Red Hat Product Security issued an advisory (RHSA-2024:7621) for Firefox and Thunderbird addressing twelve CVEs related to memory safety, denial of service, clickjacking, cross-origin data access, and site isolation bypass. The vulnerabilities include CVE-2024-9399 (denial of service via WebTransport), CVE-2024-9403 (memory safety bugs), CVE-2024-9397 (directory upload bypass via clickjacking), CVE-2024-9401 and CVE-2024-9402 (memory safety bugs), CVE-2024-9398 (external protocol handler enumeration), CVE-2024-9400 and CVE-2024-9396 (memory corruption), CVE-2024-9393 and CVE-2024-9394 (cross-origin access to PDF and JSON contents), and CVE-2024-9392 (site isolation bypass). These fixes are included in Firefox 131, Firefox ESR 115.16, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3 packages for Red Hat Enterprise Linux 9.0. The advisory references detailed bugzilla entries and directs users to Red Hat's update documentation for applying patches.

The vulnerabilities collectively could allow denial of service, memory corruption, bypass of security features such as site isolation, unauthorized cross-origin data access, and potential bypass of directory upload restrictions via clickjacking. These issues impact the confidentiality, integrity, and availability of the affected applications. Exploitation could lead to crashes, unauthorized data exposure, or execution of arbitrary code within the context of the browser or email client processes.

Red Hat has released updated Firefox and Thunderbird packages for Red Hat Enterprise Linux 9.0 that address these vulnerabilities. Users should apply these official updates as described in the Red Hat advisory RHSA-2024:7621 and the update instructions at https://access.redhat.com/articles/11258. No additional mitigations are indicated beyond applying the provided patches.