This Red Hat security advisory addresses five vulnerabilities in Mozilla Thunderbird and Firefox components used within Thunderbird. The issues include a privilege escalation vulnerability in the Firefox Updater (CVE-2025-2817), unsafe attribute access during XPath parsing (CVE-2025-4087), process isolation bypass using "javascript:" URI links in cross-origin frames (CVE-2025-4083), and multiple memory safety bugs fixed in Thunderbird 128.10 and Firefox 138/ESR 128.10 (CVE-2025-4091 and CVE-2025-4093). These vulnerabilities affect Red Hat Enterprise Linux 8.6 variants and have been remediated by updating Thunderbird to version 128.10.0-1.el8_6. The advisory references official Red Hat errata RHSA-2025:7690 and provides package updates for affected architectures.

The vulnerabilities collectively could allow privilege escalation, unsafe attribute access, bypass of process isolation, and memory safety issues within Thunderbird. These issues could potentially be exploited to compromise the security of the mail client environment. Red Hat rates the overall security impact as Important, indicating a high severity but not critical. There are no known exploits in the wild at the time of the advisory.

A security update for Thunderbird is available from Red Hat for Red Hat Enterprise Linux 8.6 and related variants. The update upgrades Thunderbird to version 128.10.0-1.el8_6, which includes fixes for all listed vulnerabilities. Users and administrators should apply this update promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official update.