This Red Hat security advisory (RHSA-2024:8725) addresses a set of vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2024-10458 (permission leak via embed or object elements), CVE-2024-10459 (use-after-free in layout with accessibility), CVE-2024-10460 (confusing display of origin for external protocol handler prompt), CVE-2024-10461 (XSS due to Content-Disposition ignored in multipart/x-mixed-replace response), CVE-2024-10462 (origin of permission prompt spoofed by long URL), CVE-2024-10463 (cross origin video frame leak), CVE-2024-10464 (denial of service via history interface), CVE-2024-10465 (clipboard paste button persisted across tabs), CVE-2024-10466 (DOM push subscription message could hang Firefox), and CVE-2024-10467 (memory safety bugs). These issues have been fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4 packages provided by Red Hat for their Enterprise Linux 8.6 variants and update services. The advisory rates the impact as moderate and provides updated packages for remediation.

The vulnerabilities collectively could lead to denial of service conditions, cross-site scripting attacks, permission leaks, use-after-free memory corruption, memory safety issues, UI spoofing, and browser hangs. These issues may affect browser stability, security boundaries, and user interface integrity in Firefox and Thunderbird. The advisory classifies the overall impact as moderate.

Red Hat has released updated Firefox packages (version 128.4.0-1.el8_6) for Red Hat Enterprise Linux 8.6 and related update services that address these vulnerabilities. Users should apply these official updates as detailed in the Red Hat advisory RHSA-2024:8725 and the article https://access.redhat.com/articles/11258 to remediate the issues. No additional mitigation steps are indicated beyond applying the provided patches.