Multiple security vulnerabilities have been identified in Mozilla Firefox and Thunderbird as packaged by Red Hat Enterprise Linux 10. These include clickjacking that could leak saved payment card details, potential local code execution via the 'Copy as cURL' command, memory safety bugs, cross-origin resource status leakage, and improper isolation of script execution error handling from web content. Red Hat has issued an important security advisory with updates addressing these issues.
Two security vulnerabilities (CVE-2025-4918 and CVE-2025-4919) affecting Mozilla Firefox have been addressed in a Red Hat Enterprise Linux 10 update. Both issues involve out-of-bounds access errors, one when resolving Promise objects and the other when optimizing linear sums. Red Hat has released updated Firefox packages to fix these vulnerabilities. The update is rated as Important by Red Hat Product Security. No known exploits in the wild have been reported at this time.
Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in a Red Hat security update for Red Hat Enterprise Linux 8.2. These include privilege escalation in the Firefox Updater, unsafe attribute access during XPath parsing, process isolation bypass via "javascript:" URI links in cross-origin frames, and several memory safety bugs. The update fixes these issues in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Red Hat has rated the security impact as Important and recommends applying the update to affected systems.
Multiple security vulnerabilities have been identified and fixed in Mozilla Firefox and Thunderbird, including a URL bar spoofing issue via non-BMP Unicode characters (CVE-2025-3029), a use-after-free vulnerability triggered by XSLTProcessor (CVE-2025-3028), and various memory safety bugs (CVE-2025-3030). These issues affect Firefox ESR 128.9 and Thunderbird 128.9 on Red Hat Enterprise Linux 10. A security update is available to address these vulnerabilities.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in the browser (CVE-2024-10464)
* firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response (CVE-2024-10461)
* firefox: thunderbird: Permission leak via embed or object elements (CVE-2024-10458)
* firefox: thunderbird: Use-after-free in layout with accessibility (CVE-2024-10459)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4 (CVE-2024-10467)
* firefox: thunderbird: Clipboard "paste" button persisted across tabs (CVE-2024-10465)
* firefox: DOM push subscription message could hang Firefox (CVE-2024-10466)
* firefox: thunderbird: Cross origin video frame leak (CVE-2024-10463)
* firefox: thunderbird: Origin of permission prompt could be spoofed by long URL (CVE-2024-10462)
* firefox: thunderbird: Confusing display of origin for external protocol handler prompt (CVE-2024-10460)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A use-after-free vulnerability exists in the Animation timeline component of Mozilla Firefox, specifically in the version packaged for Red Hat Enterprise Linux 8.2. This flaw is tracked as CVE-2024-9680 and has been rated as having a high security impact. Exploitation of this vulnerability has been observed in the wild and is known to be used in ransomware campaigns. Red Hat has issued a security advisory and update to address this issue.
Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in Red Hat Enterprise Linux 8.6 updates. These include denial of service via specially crafted WebTransport requests, memory safety bugs, potential directory upload bypass via clickjacking, external protocol handler enumeration, potential memory corruption during JIT compilation and object cloning, cross-origin access to PDF and JSON contents through multipart responses, and site isolation bypass by compromised content processes. The update fixes these issues to improve security and stability.
Red Hat has issued a security advisory for a Firefox update addressing multiple vulnerabilities. The update is rated as Important by Red Hat Product Security and affects Red Hat Enterprise Linux 7 Extended Lifecycle Support. The advisory references multiple CVEs including CVE-2024-7518 and related issues. No detailed CVSS score or specific vulnerability details are provided in the advisory content. The update is available as version 115.14.0-2.el7_9 for various architectures.