Red Hat Product Security issued an advisory (RHSA-2024:8726) for Mozilla Firefox and Thunderbird addressing ten distinct security vulnerabilities. These include a permission leak via embed or object elements (CVE-2024-10458), use-after-free in layout with accessibility (CVE-2024-10459), XSS due to ignored Content-Disposition headers (CVE-2024-10461), denial of service via history interface (CVE-2024-10464), memory safety bugs (CVE-2024-10467), and others affecting UI prompts and clipboard behavior. The fixes are incorporated in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4 packages for Red Hat Enterprise Linux 9 and its extended support variants. The advisory provides detailed references and patch information for affected Red Hat Enterprise Linux 9 variants across multiple architectures.

The vulnerabilities collectively could allow attackers to cause denial of service conditions, execute cross-site scripting attacks, leak permissions, trigger use-after-free memory corruption, cause browser hangs, leak cross-origin video frames, and spoof UI permission prompts. These issues impact the security and stability of Firefox and Thunderbird on affected Red Hat Enterprise Linux 9 systems. The advisory rates the overall security impact as moderate, reflecting the range of issues from memory safety to UI spoofing and permission leaks.

Red Hat has released updated Firefox and Thunderbird packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 9 and its extended update and life cycle support versions should apply the available security updates as described in the Red Hat advisory RHSA-2024:8726. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigations are indicated beyond applying the official patches.