Red Hat Product Security issued an important security advisory (RHSA-2025:8628) for Mozilla Thunderbird in Red Hat Enterprise Linux 8.8, addressing multiple vulnerabilities. The fixed issues include out-of-bounds access when resolving Promise objects (CVE-2025-4918) and optimizing linear sums (CVE-2025-4919), a clickjacking vulnerability that could leak saved payment card details (CVE-2025-5267), potential local code execution via the 'Copy as cURL' command (CVE-2025-5264), several memory safety bugs (CVE-2025-5268, CVE-2025-5269), leakage of cross-origin resource status through script element events (CVE-2025-5266), and incorrect isolation of error handling for script execution from web content (CVE-2025-5263). The advisory references multiple CVEs and provides updated Thunderbird packages to remediate these issues. The update is rated with an important security impact by Red Hat.

The vulnerabilities collectively could allow attackers to cause out-of-bounds memory access, potentially leading to crashes or arbitrary code execution, leak sensitive information such as saved payment card details via clickjacking, execute code locally through crafted commands, and bypass security boundaries related to script execution and cross-origin resource status. These issues pose a high risk to confidentiality, integrity, and availability of the affected Thunderbird client on Red Hat Enterprise Linux 8.8 systems.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 8.8 that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2025:8628 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigation steps are indicated beyond applying the official update.