This Red Hat security advisory addresses five vulnerabilities in Mozilla Firefox and Thunderbird components. The issues include a denial-of-service vulnerability caused by out-of-memory conditions in the Graphics WebRender component (CVE-2025-9182), a sandbox escape due to an invalid pointer in the Audio/Video GMP component (CVE-2025-9179), a same-origin policy bypass in the Graphics Canvas2D component (CVE-2025-9180), uninitialized memory usage in the JavaScript Engine component (CVE-2025-9181), and multiple memory safety bugs (CVE-2025-9185). Red Hat has released updated Firefox packages for Red Hat Enterprise Linux 8.6 variants to remediate these issues. The advisory references fixes in Firefox ESR versions 115.27, 128.14, 140.2, Thunderbird ESR 128.14, 140.2, and Firefox and Thunderbird version 142. The update is classified as important by Red Hat Product Security. No CVSS scores are provided in the advisory, and no known exploits in the wild are reported.

The vulnerabilities collectively impact the security of Firefox and Thunderbird by enabling denial-of-service conditions, sandbox escapes, same-origin policy bypasses, uninitialized memory usage, and memory safety issues. These could potentially allow attackers to disrupt service, escape sandbox restrictions, bypass security policies, or cause memory corruption. However, no known exploits in the wild have been reported. The issues affect Red Hat Enterprise Linux 8.6 Firefox packages and related Thunderbird components.

Red Hat has released security updates for Firefox and Thunderbird packages in Red Hat Enterprise Linux 8.6 to address these vulnerabilities. Users should apply the available updates as detailed in the Red Hat advisory RHSA-2025:15422 and the referenced article https://access.redhat.com/articles/11258. Applying these official patches is the recommended mitigation. No additional vendor guidance indicates that no action is required or that the issues are already mitigated.