Red Hat Security Advisory: firefox security update
Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in a Red Hat security update for Red Hat Enterprise Linux 8.4. These include memory safety bugs, incorrect URL stripping in Content Security Policy (CSP) reports, partial return value writes in the JavaScript engine, potential user-assisted code execution, and CSP bypass via XSLT documents. The update fixes nine CVEs related to these issues. The advisory rates the security impact as Important (high severity).
AI Analysis
Technical Summary
This Red Hat security advisory (RHSA-2025:12302) addresses nine vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-8027, which involves the JavaScript engine writing only a partial return value to the stack, and other issues such as large branch table truncation, memory safety bugs, incorrect URL stripping in CSP reports, potential user-assisted code execution via the 'Copy as cURL' command, incorrect JavaScript state machine behavior for generators, CSP bypass through XSLT documents, and execution of javascript: URLs on object and embed tags. These vulnerabilities affect Red Hat Enterprise Linux 8.4 versions with Firefox packages prior to the update. The advisory provides updated Firefox packages to remediate these issues.
Potential Impact
The vulnerabilities collectively could lead to memory safety issues, partial execution of JavaScript code, CSP bypasses, and potential user-assisted code execution, which may allow attackers to execute arbitrary code or bypass security policies in affected Firefox and Thunderbird versions. The advisory classifies the impact as Important, indicating a high severity level but does not provide CVSS scores.
Mitigation Recommendations
A security update for Firefox is available for Red Hat Enterprise Linux 8.4 Extended Update Support and Advanced Update Support. Users should apply the provided Firefox package updates (e.g., firefox-128.13.0-1.el8_4) as detailed in the Red Hat advisory RHSA-2025:12302 and the referenced article https://access.redhat.com/articles/11258. Applying these updates remediates the listed vulnerabilities. No additional mitigation steps are indicated by the vendor.
Red Hat Security Advisory: firefox security update
Description
Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in a Red Hat security update for Red Hat Enterprise Linux 8.4. These include memory safety bugs, incorrect URL stripping in Content Security Policy (CSP) reports, partial return value writes in the JavaScript engine, potential user-assisted code execution, and CSP bypass via XSLT documents. The update fixes nine CVEs related to these issues. The advisory rates the security impact as Important (high severity).
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This Red Hat security advisory (RHSA-2025:12302) addresses nine vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-8027, which involves the JavaScript engine writing only a partial return value to the stack, and other issues such as large branch table truncation, memory safety bugs, incorrect URL stripping in CSP reports, potential user-assisted code execution via the 'Copy as cURL' command, incorrect JavaScript state machine behavior for generators, CSP bypass through XSLT documents, and execution of javascript: URLs on object and embed tags. These vulnerabilities affect Red Hat Enterprise Linux 8.4 versions with Firefox packages prior to the update. The advisory provides updated Firefox packages to remediate these issues.
Potential Impact
The vulnerabilities collectively could lead to memory safety issues, partial execution of JavaScript code, CSP bypasses, and potential user-assisted code execution, which may allow attackers to execute arbitrary code or bypass security policies in affected Firefox and Thunderbird versions. The advisory classifies the impact as Important, indicating a high severity level but does not provide CVSS scores.
Mitigation Recommendations
A security update for Firefox is available for Red Hat Enterprise Linux 8.4 Extended Update Support and Advanced Update Support. Users should apply the provided Firefox package updates (e.g., firefox-128.13.0-1.el8_4) as detailed in the Red Hat advisory RHSA-2025:12302 and the referenced article https://access.redhat.com/articles/11258. Applying these updates remediates the listed vulnerabilities. No additional mitigation steps are indicated by the vendor.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:12302
- Cve Count
- 9
- Additional Cves
- ["CVE-2025-8028","CVE-2025-8029","CVE-2025-8030","CVE-2025-8031","CVE-2025-8032","CVE-2025-8033","CVE-2025-8034","CVE-2025-8035"]
- Cvss Version
- null
Threat ID: 6a3cc29f4853345fc16d443b
Added to database: 06/25/2026, 05:54:39 UTC
Last enriched: 06/25/2026, 06:01:49 UTC
Last updated: 06/25/2026, 10:00:48 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.