Red Hat Security Advisory: firefox security update
Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in a Red Hat security update. These include privilege escalation in the Firefox Updater, unsafe attribute access during XPath parsing, process isolation bypass via "javascript:" URI links in cross-origin frames, and several memory safety bugs. The fixes are included in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10 packages for Red Hat Enterprise Linux 8.4 variants. The update is rated as important by Red Hat Product Security.
AI Analysis
Technical Summary
This Red Hat security advisory (RHSA-2025:7545) addresses five vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-2817 (privilege escalation in Firefox Updater), CVE-2025-4087 (unsafe attribute access during XPath parsing), CVE-2025-4083 (process isolation bypass using "javascript:" URI links in cross-origin frames), and two memory safety bugs (CVE-2025-4091 and CVE-2025-4093). The vulnerabilities affect Firefox and Thunderbird versions prior to Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Red Hat has released updated packages for Red Hat Enterprise Linux 8.4 variants to remediate these issues.
Potential Impact
Successful exploitation of these vulnerabilities could allow privilege escalation, bypass of process isolation, unsafe access to attributes during XPath parsing, and potential memory safety issues that may lead to crashes or arbitrary code execution. These issues collectively pose a high security risk to affected systems running vulnerable versions of Firefox and Thunderbird on Red Hat Enterprise Linux 8.4.
Mitigation Recommendations
Red Hat has released updated Firefox and Thunderbird packages (version 128.10.0-1.el8_4) for Red Hat Enterprise Linux 8.4 variants that address these vulnerabilities. Users should apply these official updates promptly to remediate the security issues. For detailed update instructions, refer to https://access.redhat.com/articles/11258. Patch status is confirmed as fixed in these updated packages.
Red Hat Security Advisory: firefox security update
Description
Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in a Red Hat security update. These include privilege escalation in the Firefox Updater, unsafe attribute access during XPath parsing, process isolation bypass via "javascript:" URI links in cross-origin frames, and several memory safety bugs. The fixes are included in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10 packages for Red Hat Enterprise Linux 8.4 variants. The update is rated as important by Red Hat Product Security.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This Red Hat security advisory (RHSA-2025:7545) addresses five vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-2817 (privilege escalation in Firefox Updater), CVE-2025-4087 (unsafe attribute access during XPath parsing), CVE-2025-4083 (process isolation bypass using "javascript:" URI links in cross-origin frames), and two memory safety bugs (CVE-2025-4091 and CVE-2025-4093). The vulnerabilities affect Firefox and Thunderbird versions prior to Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Red Hat has released updated packages for Red Hat Enterprise Linux 8.4 variants to remediate these issues.
Potential Impact
Successful exploitation of these vulnerabilities could allow privilege escalation, bypass of process isolation, unsafe access to attributes during XPath parsing, and potential memory safety issues that may lead to crashes or arbitrary code execution. These issues collectively pose a high security risk to affected systems running vulnerable versions of Firefox and Thunderbird on Red Hat Enterprise Linux 8.4.
Mitigation Recommendations
Red Hat has released updated Firefox and Thunderbird packages (version 128.10.0-1.el8_4) for Red Hat Enterprise Linux 8.4 variants that address these vulnerabilities. Users should apply these official updates promptly to remediate the security issues. For detailed update instructions, refer to https://access.redhat.com/articles/11258. Patch status is confirmed as fixed in these updated packages.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:7545
- Cve Count
- 5
- Additional Cves
- ["CVE-2025-4083","CVE-2025-4087","CVE-2025-4091","CVE-2025-4093"]
Threat ID: 6a4049e827e9c79719835274
Added to database: 06/27/2026, 22:08:40 UTC
Last enriched: 06/27/2026, 22:36:43 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 24
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.