This Red Hat security advisory (RHSA-2024:2888) addresses several vulnerabilities in Mozilla Thunderbird by upgrading it to version 115.11.0. The fixed issues include CVE-2024-4367 (arbitrary JavaScript execution in PDF.js), CVE-2024-4767 (IndexedDB files retained in private browsing mode), CVE-2024-4768 (permissions request bypass via clickjacking), CVE-2024-4769 (cross-origin response content-type distinction), CVE-2024-4770 (use-after-free when printing to PDF), and CVE-2024-4777 (memory safety bugs). These vulnerabilities stem from Firefox components integrated into Thunderbird. The update is intended for Red Hat Enterprise Linux 9 and its Extended Update Support variants. No CVSS scores are provided in the advisory, but the issues are rated as important by Red Hat Product Security.

The vulnerabilities fixed in this update could allow arbitrary JavaScript execution, privacy leaks via retained IndexedDB files in private browsing, bypass of permissions requests through clickjacking, information disclosure through cross-origin response content-type distinctions, use-after-free memory corruption when printing to PDF, and other memory safety issues. These flaws could potentially be exploited to compromise user security and privacy when using Thunderbird. The update mitigates these risks by patching the underlying Firefox components within Thunderbird.

A security update to Thunderbird version 115.11.0 is available from Red Hat and should be applied to affected systems. The update addresses all listed vulnerabilities. Before applying this update, ensure all previously released errata relevant to your system have been applied. Follow Red Hat's official guidance for applying updates: https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor.