security update for firefox

This security update addresses several vulnerabilities in Firefox and Thunderbird, including CSP bypass and cross-site scripting (CVE-2024-11694), unhandled exceptions in add-on signature verification (CVE-2024-11696), select list elements being shown over other sites (CVE-2024-11692), memory safety bugs (CVE-2024-11699), URL bar spoofing via manipulated punycode and whitespace characters (CVE-2024-11695), and improper keypress handling in executable file confirmation dialogs (CVE-2024-11697). These issues were fixed in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. The update is part of Red Hat Enterprise Linux 10 and includes fixes for qemu-kvm virtualization components. The vendor advisory from Red Hat confirms the availability of patches and provides detailed guidance for applying updates.

The vulnerabilities could allow attackers to bypass content security policies, perform cross-site scripting attacks, cause unhandled exceptions leading to potential denial of service, spoof URLs in the address bar, and exploit memory safety bugs, which could lead to arbitrary code execution or crashes. These issues affect Firefox and Thunderbird components running on Red Hat Enterprise Linux 10. The overall impact is rated as high severity by the vendor.

Red Hat has released security updates addressing these vulnerabilities in Firefox, Thunderbird, and qemu-kvm packages for Red Hat Enterprise Linux 10. Users should apply the provided updates as detailed in the Red Hat advisory (https://access.redhat.com/errata/RHSA-2026:18479) and follow the update instructions at https://access.redhat.com/articles/11258. The vendor manages remediation through official patches; applying these updates will mitigate the vulnerabilities.