Red Hat Product Security released an important security advisory (RHSA-2025:14416) addressing multiple vulnerabilities in Mozilla Firefox and Thunderbird. The vulnerabilities include a denial-of-service due to out-of-memory in the Graphics WebRender component (CVE-2025-9182), a sandbox escape via invalid pointer in the Audio/Video GMP component (CVE-2025-9179), a same-origin policy bypass in the Graphics Canvas2D component (CVE-2025-9180), uninitialized memory in the JavaScript Engine component (CVE-2025-9181), and various memory safety bugs (CVE-2025-9185). These issues are fixed in Firefox ESR versions 115.27, 128.14, 140.2, Thunderbird ESR 128.14, 140.2, and Firefox and Thunderbird version 142. The advisory covers Red Hat Enterprise Linux 9 and its extended update and life cycle support variants across multiple architectures. The update is available as RPM packages and detailed remediation instructions are provided by Red Hat.

The vulnerabilities collectively allow for denial-of-service conditions, sandbox escapes, bypass of same-origin policy, exposure of uninitialized memory, and other memory safety issues in Firefox and Thunderbird. These could lead to potential compromise of application security boundaries and stability. The severity is rated as important by Red Hat, indicating significant security impact but no confirmed exploits in the wild at the time of the advisory.

Red Hat has released updated Firefox and Thunderbird packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 9 and its variants should apply the provided security update (RHSA-2025:14416) promptly. Detailed update instructions are available at https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the vulnerabilities.