This Red Hat security advisory addresses seven vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-11708 (use-after-free in MediaTrackGraphImpl::GetInstance()), CVE-2025-11709 (out-of-bounds read/write triggered by WebGL textures), CVE-2025-11710 (cross-process information leak via malicious IPC messages), CVE-2025-11711 (modification of some non-writable Object properties), CVE-2025-11712 (an OBJECT tag type attribute overriding browser behavior on web resources without a content-type), CVE-2025-11714 and CVE-2025-11715 (memory safety bugs). These issues affect Firefox and Thunderbird versions prior to ESR 140.4 and 144 respectively. The advisory provides updated packages for Red Hat Enterprise Linux 9.0 on multiple architectures. No CVSS scores are provided, but the vulnerabilities are rated as having high importance.

The vulnerabilities include memory safety issues such as use-after-free and out-of-bounds read/write, which can lead to crashes or potentially arbitrary code execution. Cross-process information leaks could expose sensitive data between processes. Modification of non-writable object properties and improper handling of OBJECT tag attributes could lead to unexpected browser behavior or security bypasses. These issues collectively pose a significant risk to the confidentiality, integrity, and stability of the affected software.

Red Hat has released updated Firefox and Thunderbird packages (Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144, Thunderbird 144) that address these vulnerabilities. Users of Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions should apply these official updates promptly. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory.