Red Hat issued a security advisory (RHSA-2024:8727) for Mozilla Firefox and Thunderbird on Red Hat Enterprise Linux 7 Extended Lifecycle Support addressing ten vulnerabilities (CVE-2024-10458 through CVE-2024-10467). The vulnerabilities include permission leaks via embed or object elements (CVE-2024-10458), use-after-free in layout with accessibility (CVE-2024-10459), XSS due to ignored Content-Disposition headers (CVE-2024-10461), denial of service via history interface (CVE-2024-10464), memory safety bugs fixed in Firefox 132 and Thunderbird 132 (CVE-2024-10467), and others affecting UI prompts and clipboard behavior. Red Hat provides updated Firefox packages (version 128.4.0-1.el7_9) for multiple architectures to address these issues. The advisory classifies the impact as moderate and references CVE pages for detailed CVSS scores. No known exploits in the wild are reported.

The vulnerabilities collectively could lead to denial of service conditions, cross-site scripting attacks, permission leaks, use-after-free memory corruption, memory safety issues, UI spoofing, and potential hangs in Firefox. These issues could affect the confidentiality, integrity, and availability of the browser and email client processes. The advisory rates the overall impact as moderate, indicating these are significant but not critical security issues.

Red Hat has released updated Firefox packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support (firefox-128.4.0-1.el7_9) that address these vulnerabilities. Users should apply these official updates as detailed in the Red Hat advisory RHSA-2024:8727 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the vendor-provided patches.