Mozilla Firefox and Thunderbird are affected by several vulnerabilities. Attackers can use them to escalate privileges, bypass security controls, expose confidential information, manipulate data, deceive you and, under some conditions, execute malicious code or crash the system.
Some of the flaws need something extra to work: particular permissions, specific conditions or an interaction on your part, usually opening a malicious file or web page. With Thunderbird that risk moves into your inbox, where files and content from strangers arrive daily and uninvited.
Mozilla has published updates. In Firefox you find the version under Help and About Firefox, in Thunderbird under Help and About Thunderbird. Both download the update from there, but it only takes effect once you restart. Installed from your Linux distribution's repositories, it arrives through the package manager instead.