Red Hat Product Security issued an advisory (RHSA-2024:7700) for multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird. The update fixes issues including denial of service via specially crafted WebTransport requests (CVE-2024-9399), multiple memory safety bugs (CVE-2024-9401, CVE-2024-9402, CVE-2024-9403), potential directory upload bypass via clickjacking (CVE-2024-9397), external protocol handler enumeration (CVE-2024-9398), potential memory corruption during JIT compilation and object cloning (CVE-2024-9400, CVE-2024-9396), cross-origin access to PDF and JSON contents through multipart responses (CVE-2024-9393, CVE-2024-9394), and compromised content process bypassing site isolation (CVE-2024-9392). These vulnerabilities are addressed in Firefox versions 115.16, 128.3 ESR, and 131, and corresponding Thunderbird versions. The advisory provides updated packages for Red Hat Enterprise Linux 8 on multiple architectures.

The vulnerabilities collectively could allow denial of service, memory corruption, bypass of security controls such as site isolation, unauthorized cross-origin data access, and potential clickjacking attacks. These issues may lead to crashes, information disclosure, or escalation of privileges within the affected applications. The advisory rates the security impact as Important (high severity).

Red Hat has released updated Firefox packages (version 115.16/128.3 ESR and Firefox 131) that address these vulnerabilities. Users of Red Hat Enterprise Linux 8 should apply the provided security updates promptly to remediate these issues. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.