This Red Hat security advisory (RHSA-2024:7702) addresses multiple vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2024-9399 (denial of service via WebTransport requests), CVE-2024-9403 (memory safety bugs), CVE-2024-9397 (directory upload bypass via clickjacking), CVE-2024-9401 and CVE-2024-9402 (memory safety bugs), CVE-2024-9398 (external protocol handler enumeration), CVE-2024-9400 and CVE-2024-9396 (potential memory corruption), CVE-2024-9393 and CVE-2024-9394 (cross-origin access to PDF and JSON contents), and CVE-2024-9392 (site isolation bypass). These vulnerabilities affect Firefox 131, Firefox ESR 115.16, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3. The advisory provides updated packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support. No CVSS scores are provided in the advisory, but the update is rated as important by Red Hat Product Security.

The vulnerabilities collectively could allow denial of service, memory corruption, bypass of security mechanisms such as site isolation, unauthorized cross-origin data access, and potential bypass of upload restrictions via clickjacking. These issues could impact the confidentiality, integrity, and availability of the affected applications. No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released updated Firefox packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2024:7702 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigation steps are indicated beyond applying the official update.