This Red Hat security advisory addresses several vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-11708 (use-after-free in MediaTrackGraphImpl::GetInstance()), CVE-2025-11709 (out-of-bounds read/write triggered by WebGL textures), CVE-2025-11710 (cross-process information leak via malicious IPC messages), CVE-2025-11711 (modification of non-writable Object properties), CVE-2025-11712 (OBJECT tag type attribute overriding browser behavior), CVE-2025-11714 and CVE-2025-11715 (memory safety bugs). These vulnerabilities affect the Red Hat Enterprise Linux 10 Firefox and Thunderbird packages and have been fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144, and Thunderbird 144. The advisory provides updated packages for multiple architectures and variants of Red Hat Enterprise Linux 10.

The vulnerabilities include memory safety issues such as use-after-free and out-of-bounds read/write, which could lead to crashes or potentially arbitrary code execution. Cross-process information leaks could expose sensitive data between processes. Modification of non-writable properties and improper handling of OBJECT tag attributes could lead to unexpected browser behavior or security bypasses. These issues collectively pose a high security risk to users running affected versions of Firefox and Thunderbird on Red Hat Enterprise Linux 10.

Red Hat has released updated Firefox and Thunderbird packages (Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144, Thunderbird 144) that address these vulnerabilities. Users of Red Hat Enterprise Linux 10 should apply these security updates promptly by following the instructions in the Red Hat advisory (https://access.redhat.com/articles/11258). No additional mitigations are specified or required beyond applying the official patches.