This Red Hat security advisory addresses a broad set of vulnerabilities in Mozilla Firefox and Thunderbird, including use-after-free, memory safety bugs, privilege escalation, sandbox escapes, incorrect boundary conditions, integer overflows, race conditions, undefined behavior, information disclosure, denial-of-service, and mitigation bypass. The vulnerabilities impact multiple components such as the JavaScript Engine, Graphics (Canvas2D, WebRender, Text), Audio/Video (Web Codecs, Playback, GMP), WebRTC Signaling, XPCOM, CSS Parsing, Layout, Widget Cocoa, Netmonitor, Disability Access APIs, Responsive Design Mode, Telemetry, and Networking HTTP. These issues have been fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149, and Thunderbird 149. Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Telecommunications Update Service have received updates to address these vulnerabilities. The advisory rates the security impact as Important (high severity). No known exploits in the wild have been reported at the time of this advisory.

The vulnerabilities collectively could allow attackers to cause use-after-free conditions, memory safety violations, privilege escalation, sandbox escapes, information disclosure, denial-of-service, and bypass of security mitigations in Firefox and Thunderbird. These issues affect critical components responsible for JavaScript execution, graphics rendering, audio/video processing, networking, and sandboxing, potentially compromising browser and email client security. The impact severity is high as rated by Red Hat Product Security.

A security update for Firefox and Thunderbird is available from Red Hat for Red Hat Enterprise Linux 8.8 variants, including Update Services for SAP Solutions and Telecommunications Update Service. Users should apply the provided updates promptly to remediate the vulnerabilities. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigations are indicated beyond applying the official patches.