This Red Hat security advisory addresses a set of 13 vulnerabilities in Mozilla Firefox and Thunderbird components, including CVE-2025-14327 (spoofing in Downloads Panel), multiple use-after-free bugs in JavaScript GC, IPC, and JavaScript engine components, memory safety bugs, sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics components, information disclosure in Networking and PDF Viewer components, mitigation bypass in DOM security, and spoofing and clickjacking issues. These vulnerabilities affect Firefox ESR 140.7 and Firefox 147 versions provided by Red Hat for Red Hat Enterprise Linux 9.6 Extended Update Support. The advisory provides updated packages to remediate these issues.

The vulnerabilities collectively could allow attackers to perform spoofing, execute use-after-free exploits potentially leading to arbitrary code execution, escape sandbox restrictions, disclose sensitive information, bypass security mitigations, and conduct clickjacking attacks. These issues impact the security and integrity of the Firefox browser and Thunderbird mail client, potentially compromising user data and system security if exploited.

Red Hat has released updated Firefox packages (version 140.7.0-1.el9_6 and Firefox 147) for Red Hat Enterprise Linux 9.6 Extended Update Support that address these vulnerabilities. Users should apply these official updates promptly to remediate the security issues. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the provided patches.