Red Hat Product Errata RHSA-2025:23035 - Security Advisory
Issued:
2025-12-10
Updated:
2025-12-10

RHSA-2025:23035 - Security Advisory

Synopsis

Important: firefox security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for firefox is now available for Red Hat Enterprise Linux 10.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

  • firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146 (CVE-2025-14333)
  • firefox: Use-after-free in the WebRTC: Signaling component (CVE-2025-14321)
  • firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14325)
  • firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2025-14322)
  • firefox: Privilege escalation in the Netmonitor component (CVE-2025-14328)
  • firefox: Privilege escalation in the Netmonitor component (CVE-2025-14329)
  • firefox: Same-origin policy bypass in the Request Handling component (CVE-2025-14331)
  • firefox: Privilege escalation in the DOM: Notifications component (CVE-2025-14323)
  • firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14330)
  • firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14324)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 10 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 10 s390x
  • Red Hat Enterprise Linux for Power, little endian 10 ppc64le
  • Red Hat Enterprise Linux for ARM 64 10 aarch64

Fixes

  • BZ - 2420502 - CVE-2025-14333 firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146
  • BZ - 2420503 - CVE-2025-14321 firefox: Use-after-free in the WebRTC: Signaling component
  • BZ - 2420504 - CVE-2025-14325 firefox: JIT miscompilation in the JavaScript Engine: JIT component
  • BZ - 2420506 - CVE-2025-14322 firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
  • BZ - 2420508 - CVE-2025-14328 firefox: Privilege escalation in the Netmonitor component
  • BZ - 2420509 - CVE-2025-14329 firefox: Privilege escalation in the Netmonitor component
  • BZ - 2420512 - CVE-2025-14331 firefox: Same-origin policy bypass in the Request Handling component
  • BZ - 2420513 - CVE-2025-14323 firefox: Privilege escalation in the DOM: Notifications component
  • BZ - 2420516 - CVE-2025-14330 firefox: JIT miscompilation in the JavaScript Engine: JIT component
  • BZ - 2420517 - CVE-2025-14324 firefox: JIT miscompilation in the JavaScript Engine: JIT component

Red Hat Enterprise Linux for x86_64 10

SRPM
firefox-140.6.0-1.el10_1.src.rpm SHA-256: d022b9d1ef017e17660ee7bed64f3fde718f3b746760c010d438bad7906dd385
x86_64
firefox-140.6.0-1.el10_1.x86_64.rpm SHA-256: e45cedd3d6b3ff7fa06a822ac23c060e179ac4ad5aef6fcfc8c8637309cce52a
firefox-debuginfo-140.6.0-1.el10_1.x86_64.rpm SHA-256: 0f0dbf1e71fcdb20ce53edb598715e308ad2478944b299e8f57bba913645478a
firefox-debugsource-140.6.0-1.el10_1.x86_64.rpm SHA-256: e1aa1e3f8930c713541a1241eda904ddcbbfd3c9b4be70f4625f13722523f0b9

Red Hat Enterprise Linux for IBM z Systems 10

SRPM
firefox-140.6.0-1.el10_1.src.rpm SHA-256: d022b9d1ef017e17660ee7bed64f3fde718f3b746760c010d438bad7906dd385
s390x
firefox-140.6.0-1.el10_1.s390x.rpm SHA-256: 5271806ff0049c1d3962ce7f59b263692448b84c753a89e8c0fcf0fe07a1eb1e
firefox-debuginfo-140.6.0-1.el10_1.s390x.rpm SHA-256: 43e22bdc46c7b55d4a1b0ecb02098056abcc7afd4d1dac30013d927569b61722
firefox-debugsource-140.6.0-1.el10_1.s390x.rpm SHA-256: 2254b4a7c070652684e8467adc47dd4e10a97b50d9d82e4714ad6af60ba69543

Red Hat Enterprise Linux for Power, little endian 10

SRPM
firefox-140.6.0-1.el10_1.src.rpm SHA-256: d022b9d1ef017e17660ee7bed64f3fde718f3b746760c010d438bad7906dd385
ppc64le
firefox-140.6.0-1.el10_1.ppc64le.rpm SHA-256: 10c7aa4d40580043373fdf9191a9b817e13e48d78e7803888b627b773a90f819
firefox-debuginfo-140.6.0-1.el10_1.ppc64le.rpm SHA-256: 7c5cf1f7ff8c460cd2020321c70756052647727c806b02addaaf470c88aa1006
firefox-debugsource-140.6.0-1.el10_1.ppc64le.rpm SHA-256: afe248ae23c0888da9b7dd2395fe1d9925ac5c4445f2398756faded93262745d

Red Hat Enterprise Linux for ARM 64 10

SRPM
firefox-140.6.0-1.el10_1.src.rpm SHA-256: d022b9d1ef017e17660ee7bed64f3fde718f3b746760c010d438bad7906dd385
aarch64
firefox-140.6.0-1.el10_1.aarch64.rpm SHA-256: 843215a80922eadaad2b6547a40307c1edba22c5f83d278c90e89d99873813c4
firefox-debuginfo-140.6.0-1.el10_1.aarch64.rpm SHA-256: 2aa649defa37f702b9b3951461f5d5f8d22bc65c08b1c53e74b73c57e1963975
firefox-debugsource-140.6.0-1.el10_1.aarch64.rpm SHA-256: 1a204aa18628916b0e00bd2df4c9cb6aff4003b8ed456c16e25650366d07ccbd

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.