Red Hat Product Security has published an advisory (RHSA-2025:4389) for Mozilla Thunderbird vulnerabilities affecting Red Hat Enterprise Linux 8.2 AUS. The advisory addresses three vulnerabilities: CVE-2025-3523 involves user interface misrepresentation of attachment URLs, CVE-2025-2830 concerns information disclosure of the /tmp directory listing, and CVE-2025-3522 relates to leakage of hashed Windows credentials through crafted attachment URLs. The advisory provides updated Thunderbird packages (version 128.9.2-1.el8_2) that fix these issues. No CVSS scores are provided in the advisory, but the severity is rated as Important by Red Hat. The vendor advisory includes instructions for applying the update and references to the CVE pages for further details.

Successful exploitation of these vulnerabilities could lead to user interface deception potentially tricking users about attachment URLs, unauthorized disclosure of temporary directory contents, and leakage of hashed Windows credentials. These impacts may facilitate further attacks or unauthorized access to sensitive information. The advisory rates the overall security impact as Important, indicating a high risk to affected systems if unpatched.

A security update for Mozilla Thunderbird is available for Red Hat Enterprise Linux 8.2 AUS (thunderbird-128.9.2-1.el8_2). Users should apply this update promptly to remediate the vulnerabilities. Detailed update instructions are provided in the Red Hat advisory article https://access.redhat.com/articles/11258. No indication is given that these issues are already mitigated or require no action; therefore, applying the official update is the recommended mitigation.