This Red Hat security advisory addresses five vulnerabilities affecting Mozilla Firefox and Thunderbird. CVE-2025-2817 involves privilege escalation in the Firefox Updater. CVE-2025-4087 concerns unsafe attribute access during XPath parsing. CVE-2025-4083 is a process isolation bypass using "javascript:" URI links in cross-origin frames. CVE-2025-4091 and CVE-2025-4093 are memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. The advisory provides updated packages for Red Hat Enterprise Linux 9 and its Extended Update Support and Extended Life Cycle variants across multiple architectures. No CVSS scores are provided in the advisory, but the overall severity is rated as important by Red Hat.

The vulnerabilities collectively could allow privilege escalation, unsafe access to attributes during XML parsing, bypass of process isolation protections, and memory safety issues that could lead to crashes or potential code execution. These issues affect Firefox and Thunderbird users on Red Hat Enterprise Linux 9 and related variants. Exploitation could compromise the security boundaries expected in the browser and email client environments.

Red Hat has released updated Firefox and Thunderbird packages that address these vulnerabilities. Users and administrators should apply the updates provided in Red Hat Enterprise Linux 9 and its Extended Update Support and Extended Life Cycle variants as soon as possible. Detailed update instructions are available in the Red Hat advisory at https://access.redhat.com/articles/11258. Since this is an official Red Hat security advisory with provided fixes, applying the vendor-supplied updates is the recommended remediation.