This Red Hat security advisory addresses multiple vulnerabilities in Firefox, fixed by upgrading to version 115.11.0 ESR. The fixed issues include CVE-2024-4367 (arbitrary JavaScript execution in PDF.js), CVE-2024-4767 (IndexedDB files retained in private browsing mode), CVE-2024-4768 (permissions request bypass via clickjacking), CVE-2024-4769 (cross-origin response content-type distinction), CVE-2024-4770 (use-after-free when printing to PDF), and CVE-2024-4777 (memory safety bugs). These vulnerabilities could lead to unauthorized script execution, privacy leaks, permission bypass, and memory corruption. The update is available for Red Hat Enterprise Linux 8.4 variants including AUS, E4S, TUS, and SAP Solutions update services. Red Hat rates the security impact as Important and recommends applying the update after ensuring all previous errata are applied.

The vulnerabilities fixed in this update could allow attackers to execute arbitrary JavaScript code via PDF.js, bypass permission requests through clickjacking, distinguish cross-origin responses by content-type, retain IndexedDB files in private browsing mode potentially leaking data, and cause use-after-free memory corruption when printing to PDF. These issues may compromise user privacy, security, and stability of the Firefox browser on affected Red Hat Enterprise Linux systems. No known exploits in the wild have been reported at this time.

Red Hat has released an official security update upgrading Firefox to version 115.11.0 ESR that addresses these vulnerabilities. Users should apply this update promptly after ensuring all previously released relevant errata have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigation steps are indicated beyond applying the official patch.