Red Hat Product Security issued an advisory (RHSA-2025:21054) for multiple security vulnerabilities in Mozilla Firefox and Thunderbird. The vulnerabilities include use-after-free in MediaTrackGraphImpl::GetInstance() (CVE-2025-11708), out-of-bounds read/write in a privileged process triggered by WebGL textures (CVE-2025-11709), cross-process information leakage due to malicious IPC messages (CVE-2025-11710), modification of some non-writable Object properties (CVE-2025-11711), an OBJECT tag type attribute overriding browser behavior on web resources without a content-type (CVE-2025-11712), and multiple memory safety bugs (CVE-2025-11714, CVE-2025-11715). These issues affect Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144, and Thunderbird 144. The advisory provides updated packages for Red Hat Enterprise Linux 8.2 AUS x86_64. No CVSS scores are provided in the advisory, but the overall impact is rated as important by Red Hat.

The vulnerabilities collectively could lead to memory safety issues, including use-after-free and out-of-bounds read/write, potentially causing crashes or arbitrary code execution. Cross-process information leaks could expose sensitive data via malicious IPC messages. Modification of non-writable object properties and improper handling of OBJECT tag attributes could lead to unexpected browser behavior or security bypasses. The overall impact is considered important, indicating significant security concerns that could affect confidentiality, integrity, or availability of the affected software.

Red Hat has released updated Firefox and Thunderbird packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 8.2 AUS x86_64 should apply the Firefox ESR 140.4 and Thunderbird ESR 140.4 updates or later versions as provided in the advisory RHSA-2025:21054. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official updates.