This advisory covers a security update for Mozilla Thunderbird, upgrading it to version 115.11.0 to fix multiple vulnerabilities originally identified in Firefox components. The fixed issues include CVE-2024-4367 (arbitrary JavaScript execution in PDF.js), CVE-2024-4767 (IndexedDB files retained in private browsing mode), CVE-2024-4768 (permissions request bypass via clickjacking), CVE-2024-4769 (cross-origin response content-type distinction), CVE-2024-4770 (use-after-free when printing to PDF), and CVE-2024-4777 (memory safety bugs). These vulnerabilities affect Thunderbird as packaged in Red Hat Enterprise Linux 9 and its Extended Update Support and Extended Life Cycle variants across multiple architectures. The update is rated as important and addresses security issues that could lead to arbitrary code execution, privacy leaks, or memory corruption.

The vulnerabilities fixed in Thunderbird 115.11.0 could allow attackers to execute arbitrary JavaScript code, bypass permissions via clickjacking, retain private browsing data, distinguish cross-origin content types improperly, and trigger use-after-free conditions leading to potential memory corruption. These issues collectively pose risks including arbitrary code execution, privacy violations, and application instability. Red Hat rates the overall security impact as important.

A security update to Thunderbird version 115.11.0 is available from Red Hat and should be applied to affected systems. Red Hat advises ensuring all previously released errata relevant to the system are applied before updating. Detailed update instructions are provided in the Red Hat advisory. No additional mitigations are specified beyond applying this official update.