Red Hat Product Security issued an advisory (RHSA-2025:22371) addressing nine distinct security vulnerabilities in Mozilla Firefox for Red Hat Enterprise Linux 7 Extended Lifecycle Support. The vulnerabilities include a race condition in the Graphics component (CVE-2025-13012), multiple mitigation bypasses in DOM components (CVE-2025-13013, CVE-2025-13018), use-after-free bugs in Audio/Video and WebRTC components (CVE-2025-13014, CVE-2025-13020), same-origin policy bypasses in DOM Workers and Notifications components (CVE-2025-13019, CVE-2025-13017), a spoofing issue (CVE-2025-13015), and incorrect boundary conditions in the JavaScript WebAssembly component (CVE-2025-13016). Red Hat has provided updated Firefox packages (version 140.5.0-1.el7_9) for multiple architectures including x86_64, s390x, ppc64, and ppc64le to remediate these vulnerabilities. The advisory rates the update as important and the overall severity as high. No CVSS scores are provided in the advisory, but detailed CVE references are available for further information.

The vulnerabilities collectively impact the security posture of Firefox by enabling potential bypasses of security mitigations, use-after-free conditions that could lead to memory corruption, same-origin policy bypasses that could allow unauthorized data access, race conditions that may cause unpredictable behavior, and spoofing that could deceive users. These issues could be exploited to compromise confidentiality, integrity, or availability of the browser environment or user data. The advisory does not report known exploits in the wild.

Red Hat has released updated Firefox packages (version 140.5.0-1.el7_9) for Red Hat Enterprise Linux 7 Extended Lifecycle Support that address these vulnerabilities. Users and administrators should apply these updates promptly following Red Hat's published instructions at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated or required beyond applying the official update.