Red Hat Security Advisory: firefox security update
Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in Red Hat Enterprise Linux 9.0 updates. These include sandbox escapes due to use-after-free and undefined behavior in the Graphics Canvas2D component, a same-origin policy bypass in the Layout component, memory safety bugs, information disclosure in the Networking Cache component, integer overflow in the SVG component, and incorrect boundary conditions in the JavaScript garbage collection component. The update fixes these issues in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143, and Thunderbird 143.
AI Analysis
Technical Summary
This Red Hat security advisory covers a set of vulnerabilities in Mozilla Firefox and Thunderbird, including sandbox escapes (CVE-2025-10527, CVE-2025-10528), a same-origin policy bypass (CVE-2025-10529), memory safety bugs (CVE-2025-10537), information disclosure (CVE-2025-10536), integer overflow (CVE-2025-10533), and incorrect boundary conditions in the JavaScript garbage collection component (CVE-2025-10532). These vulnerabilities affect the Graphics Canvas2D, Layout, Networking Cache, SVG, and JavaScript GC components. The issues are fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143, and Thunderbird 143, with updates provided for Red Hat Enterprise Linux 9.0 variants.
Potential Impact
The vulnerabilities include sandbox escapes that could allow an attacker to break out of the browser's sandbox environment, a same-origin policy bypass that could lead to unauthorized access to web content, memory safety bugs that may cause crashes or code execution, information disclosure that could leak sensitive data, and integer overflow that could lead to unexpected behavior. These issues collectively pose a high security risk to users running affected versions of Firefox and Thunderbird on Red Hat Enterprise Linux 9.0.
Mitigation Recommendations
Red Hat has released security updates for Firefox and Thunderbird in Red Hat Enterprise Linux 9.0 that address these vulnerabilities. Users should apply the Firefox ESR 140.3 update or later versions (including Firefox 143 and Thunderbird 143) as provided by Red Hat to remediate these issues. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.
Red Hat Security Advisory: firefox security update
Description
Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in Red Hat Enterprise Linux 9.0 updates. These include sandbox escapes due to use-after-free and undefined behavior in the Graphics Canvas2D component, a same-origin policy bypass in the Layout component, memory safety bugs, information disclosure in the Networking Cache component, integer overflow in the SVG component, and incorrect boundary conditions in the JavaScript garbage collection component. The update fixes these issues in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143, and Thunderbird 143.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This Red Hat security advisory covers a set of vulnerabilities in Mozilla Firefox and Thunderbird, including sandbox escapes (CVE-2025-10527, CVE-2025-10528), a same-origin policy bypass (CVE-2025-10529), memory safety bugs (CVE-2025-10537), information disclosure (CVE-2025-10536), integer overflow (CVE-2025-10533), and incorrect boundary conditions in the JavaScript garbage collection component (CVE-2025-10532). These vulnerabilities affect the Graphics Canvas2D, Layout, Networking Cache, SVG, and JavaScript GC components. The issues are fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143, and Thunderbird 143, with updates provided for Red Hat Enterprise Linux 9.0 variants.
Potential Impact
The vulnerabilities include sandbox escapes that could allow an attacker to break out of the browser's sandbox environment, a same-origin policy bypass that could lead to unauthorized access to web content, memory safety bugs that may cause crashes or code execution, information disclosure that could leak sensitive data, and integer overflow that could lead to unexpected behavior. These issues collectively pose a high security risk to users running affected versions of Firefox and Thunderbird on Red Hat Enterprise Linux 9.0.
Mitigation Recommendations
Red Hat has released security updates for Firefox and Thunderbird in Red Hat Enterprise Linux 9.0 that address these vulnerabilities. Users should apply the Firefox ESR 140.3 update or later versions (including Firefox 143 and Thunderbird 143) as provided by Red Hat to remediate these issues. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:17373
- Cve Count
- 7
- Additional Cves
- ["CVE-2025-10528","CVE-2025-10529","CVE-2025-10532","CVE-2025-10533","CVE-2025-10536","CVE-2025-10537"]
Threat ID: 6a419cb227e9c79719abbeaa
Added to database: 06/28/2026, 22:14:10 UTC
Last enriched: 08/22/2026, 22:21:37 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 23
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.