Red Hat Product Security issued an advisory (RHSA-2024:7703) for Firefox and Thunderbird addressing twelve CVEs including CVE-2024-9392 through CVE-2024-9403 and CVE-2024-8900. The vulnerabilities include denial of service caused by crafted WebTransport requests, multiple memory safety and corruption bugs, potential directory upload bypass via clickjacking, enumeration of external protocol handlers via popups, and cross-origin access to PDF and JSON contents through multipart responses. The advisory covers fixes in Firefox 131, Firefox ESR 115.16 and 128.3, Thunderbird 131, and Thunderbird 128.3. The update is available for Red Hat Enterprise Linux 8.4 variants including Extended Update Support, Update Services for SAP Solutions, and Telecommunications Update Service. The advisory references detailed bugzilla entries and provides package updates for affected platforms.

Successful exploitation of these vulnerabilities could lead to denial of service, memory corruption, bypass of security mechanisms such as site isolation, unauthorized cross-origin data access, and potential directory upload bypass. These issues could compromise the security and stability of Firefox and Thunderbird on affected Red Hat Enterprise Linux 8.4 systems. The advisory rates the overall impact as important (high severity).

Red Hat has released updated Firefox packages (version 128.3.0-1.el8_4 and related) that address all listed vulnerabilities. Users of Red Hat Enterprise Linux 8.4 variants should apply these updates promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official patches.