Red Hat Product Security released an advisory (RHSA-2025:4617) for Mozilla Thunderbird addressing three security vulnerabilities: CVE-2025-3523 (UI misrepresentation of attachment URL), CVE-2025-2830 (information disclosure of /tmp directory listing), and CVE-2025-3522 (leak of hashed Windows credentials via crafted attachment URL). These vulnerabilities could allow an attacker to mislead users about attachment URLs, disclose sensitive temporary directory information, or leak hashed credentials. The advisory provides updated Thunderbird packages (version 128.9.2-1.el8_8) for Red Hat Enterprise Linux 8.8 Extended Update Support across multiple architectures. The update is rated as important by Red Hat, and no known exploits in the wild have been reported. The advisory references detailed CVE pages for further information. Patch details and installation instructions are available from Red Hat's official update article.

Successful exploitation of these vulnerabilities could lead to user interface deception regarding attachment URLs, unauthorized disclosure of temporary directory contents, and leakage of hashed Windows credentials. These impacts may facilitate further attacks such as phishing or credential compromise. However, no active exploitation has been reported. The vulnerabilities affect the confidentiality and integrity of user information handled by Thunderbird.

Red Hat has released updated Thunderbird packages (version 128.9.2-1.el8_8) that address these vulnerabilities. Users of Red Hat Enterprise Linux 8.8 Extended Update Support should apply the provided security update promptly. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation actions are indicated by the vendor advisory.