This Red Hat security advisory addresses five distinct vulnerabilities in Mozilla Firefox and Thunderbird components. CVE-2025-9182 involves a denial-of-service condition caused by out-of-memory in the Graphics WebRender component. CVE-2025-9179 is a sandbox escape vulnerability due to an invalid pointer in the Audio/Video GMP component. CVE-2025-9180 allows same-origin policy bypass in the Graphics Canvas2D component. CVE-2025-9181 concerns uninitialized memory in the JavaScript Engine. CVE-2025-9185 covers multiple memory safety bugs fixed in various ESR and standard releases of Firefox and Thunderbird. The fixes are included in Firefox ESR 115.27, 128.14, 140.2, Thunderbird ESR 128.14, 140.2, and Firefox and Thunderbird version 142. The advisory is specific to Red Hat Enterprise Linux 7 Extended Lifecycle Support and provides updated packages for multiple architectures. No CVSS scores are provided in the advisory, but the severity is rated as important by Red Hat.

The vulnerabilities collectively impact the security of Firefox and Thunderbird by enabling denial-of-service, sandbox escape, same-origin policy bypass, uninitialized memory exposure, and memory safety issues. These could potentially allow attackers to disrupt service, escape sandbox protections, bypass security policies, or cause memory corruption. The advisory does not report known exploits in the wild. The impact is significant enough for Red Hat to rate the update as important, indicating a high risk to affected systems if unpatched.

Red Hat has released updated Firefox packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support that address these vulnerabilities. Users should apply the provided security update (firefox-128.14.0-2.el7_9 and corresponding packages) as soon as possible to remediate the issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are noted or required beyond applying the official update.