This advisory covers a set of ten security vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2024-10458 (permission leak via embed or object elements), CVE-2024-10459 (use-after-free in layout with accessibility), CVE-2024-10460 (confusing display of origin for external protocol handler prompt), CVE-2024-10461 (XSS due to Content-Disposition being ignored), CVE-2024-10462 (origin spoofing of permission prompt by long URL), CVE-2024-10463 (cross origin video frame leak), CVE-2024-10464 (history interface causing denial of service), CVE-2024-10465 (clipboard paste button persisted across tabs), CVE-2024-10466 (DOM push subscription message hang), and CVE-2024-10467 (memory safety bugs). These vulnerabilities impact Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4. The Red Hat advisory RHSA-2024:8721 provides updated Firefox packages for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions on multiple architectures. The update addresses these vulnerabilities to mitigate risks such as denial of service, cross-site scripting, permission leaks, use-after-free, and memory safety issues.

The vulnerabilities collectively could lead to denial of service conditions, cross-site scripting attacks, permission leaks, use-after-free memory corruption, memory safety issues, UI spoofing of permission prompts, and potential hangs in Firefox. These issues may allow attackers to disrupt browser functionality, leak sensitive permissions, or confuse users about security prompts. The overall security impact is rated as moderate by Red Hat.

Red Hat has released updated Firefox packages (version 128.4.0-1.el9_0) for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions on ppc64le, x86_64, aarch64, and s390x architectures. Users should apply these official updates promptly to remediate the vulnerabilities. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the provided security update.