Red Hat Security Advisory: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Content-Disposition header ignored when a file is included in an embed or object tag (CVE-2025-6430) * firefox: Use-after-free in FontFaceSet (CVE-2025-6424) * firefox: Incorrect parsing of URLs could have allowed embedding of youtube.com (CVE-2025-6429) * firefox: The WebCompat WebExtension shipped with Firefox exposed a persistent UUID (CVE-2025-6425) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
This Red Hat security advisory covers four vulnerabilities in Mozilla Firefox distributed with Red Hat Enterprise Linux 9. CVE-2025-6424 is a use-after-free vulnerability in FontFaceSet, CVE-2025-6429 involves incorrect URL parsing that could allow embedding of youtube.com, CVE-2025-6425 concerns exposure of a persistent UUID through the WebCompat WebExtension, and CVE-2025-6430 involves ignoring the Content-Disposition header in certain embed or object tag scenarios. These issues have been addressed in updated Firefox packages provided by Red Hat. The advisory rates the update as Important and references Red Hat's errata RHSA-2025:10072 for details and remediation instructions.
Potential Impact
The vulnerabilities collectively could lead to memory corruption (use-after-free), privacy exposure (persistent UUID), and potential content embedding issues due to URL parsing and header handling flaws. These issues may impact browser security and user privacy. The Red Hat advisory classifies the security impact as Important, indicating a high severity level but no known exploits in the wild have been reported at the time of publication.
Mitigation Recommendations
Red Hat has released updated Firefox packages for Red Hat Enterprise Linux 9 and its Extended Update Support and Extended Life Cycle variants. Users should apply these official updates promptly to remediate the vulnerabilities. Detailed update instructions are available in Red Hat's advisory RHSA-2025:10072 and related documentation at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the vendor-provided patches.
Red Hat Security Advisory: firefox security update
Description
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Content-Disposition header ignored when a file is included in an embed or object tag (CVE-2025-6430) * firefox: Use-after-free in FontFaceSet (CVE-2025-6424) * firefox: Incorrect parsing of URLs could have allowed embedding of youtube.com (CVE-2025-6429) * firefox: The WebCompat WebExtension shipped with Firefox exposed a persistent UUID (CVE-2025-6425) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This Red Hat security advisory covers four vulnerabilities in Mozilla Firefox distributed with Red Hat Enterprise Linux 9. CVE-2025-6424 is a use-after-free vulnerability in FontFaceSet, CVE-2025-6429 involves incorrect URL parsing that could allow embedding of youtube.com, CVE-2025-6425 concerns exposure of a persistent UUID through the WebCompat WebExtension, and CVE-2025-6430 involves ignoring the Content-Disposition header in certain embed or object tag scenarios. These issues have been addressed in updated Firefox packages provided by Red Hat. The advisory rates the update as Important and references Red Hat's errata RHSA-2025:10072 for details and remediation instructions.
Potential Impact
The vulnerabilities collectively could lead to memory corruption (use-after-free), privacy exposure (persistent UUID), and potential content embedding issues due to URL parsing and header handling flaws. These issues may impact browser security and user privacy. The Red Hat advisory classifies the security impact as Important, indicating a high severity level but no known exploits in the wild have been reported at the time of publication.
Mitigation Recommendations
Red Hat has released updated Firefox packages for Red Hat Enterprise Linux 9 and its Extended Update Support and Extended Life Cycle variants. Users should apply these official updates promptly to remediate the vulnerabilities. Detailed update instructions are available in Red Hat's advisory RHSA-2025:10072 and related documentation at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the vendor-provided patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:10072
- Cve Count
- 4
- Additional Cves
- ["CVE-2025-6425","CVE-2025-6429","CVE-2025-6430"]
Threat ID: 6a3cc2974853345fc16d180d
Added to database: 06/25/2026, 05:54:31 UTC
Last enriched: 06/25/2026, 06:46:25 UTC
Last updated: 09/10/2026, 19:36:51 UTC
Views: 27
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.