This Red Hat security advisory addresses five vulnerabilities affecting Mozilla Thunderbird in Red Hat Enterprise Linux 8.4. The issues include CVE-2025-2817 (privilege escalation in Firefox Updater), CVE-2025-4087 (unsafe attribute access during XPath parsing), CVE-2025-4083 (process isolation bypass using "javascript:" URI links in cross-origin frames), and two memory safety bugs (CVE-2025-4091 and CVE-2025-4093) fixed in Thunderbird 128.10 and Firefox ESR 128.10. Red Hat has released updated Thunderbird packages (version 128.10.0-1.el8_4) for multiple RHEL 8.4 variants including Extended Update Support, Update Services for SAP Solutions, and Telecommunications Update Service. The advisory references Red Hat Bugzilla entries for each CVE and provides links for applying the update. No CVSS scores are provided in the advisory, but Red Hat rates the update as Important.

The vulnerabilities collectively allow privilege escalation, unsafe attribute access potentially leading to unauthorized data exposure or manipulation, bypass of process isolation protections, and memory safety issues that could lead to crashes or arbitrary code execution. These issues affect Thunderbird users on Red Hat Enterprise Linux 8.4 platforms. Exploitation could compromise the confidentiality, integrity, or availability of the affected system or user data.

Red Hat has released updated Thunderbird packages (version 128.10.0-1.el8_4) that address these vulnerabilities. Users of Red Hat Enterprise Linux 8.4 variants should apply the Thunderbird update as detailed in Red Hat advisory RHSA-2025:7691 and the referenced article https://access.redhat.com/articles/11258. Applying this update remediates the identified security issues. No additional mitigation actions are specified or required beyond applying the official update.