Red Hat Security Advisory: firefox security update
Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in a Red Hat Enterprise Linux 8 update. These include memory safety bugs, incorrect URL handling in Content Security Policy (CSP) reports, partial return value writes in the JavaScript engine, potential user-assisted code execution via the 'Copy as cURL' command, and bypasses of CSP through XSLT documents. The update is rated as important by Red Hat Product Security and affects various architectures of Red Hat Enterprise Linux 8.
AI Analysis
Technical Summary
This advisory covers a set of nine security vulnerabilities in Mozilla Firefox and Thunderbird as packaged by Red Hat for Red Hat Enterprise Linux 8. The issues include a large branch table leading to truncated instructions (CVE-2025-8028), multiple memory safety bugs (CVE-2025-8034, CVE-2025-8035), incorrect URL stripping in CSP reports (CVE-2025-8031), partial return value writes in the JavaScript engine stack (CVE-2025-8027), potential user-assisted code execution via the 'Copy as cURL' command (CVE-2025-8030), incorrect JavaScript state machine behavior for generators (CVE-2025-8033), CSP bypass via XSLT documents (CVE-2025-8032), and execution of javascript: URLs on object and embed tags (CVE-2025-8029). Red Hat has released updated Firefox packages for multiple architectures to address these vulnerabilities.
Potential Impact
The vulnerabilities collectively pose risks including memory safety issues that could lead to crashes or code execution, CSP bypasses that weaken web security policies, and potential user-assisted code execution through browser features. These issues could be exploited to compromise the confidentiality, integrity, or availability of the affected systems running Red Hat Enterprise Linux 8 with the vulnerable Firefox and Thunderbird packages.
Mitigation Recommendations
Red Hat has released updated Firefox packages for Red Hat Enterprise Linux 8 and its Extended Life Cycle versions across multiple architectures. Users should apply these official updates promptly to remediate the vulnerabilities. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the vendor-provided patches.
Red Hat Security Advisory: firefox security update
Description
Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in a Red Hat Enterprise Linux 8 update. These include memory safety bugs, incorrect URL handling in Content Security Policy (CSP) reports, partial return value writes in the JavaScript engine, potential user-assisted code execution via the 'Copy as cURL' command, and bypasses of CSP through XSLT documents. The update is rated as important by Red Hat Product Security and affects various architectures of Red Hat Enterprise Linux 8.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers a set of nine security vulnerabilities in Mozilla Firefox and Thunderbird as packaged by Red Hat for Red Hat Enterprise Linux 8. The issues include a large branch table leading to truncated instructions (CVE-2025-8028), multiple memory safety bugs (CVE-2025-8034, CVE-2025-8035), incorrect URL stripping in CSP reports (CVE-2025-8031), partial return value writes in the JavaScript engine stack (CVE-2025-8027), potential user-assisted code execution via the 'Copy as cURL' command (CVE-2025-8030), incorrect JavaScript state machine behavior for generators (CVE-2025-8033), CSP bypass via XSLT documents (CVE-2025-8032), and execution of javascript: URLs on object and embed tags (CVE-2025-8029). Red Hat has released updated Firefox packages for multiple architectures to address these vulnerabilities.
Potential Impact
The vulnerabilities collectively pose risks including memory safety issues that could lead to crashes or code execution, CSP bypasses that weaken web security policies, and potential user-assisted code execution through browser features. These issues could be exploited to compromise the confidentiality, integrity, or availability of the affected systems running Red Hat Enterprise Linux 8 with the vulnerable Firefox and Thunderbird packages.
Mitigation Recommendations
Red Hat has released updated Firefox packages for Red Hat Enterprise Linux 8 and its Extended Life Cycle versions across multiple architectures. Users should apply these official updates promptly to remediate the vulnerabilities. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the vendor-provided patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:11747
- Cve Count
- 9
- Additional Cves
- ["CVE-2025-8028","CVE-2025-8029","CVE-2025-8030","CVE-2025-8031","CVE-2025-8032","CVE-2025-8033","CVE-2025-8034","CVE-2025-8035"]
- Cvss Version
- null
Threat ID: 6a3cc29f4853345fc16d44b9
Added to database: 06/25/2026, 05:54:39 UTC
Last enriched: 06/25/2026, 06:00:55 UTC
Last updated: 06/25/2026, 06:20:49 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.