Red Hat Product Security issued an important security advisory (RHSA-2025:21121) for Mozilla Firefox on Red Hat Enterprise Linux 9.6 Extended Update Support. The advisory addresses nine distinct vulnerabilities (CVE-2025-13012 through CVE-2025-13020) affecting various Firefox components including DOM, Audio/Video, JavaScript WebAssembly, Workers, WebRTC, Graphics, and core HTML. The vulnerabilities include mitigation bypasses, use-after-free conditions, incorrect boundary checks, same-origin policy bypasses, race conditions, and spoofing issues. Red Hat has released updated Firefox packages (version 140.5.0-1.el9_6) for multiple architectures to remediate these issues. No CVSS scores are provided in the advisory, but the vendor rates the update as having an important security impact.

The vulnerabilities fixed in this update could allow attackers to bypass security mitigations, execute use-after-free exploits potentially leading to arbitrary code execution or crashes, bypass same-origin policy restrictions, cause race conditions, or spoof content in Firefox. These issues collectively pose a high risk to the confidentiality, integrity, and security of users browsing with affected Firefox versions on Red Hat Enterprise Linux 9.6. Exploits in the wild are not known at this time.

Red Hat has released updated Firefox packages (version 140.5.0-1.el9_6) for Red Hat Enterprise Linux 9.6 Extended Update Support and related variants. Users and administrators should apply these official updates promptly to remediate the vulnerabilities. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.