This Red Hat security advisory (RHSA-2025:22373) addresses nine distinct vulnerabilities in Mozilla Firefox as packaged for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. The vulnerabilities include race conditions (CVE-2025-13012), use-after-free bugs in Audio/Video and WebRTC components (CVE-2025-13014, CVE-2025-13020), mitigation bypasses in DOM security components (CVE-2025-13013, CVE-2025-13018), same-origin policy bypasses in DOM Workers and Notifications components (CVE-2025-13017, CVE-2025-13019), incorrect boundary conditions in JavaScript WebAssembly (CVE-2025-13016), and a spoofing issue (CVE-2025-13015). Red Hat has released updated Firefox packages (version 140.5.0-1.el9_0) for multiple architectures including x86_64, ppc64le, aarch64, and s390x. The advisory directs users to apply these updates to mitigate the security risks. No CVSS scores are provided in the advisory; severity is rated as Important by Red Hat.

The vulnerabilities collectively impact the security of Firefox by potentially allowing attackers to bypass security mitigations, exploit use-after-free conditions, bypass same-origin policies, cause race conditions, and perform spoofing attacks. These issues could lead to unauthorized access, information disclosure, or execution of arbitrary code within the browser context. The advisory rates the overall security impact as Important, indicating a high risk to affected systems if unpatched.

Red Hat has released updated Firefox packages that address all listed vulnerabilities. Users of Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions should apply the Firefox update version 140.5.0-1.el9_0 or later as provided by Red Hat to remediate these issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official update.