This Red Hat security advisory addresses five vulnerabilities in Mozilla Thunderbird and related Firefox components. The issues include a denial-of-service caused by out-of-memory in the Graphics WebRender component (CVE-2025-9182), a sandbox escape due to an invalid pointer in the Audio/Video GMP component (CVE-2025-9179), a same-origin policy bypass in the Graphics Canvas2D component (CVE-2025-9180), uninitialized memory usage in the JavaScript Engine (CVE-2025-9181), and multiple memory safety bugs fixed in recent ESR and standard releases (CVE-2025-9185). These vulnerabilities affect Thunderbird and Firefox ESR versions as specified in the advisory. The update is provided for Red Hat Enterprise Linux 8.4 Extended Update Support and Advanced Update Support. No CVSS scores are provided in the advisory.

The vulnerabilities collectively could allow denial-of-service conditions, sandbox escapes, bypass of same-origin policy, and memory safety issues that may lead to potential security breaches. The sandbox escape and same-origin policy bypass could undermine security boundaries within Thunderbird, potentially allowing unauthorized code execution or data access. The denial-of-service vulnerability could disrupt service availability. Memory safety bugs increase the risk of crashes or exploitation. However, no known exploits in the wild have been reported at this time.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 8.4 Extended Update Support and Advanced Update Support that address these vulnerabilities. Users should apply the available security update as described in the Red Hat advisory RHSA-2025:15496 and the referenced article https://access.redhat.com/articles/11258. This update includes fixes for all listed CVEs. No additional mitigation steps are indicated beyond applying the official update.