Threats affecting pkg:rpm/redhat/firefox

Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in Red Hat Enterprise Linux 8.2. These include sandbox escapes, same-origin policy bypass, memory safety bugs, information disclosure, incorrect boundary conditions, and integer overflow. The update fixes these issues in Firefox ESR 140.3 and Thunderbird ESR 140.3. Red Hat rates the overall security impact as Important.

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component (CVE-2025-9182) * thunderbird: firefox: Sandbox escape due to invalid pointer in the Audio/Video: GMP component (CVE-2025-9179) * thunderbird: firefox: Same-origin policy bypass in the Graphics: Canvas2D component (CVE-2025-9180) * thunderbird: firefox: Uninitialized memory in the JavaScript Engine component (CVE-2025-9181) * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 (CVE-2025-9185) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple security vulnerabilities were identified in Mozilla Firefox, including a use-after-free in FontFaceSet, improper handling of Content-Disposition headers in embedded files, incorrect URL parsing allowing embedding of youtube.com, and exposure of a persistent UUID via the WebCompat WebExtension. These issues affect Firefox versions distributed with Red Hat Enterprise Linux 9 and SUSE Linux Enterprise. A security update addressing these vulnerabilities is available from Red Hat and SUSE.

A security update for Mozilla Firefox and Thunderbird addresses multiple vulnerabilities including clickjacking that could leak saved payment card details, potential local code execution via the 'Copy as cURL' command, memory safety bugs, cross-origin resource status leakage, and improper isolation of script execution error handling from web content. These issues have been rated as important by Red Hat Product Security and affect Red Hat Enterprise Linux 9.2 variants. The update is available and should be applied to mitigate these vulnerabilities.

Red Hat has issued a security advisory for Firefox addressing two vulnerabilities involving out-of-bounds access in Firefox and Thunderbird. These vulnerabilities are identified as CVE-2025-4918 and CVE-2025-4919. The issues relate to out-of-bounds access when resolving Promise objects and when optimizing linear sums. The advisory rates the security impact as Important and provides updated Firefox packages for Red Hat Enterprise Linux 8.4. No CVSS score is provided in the advisory.