This Red Hat security advisory details an update to Mozilla Thunderbird, upgrading it to version 115.11.0 to address six security vulnerabilities originally identified in Firefox components. These include CVE-2024-4367 (arbitrary JavaScript execution in PDF.js), CVE-2024-4767 (IndexedDB files retained in private browsing mode), CVE-2024-4768 (permissions request bypass via clickjacking), CVE-2024-4769 (cross-origin response content-type distinction), CVE-2024-4770 (use-after-free when printing to PDF), and CVE-2024-4777 (memory safety bugs). The update fixes these vulnerabilities in Red Hat Enterprise Linux 9.0 Extended Update Support and related variants. No CVSS scores are provided in the advisory, but the update is classified as important.

The vulnerabilities fixed by this update could allow arbitrary JavaScript execution, privacy issues due to retained IndexedDB files in private browsing, bypassing of permissions requests through clickjacking, information disclosure via cross-origin content-type distinctions, use-after-free memory corruption when printing to PDF, and other memory safety issues. These could potentially lead to unauthorized code execution, privacy breaches, or application crashes in affected Thunderbird versions prior to 115.11.0.

A security update to Thunderbird version 115.11.0 is available and should be applied to affected systems. Red Hat advises ensuring all previously released errata relevant to the system are applied before updating. Detailed update instructions are available at https://access.redhat.com/articles/11258. No indication of partial or temporary mitigations is provided; applying the official update fully addresses these vulnerabilities.