This Red Hat security advisory (RHSA-2025:12361) addresses nine vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-8027 and eight others. The issues fixed include large branch table truncation leading to instruction truncation, multiple memory safety bugs, incorrect URL stripping in CSP reports, partial return value writes in the JavaScript engine stack, potential user-assisted code execution via the 'Copy as cURL' command, incorrect JavaScript state machine behavior for generators, CSP bypass via XSLT documents, and execution of javascript: URLs on object and embed tags. The advisory applies to Red Hat Enterprise Linux 8.6 variants and provides updated Firefox packages to remediate these vulnerabilities.

The vulnerabilities collectively pose risks including memory safety errors that could lead to crashes or code execution, incorrect enforcement of security policies (CSP), and potential user-assisted code execution. These issues could allow attackers to bypass security controls or execute arbitrary code under certain conditions, impacting the confidentiality, integrity, and availability of affected systems running Firefox or Thunderbird on Red Hat Enterprise Linux 8.6.

Red Hat has released updated Firefox packages for Red Hat Enterprise Linux 8.6 that address these vulnerabilities. Users should apply these official security updates promptly to remediate the issues. For detailed update instructions, refer to Red Hat's advisory and article at https://access.redhat.com/articles/11258. No indication of known exploits in the wild has been reported. Patch status is confirmed as fixed in the updated packages provided by Red Hat.