Red Hat Product Security released an advisory (RHSA-2025:10074) for Mozilla Firefox on Red Hat Enterprise Linux 8, addressing four security vulnerabilities: CVE-2025-6424 (use-after-free in FontFaceSet), CVE-2025-6430 (Content-Disposition header ignored in embed/object tags), CVE-2025-6429 (incorrect URL parsing enabling embedding of youtube.com), and CVE-2025-6425 (persistent UUID exposure in WebCompat WebExtension). These vulnerabilities impact Firefox's handling of web content and extensions, potentially leading to memory corruption and privacy issues. The advisory provides updated Firefox packages (version 128.12.0-1.el8_10) for multiple architectures including x86_64, s390x, ppc64le, and aarch64. No CVSS scores were provided in the advisory. The update is classified as Important by Red Hat and is available for installation.

The vulnerabilities fixed include a use-after-free condition that could lead to memory corruption, improper handling of HTTP headers affecting content embedding, incorrect URL parsing that could allow unauthorized embedding of external content, and exposure of a persistent UUID that may impact user privacy. These issues collectively could affect browser stability, security, and user privacy on affected Red Hat Enterprise Linux 8 systems running Firefox.

Red Hat has released updated Firefox packages that address these vulnerabilities. Users and administrators should apply the Firefox update (version 128.12.0-1.el8_10) available through Red Hat Enterprise Linux 8 and Extended Life Cycle 8.10 repositories as soon as possible. For detailed update instructions, refer to Red Hat's official article at https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory.