This Red Hat security advisory addresses several vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-11708 (use-after-free in MediaTrackGraphImpl::GetInstance()), CVE-2025-11709 (out-of-bounds read/write triggered by WebGL textures), CVE-2025-11710 (cross-process information leak via malicious IPC messages), CVE-2025-11711 (modification of non-writable object properties), CVE-2025-11712 (an OBJECT tag type attribute overriding browser behavior without a content-type), CVE-2025-11714 and CVE-2025-11715 (memory safety bugs). These vulnerabilities affect the Firefox and Thunderbird products and have been fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144, and Thunderbird 144. The advisory is classified as important by Red Hat and includes fixes for Red Hat Enterprise Linux 8.8 variants. No CVSS scores are provided in the advisory, and no known exploits have been reported.

The vulnerabilities include memory safety issues such as use-after-free and out-of-bounds read/write, which could lead to crashes or potentially arbitrary code execution. Cross-process information leaks could expose sensitive data between processes. Improper handling of object properties and browser behavior could allow modification of normally protected properties or unexpected behavior when processing web resources. These issues collectively pose a high security risk to affected systems running vulnerable versions of Firefox or Thunderbird.

Red Hat has released updated packages fixing these vulnerabilities in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144, and Thunderbird 144 for Red Hat Enterprise Linux 8.8 variants. Users and administrators should apply these official updates promptly to remediate the issues. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. There are no indications that additional mitigations are required beyond applying the official patches.