Skip to main content
EPSS 3.4%top 12%

Red Hat Security Advisory: firefox security update

0
High
Published: 07/01/2025 (07/01/2025, 22:14:34 UTC)
Source: GCVE Database
Vendor/Project: Red Hat Product Security
Product: Red Hat

Description

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Content-Disposition header ignored when a file is included in an embed or object tag (CVE-2025-6430) * firefox: Use-after-free in FontFaceSet (CVE-2025-6424) * firefox: Incorrect parsing of URLs could have allowed embedding of youtube.com (CVE-2025-6429) * firefox: The WebCompat WebExtension shipped with Firefox exposed a persistent UUID (CVE-2025-6425) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected software

redhat/firefox
pkg:rpm/redhat/firefox
Affected versions
<9.6.0<9.8.0

Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 06/25/2026, 06:46:25 UTC

Technical Analysis

This Red Hat security advisory covers four vulnerabilities in Mozilla Firefox distributed with Red Hat Enterprise Linux 9. CVE-2025-6424 is a use-after-free vulnerability in FontFaceSet, CVE-2025-6429 involves incorrect URL parsing that could allow embedding of youtube.com, CVE-2025-6425 concerns exposure of a persistent UUID through the WebCompat WebExtension, and CVE-2025-6430 involves ignoring the Content-Disposition header in certain embed or object tag scenarios. These issues have been addressed in updated Firefox packages provided by Red Hat. The advisory rates the update as Important and references Red Hat's errata RHSA-2025:10072 for details and remediation instructions.

Potential Impact

The vulnerabilities collectively could lead to memory corruption (use-after-free), privacy exposure (persistent UUID), and potential content embedding issues due to URL parsing and header handling flaws. These issues may impact browser security and user privacy. The Red Hat advisory classifies the security impact as Important, indicating a high severity level but no known exploits in the wild have been reported at the time of publication.

Mitigation Recommendations

Red Hat has released updated Firefox packages for Red Hat Enterprise Linux 9 and its Extended Update Support and Extended Life Cycle variants. Users should apply these official updates promptly to remediate the vulnerabilities. Detailed update instructions are available in Red Hat's advisory RHSA-2025:10072 and related documentation at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the vendor-provided patches.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Gcve Source
db.gcve.eu
Csaf Category
csaf_security_advisory
Csaf Version
2.0
Publisher
Red Hat Product Security
Advisory Id
RHSA-2025:10072
Cve Count
4
Additional Cves
["CVE-2025-6425","CVE-2025-6429","CVE-2025-6430"]

Threat ID: 6a3cc2974853345fc16d180d

Added to database: 06/25/2026, 05:54:31 UTC

Last enriched: 06/25/2026, 06:46:25 UTC

Last updated: 09/10/2026, 19:36:51 UTC

Views: 27

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses