This Red Hat security advisory (RHSA-2025:15423) addresses five distinct vulnerabilities in Mozilla Firefox and Thunderbird. The vulnerabilities include: CVE-2025-9182, a denial-of-service caused by out-of-memory in the Graphics: WebRender component; CVE-2025-9179, a sandbox escape due to an invalid pointer in the Audio/Video GMP component; CVE-2025-9180, a same-origin policy bypass in the Graphics: Canvas2D component; CVE-2025-9181, uninitialized memory in the JavaScript engine component; and CVE-2025-9185, multiple memory safety bugs fixed in Firefox ESR 115.27, ESR 128.14, ESR 140.2, Thunderbird ESR 128.14, ESR 140.2, Firefox 142, and Thunderbird 142. Red Hat has released updated packages for Red Hat Enterprise Linux 9.4 Extended Update Support and related variants to remediate these issues. The advisory references official Red Hat errata and provides package updates for multiple architectures.

The vulnerabilities collectively impact the security posture of Firefox and Thunderbird by enabling denial-of-service conditions, sandbox escapes, same-origin policy bypasses, and memory safety issues. These could potentially allow attackers to disrupt service, escape sandbox restrictions, bypass web security policies, or cause memory corruption. The severity is rated as important by Red Hat, indicating significant security impact but no confirmed exploits in the wild at the time of the advisory.

Red Hat has released official security updates that fix these vulnerabilities in Firefox and Thunderbird packages for Red Hat Enterprise Linux 9.4 Extended Update Support and related variants. Users should apply the provided updates promptly to remediate these issues. Detailed update instructions are available in the Red Hat advisory (RHSA-2025:15423) and associated knowledge base articles. No additional mitigations are specified or required beyond applying the official patches.