This advisory covers five security vulnerabilities in Mozilla Thunderbird and Firefox components, including CVE-2025-9179 (sandbox escape via invalid pointer in Audio/Video GMP), CVE-2025-9180 (same-origin policy bypass in Graphics Canvas2D), CVE-2025-9181 (uninitialized memory in JavaScript Engine), CVE-2025-9182 (denial-of-service due to out-of-memory in Graphics WebRender), and CVE-2025-9185 (memory safety bugs). These vulnerabilities affect Thunderbird and Firefox ESR versions up to 128.14 and 140.2, as well as Firefox 142 and Thunderbird 142. Red Hat has issued updated packages for Red Hat Enterprise Linux 9.0 variants to address these issues.

The vulnerabilities could allow denial-of-service conditions, sandbox escapes, bypass of same-origin policy, exposure of uninitialized memory, and other memory safety issues. These impacts could compromise the security boundaries within Thunderbird and Firefox, potentially leading to unauthorized code execution or information disclosure. Red Hat rates the security impact as important, indicating a high risk to affected systems if unpatched.

Red Hat has released security updates for Thunderbird in Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Users should apply the Thunderbird update to version 128.14.0-3.el9_0 or later as provided by Red Hat to remediate these vulnerabilities. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.