This advisory covers seven distinct security vulnerabilities in Mozilla Firefox and Thunderbird as packaged for Red Hat Enterprise Linux 8.2. The issues include sandbox escapes caused by use-after-free (CVE-2025-10527) and undefined behavior with invalid pointers (CVE-2025-10528) in the Graphics Canvas2D component, a same-origin policy bypass in the Layout component (CVE-2025-10529), incorrect boundary conditions in the JavaScript garbage collection component (CVE-2025-10532), memory safety bugs fixed in Firefox ESR 140.3 and Thunderbird ESR 140.3 (CVE-2025-10537), information disclosure in the Networking Cache component (CVE-2025-10536), and an integer overflow in the SVG component (CVE-2025-10533). These vulnerabilities could allow sandbox escapes, information disclosure, and bypass of security policies. The Red Hat advisory RHSA-2025:17372 provides updated packages to remediate these issues.

The vulnerabilities collectively impact the security boundaries of Firefox and Thunderbird, potentially allowing attackers to escape sandbox restrictions, bypass same-origin policies, disclose sensitive information, and cause memory corruption or overflows. These issues could lead to unauthorized code execution or data leakage within the affected applications. Red Hat rates the overall security impact as Important, indicating a high risk to affected systems if unpatched.

Red Hat has released updated Firefox and Thunderbird packages for Red Hat Enterprise Linux 8.2 that address these vulnerabilities. Users should apply the security update RHSA-2025:17372 promptly to remediate these issues. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official patches.