This Red Hat security advisory (RHSA-2025:9073) addresses multiple vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2025-5263, CVE-2025-5264, CVE-2025-5266, CVE-2025-5267, CVE-2025-5268, CVE-2025-5269, and CVE-2025-5283. The vulnerabilities cover a range of issues such as clickjacking leading to potential leakage of saved payment card details, potential local code execution through the 'Copy as cURL' command, memory safety bugs, leakage of cross-origin resource status via script element events, and incorrect isolation of error handling from web content. The advisory applies to Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions on multiple architectures (ppc64le, x86_64, aarch64, s390x). Red Hat has released updated Firefox packages (version 128.11.0-1.el9_0) to address these issues. The advisory does not provide CVSS scores but rates the update as important.

The vulnerabilities could allow an attacker to leak sensitive information such as saved payment card details (via clickjacking), execute code locally through crafted use of the 'Copy as cURL' command, and exploit memory safety bugs that may lead to crashes or potential code execution. Leakage of cross-origin resource status and improper error handling isolation could also lead to information disclosure or security bypasses. These issues collectively pose a high security risk to users of affected Firefox and Thunderbird versions on Red Hat Enterprise Linux 9.0.

Red Hat has released updated Firefox packages (version 128.11.0-1.el9_0) for Red Hat Enterprise Linux 9.0 on supported architectures. Users should apply these official updates promptly to remediate the vulnerabilities. Detailed update instructions are available at https://access.redhat.com/articles/11258. No indication of alternative mitigations or that no action is required is provided; applying the official patch is the recommended remediation.