This advisory covers four security vulnerabilities in Mozilla Thunderbird as packaged by Red Hat for RHEL 8.2 and 8.8 Extended Update Support. CVE-2025-3909 involves JavaScript execution triggered by spoofed PDF attachments and file:/// links. CVE-2025-3875 allows sender spoofing via malformed From headers. CVE-2025-3877 enables unsolicited file downloads, disk space exhaustion, and credential leakage through mailbox:/// links. CVE-2025-3932 concerns tracking links in attachments that bypass remote content blocking. Red Hat has issued updated Thunderbird packages (version 128.10.1-1.el8_8 and 128.10.1-1.el8_2) to address these vulnerabilities. The advisory rates the security impact as Important (high severity) but does not provide CVSS scores. No known exploits in the wild have been reported. The vendor advisory provides detailed patch information and instructions for applying updates.

Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary JavaScript code via crafted PDF attachments, spoof sender identities in emails, cause unsolicited file downloads leading to disk space exhaustion and potential credential leakage, and bypass remote content blocking through tracking links in attachments. These impacts could compromise user privacy and security within the Thunderbird mail client environment on affected Red Hat Enterprise Linux systems.

Red Hat has released updated Thunderbird packages for affected RHEL versions (notably 8.2 AUS and 8.8 Extended Update Support) that fix these vulnerabilities. Users should apply these official updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory beyond applying the provided patches.