This Red Hat security advisory addresses seven vulnerabilities in Mozilla Firefox and Thunderbird, including sandbox escapes (CVE-2025-10527, CVE-2025-10528), same-origin policy bypass (CVE-2025-10529), memory safety bugs (CVE-2025-10537), information disclosure (CVE-2025-10536), integer overflow (CVE-2025-10533), and incorrect boundary conditions in JavaScript garbage collection (CVE-2025-10532). These vulnerabilities affect components such as Graphics Canvas2D, Layout, Networking Cache, SVG, and JavaScript GC. The advisory provides updated packages for Red Hat Enterprise Linux 9.4 Extended Update Support and related variants to remediate these issues.

The vulnerabilities include sandbox escapes that could allow code execution outside of the intended sandbox environment, same-origin policy bypass potentially enabling unauthorized access to web content, memory safety bugs that could lead to crashes or code execution, information disclosure exposing sensitive data, and integer overflow that may result in unexpected behavior. These issues collectively pose a high security risk to affected systems running vulnerable versions of Firefox and Thunderbird on Red Hat Enterprise Linux 9.4.

Red Hat has released updated Firefox and Thunderbird packages for Red Hat Enterprise Linux 9.4 Extended Update Support that address these vulnerabilities. Users should apply these official updates promptly to remediate the security issues. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.