This Red Hat security advisory covers a comprehensive set of vulnerabilities in Mozilla Firefox and Thunderbird, including use-after-free, memory safety bugs, privilege escalation, sandbox escapes, incorrect boundary conditions, integer overflows, race conditions, undefined behavior, information disclosure, denial-of-service, and mitigation bypass vulnerabilities. The affected components span the JavaScript engine, graphics subsystems (Canvas2D, WebRender, Text), audio/video codecs, WebRTC signaling, XPCOM, CSS parsing, layout, networking HTTP, and others. These vulnerabilities have been fixed in Firefox ESR 115.34, ESR 140.9, Thunderbird ESR 140.9, Firefox 149, and Thunderbird 149. The advisory is specific to Red Hat Enterprise Linux 9.6 Extended Update Support and related variants. No known exploits in the wild have been reported at the time of this advisory.

The vulnerabilities collectively could allow attackers to execute arbitrary code, escalate privileges, escape sandbox restrictions, cause denial-of-service conditions, and disclose sensitive information when users run affected versions of Firefox or Thunderbird. The range of issues affects core browser and email client components, potentially impacting confidentiality, integrity, and availability of the affected systems. The severity is rated as high by Red Hat Product Security.

An official security update is available from Red Hat for Firefox and Thunderbird in Red Hat Enterprise Linux 9.6 Extended Update Support. Users and administrators should apply the update promptly to remediate these vulnerabilities. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official patches.