This advisory covers multiple security vulnerabilities in Mozilla Firefox and Thunderbird as packaged for Red Hat Enterprise Linux 9. The issues include a clickjacking vulnerability (CVE-2025-5267) that could lead to leaking saved payment card details, potential local code execution through the 'Copy as cURL' command (CVE-2025-5264), several memory safety bugs (CVE-2025-5268, CVE-2025-5269), leakage of cross-origin resource status via script element events (CVE-2025-5266), and improper isolation of error handling for script execution from web content (CVE-2025-5263). Red Hat has released updated Firefox packages to address these vulnerabilities. The advisory references multiple CVEs and provides updated packages for various Red Hat Enterprise Linux 9 architectures and update streams.

Successful exploitation of these vulnerabilities could lead to unauthorized disclosure of sensitive information such as saved payment card details, local code execution on affected systems, and potential compromise of browser security through memory safety issues and cross-origin information leakage. These impacts could undermine user privacy and system integrity on affected Red Hat Enterprise Linux 9 systems running Firefox or Thunderbird.

Red Hat has released updated Firefox packages for Red Hat Enterprise Linux 9 and its variants that address these vulnerabilities. Users and administrators should apply the available security updates as described in the Red Hat advisory RHSA-2025:8293 to remediate these issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official update.