This Red Hat security advisory addresses several vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-11708 (use-after-free in MediaTrackGraphImpl::GetInstance), CVE-2025-11709 (out-of-bounds read/write triggered by WebGL textures), CVE-2025-11710 (cross-process information leak via malicious IPC messages), CVE-2025-11711 (modification of non-writable object properties), CVE-2025-11712 (an OBJECT tag type attribute overriding browser behavior without content-type), CVE-2025-11714 (memory safety bugs), and CVE-2025-11715 (memory safety bugs fixed in ESR and standard releases). These vulnerabilities affect Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144, and Thunderbird 144. The advisory rates the update as important and provides fixes for these issues in Red Hat Enterprise Linux 9 and its extended update support versions.

The vulnerabilities include memory safety bugs such as use-after-free and out-of-bounds read/write, which can lead to potential crashes or arbitrary code execution. Cross-process information leaks may expose sensitive data between processes. Modification of non-writable object properties and overriding browser behavior without proper content-type validation could lead to unexpected or unauthorized behavior in the browser. These issues collectively pose a high security risk to affected systems if exploited.

Red Hat has released updated Firefox and Thunderbird packages that address these vulnerabilities. Users should apply the security update for Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144, and Thunderbird 144 as provided by Red Hat for Red Hat Enterprise Linux 9 and its variants. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official update.