This Red Hat security advisory addresses nine distinct vulnerabilities in Mozilla Firefox, including CVE-2025-13012 (race condition in Graphics), CVE-2025-13013 and CVE-2025-13018 (mitigation bypasses in DOM components), CVE-2025-13014 and CVE-2025-13020 (use-after-free in Audio/Video and WebRTC components), CVE-2025-13015 (spoofing), CVE-2025-13016 (incorrect boundary conditions in JavaScript WebAssembly), CVE-2025-13017 and CVE-2025-13019 (same-origin policy bypasses in DOM Workers and Notifications). Red Hat has issued updates for Firefox in RHEL 9.4 Extended Update Support to remediate these vulnerabilities. The advisory references fixes for these CVEs and provides updated package versions for multiple architectures.

The vulnerabilities collectively impact the security of Firefox by allowing potential mitigation bypasses, use-after-free memory corruption, same-origin policy bypasses, race conditions, and spoofing attacks. These issues could lead to unauthorized code execution, information disclosure, or security policy violations within the browser environment. The advisory rates the overall impact as Important (high severity). No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released updated Firefox packages (version 140.5.0-1.el9_4) for Red Hat Enterprise Linux 9.4 Extended Update Support and related variants. Users should apply these official updates promptly to remediate the vulnerabilities. Detailed update instructions are available at https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the described security issues.