This advisory covers several security vulnerabilities in Mozilla Thunderbird related to memory safety and privilege management, including CVE-2025-11708 (use-after-free in MediaTrackGraphImpl::GetInstance()), CVE-2025-11709 (out-of-bounds read/write triggered by WebGL textures), CVE-2025-11710 (cross-process information leak via malicious IPC messages), CVE-2025-11711 (modification of non-writable object properties), CVE-2025-11712 (OBJECT tag type attribute overriding browser behavior), CVE-2025-11714 and CVE-2025-11715 (memory safety bugs). These vulnerabilities were fixed in Thunderbird ESR 140.4 and Thunderbird 144, with Red Hat providing updated packages for Red Hat Enterprise Linux 8 and its extended life cycle variants. The advisory does not provide CVSS scores but rates the impact as important.

The vulnerabilities include memory safety bugs such as use-after-free and out-of-bounds read/write, which could lead to crashes or potentially arbitrary code execution. Cross-process information leaks could expose sensitive data between processes. Modification of non-writable object properties and overriding browser behavior could affect application integrity and security. Collectively, these issues pose a high risk to the confidentiality, integrity, and availability of the affected Thunderbird clients.

Red Hat has released updated Thunderbird packages (version 140.4.0-2.el8_10 and corresponding builds) for Red Hat Enterprise Linux 8 and its extended life cycle variants that address these vulnerabilities. Users should apply these official updates promptly. For detailed update instructions, refer to Red Hat's advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the provided security update.