This Red Hat security advisory addresses several vulnerabilities in Mozilla Thunderbird related to Firefox components, including CVE-2025-11708 (use-after-free in MediaTrackGraphImpl::GetInstance), CVE-2025-11709 (out-of-bounds read/write triggered by WebGL textures), CVE-2025-11710 (cross-process information leak via malicious IPC messages), CVE-2025-11711 (modification of non-writable Object properties), CVE-2025-11712 (OBJECT tag type attribute overriding browser behavior), CVE-2025-11714 and CVE-2025-11715 (memory safety bugs). These issues affect Thunderbird ESR 140.4 and Thunderbird 144 versions. The advisory provides updated packages for Red Hat Enterprise Linux 9 and its extended update support variants on multiple architectures including x86_64, s390x, ppc64le, and aarch64. The vulnerabilities have been rated as important/high severity by Red Hat. No known exploits in the wild have been reported at the time of the advisory.

The vulnerabilities include memory safety bugs, use-after-free conditions, out-of-bounds memory access, cross-process information leaks, and improper handling of web content attributes. These issues could potentially lead to crashes, information disclosure, or unauthorized modification of object properties within Thunderbird. The impact is rated as high severity by Red Hat Product Security. No known active exploitation has been reported.

A security update for Thunderbird is available from Red Hat for Red Hat Enterprise Linux 9 and its extended update support versions. Users should apply the Thunderbird update to versions ESR 140.4 or 144 as provided by Red Hat to remediate these vulnerabilities. Refer to the Red Hat advisory RHSA-2025:18321 and the article https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigation steps are indicated beyond applying the official update.