabilities in Mozilla Thunderbird affecting Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. The vulnerabilities include UI misrepresentation of attachment URLs (CVE-2025-3523), which could mislead users; information disclosure of the /tmp directory listing (CVE-2025-2830), potentially exposing sensitive temporary files; and leakage of hashed Windows credentials via crafted attachment URLs (CVE-2025-3522). Red Hat has issued an update (thunderbird-128.9.2-1.el9_0) that fixes these issues across multiple architectures including ppc64le, x86_64, aarch64, and s390x. The advisory is classified as Important by Red Hat Product Security.

Successful exploitation of these vulnerabilities could lead to user interface deception, unauthorized disclosure of temporary directory contents, and leakage of hashed Windows credentials. This may result in information disclosure and potential compromise of user credentials. The issues affect the Thunderbird mail client as distributed by Red Hat for Enterprise Linux 9.0 Update Services for SAP Solutions.

Red Hat has released an official security update for Thunderbird version 128.9.2-1.el9_0 that addresses these vulnerabilities. Users and administrators should apply this update promptly using Red Hat's standard update mechanisms. For detailed update instructions, refer to Red Hat's advisory and article at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the provided update.