This Red Hat security advisory addresses a set of ten vulnerabilities in Mozilla Thunderbird, including CVE-2024-10458 (permission leak via embed or object elements), CVE-2024-10459 (use-after-free in layout with accessibility), CVE-2024-10460 (confusing display of origin for external protocol handler prompt), CVE-2024-10461 (XSS due to Content-Disposition being ignored), CVE-2024-10462 (origin of permission prompt spoofing), CVE-2024-10463 (cross origin video frame leak), CVE-2024-10464 (denial of service via history interface), CVE-2024-10465 (clipboard paste button persisted across tabs), CVE-2024-10466 (DOM push subscription message hang), and CVE-2024-10467 (memory safety bugs). These vulnerabilities affect Thunderbird as packaged for Red Hat Enterprise Linux 8 and have been fixed in Thunderbird version 128.4.0. The advisory includes updated RPM packages for multiple architectures and references Red Hat's official errata for remediation instructions.

The vulnerabilities collectively could lead to denial of service conditions, cross-site scripting attacks, permission leaks, use-after-free memory corruption, memory safety issues, UI spoofing, and potential hangs in the application. These issues may impact the confidentiality, integrity, and availability of the Thunderbird mail client on affected systems. The overall security impact is rated as moderate by Red Hat Product Security.

A security update for Thunderbird is available for Red Hat Enterprise Linux 8, specifically version 128.4.0-1.el8_10 and later. Users should apply the update as provided by Red Hat to remediate these vulnerabilities. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.