This Red Hat security advisory addresses a broad set of vulnerabilities in Mozilla Firefox and Thunderbird, including use-after-free, memory safety bugs, privilege escalation, sandbox escapes, incorrect boundary conditions, integer overflows, race conditions, undefined behavior, information disclosure, denial-of-service, and mitigation bypasses. The affected components span the JavaScript engine, graphics (Canvas2D, WebRender, Text), audio/video (Web Codecs, GMP, playback), WebRTC signaling, networking HTTP, XPCOM, CSS parsing, layout, widget Cocoa, telemetry, and responsive design mode. These vulnerabilities are fixed in updated versions of Firefox ESR 115.34, ESR 140.9, Firefox 149, Thunderbird ESR 140.9, and Thunderbird 149. The advisory specifically covers Red Hat Enterprise Linux 8.4 variants with these updates. The vendor rates the security impact as Important (high severity).

The vulnerabilities collectively could allow attackers to execute arbitrary code, escalate privileges, escape sandbox restrictions, cause denial-of-service conditions, or disclose sensitive information through memory safety errors, use-after-free bugs, boundary condition errors, integer overflows, race conditions, and mitigation bypasses. The broad range of affected components increases the attack surface. However, no known exploits in the wild have been reported. The update mitigates these risks by addressing the underlying bugs in the specified Firefox and Thunderbird versions.

A security update is available from Red Hat for Red Hat Enterprise Linux 8.4 variants that includes fixes for these vulnerabilities. Users should apply the update promptly to mitigate the risks. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional vendor-recommended mitigations or workarounds are indicated in the advisory.