This Red Hat security advisory addresses several vulnerabilities in Mozilla Firefox, fixed by upgrading to Firefox ESR 115.11.0. The key issues include CVE-2024-4367 (arbitrary JavaScript execution in PDF.js), CVE-2024-4767 (IndexedDB files retained in private browsing mode), CVE-2024-4768 (permissions request bypass via clickjacking), CVE-2024-4769 (cross-origin response content-type distinction), CVE-2024-4770 (use-after-free when printing to PDF), and CVE-2024-4777 (memory safety bugs). These vulnerabilities affect Firefox as packaged for Red Hat Enterprise Linux 8.4 variants. The advisory rates the update as important and recommends applying the update to mitigate these issues.

The vulnerabilities collectively could allow arbitrary JavaScript execution, privacy leaks via retained IndexedDB files in private browsing, bypass of permissions requests through clickjacking, information disclosure through cross-origin content-type distinctions, use-after-free memory corruption when printing PDFs, and other memory safety issues. These could lead to unauthorized code execution, privacy violations, or application crashes if exploited. No known exploits in the wild have been reported at the time of this advisory.

A security update is available that upgrades Firefox to version 115.11.0 ESR, which addresses all listed vulnerabilities. Red Hat recommends applying this update promptly after ensuring all previous relevant errata are applied. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official update.