This Red Hat security advisory covers an update to Mozilla Firefox ESR to version 115.11.0, which fixes six distinct security vulnerabilities: CVE-2024-4367 (arbitrary JavaScript execution in PDF.js), CVE-2024-4767 (IndexedDB files retained in private browsing mode), CVE-2024-4768 (permissions request bypass via clickjacking), CVE-2024-4769 (cross-origin response content-type distinction), CVE-2024-4770 (use-after-free when printing to PDF), and CVE-2024-4777 (memory safety bugs). The update is provided for Red Hat Enterprise Linux 9.2 Extended Update Support and related architectures. The advisory does not provide CVSS scores but rates the update as important. No known exploits in the wild have been reported at this time.

The vulnerabilities fixed in this update could allow arbitrary JavaScript execution, privacy leaks via retained IndexedDB files in private browsing, bypass of permissions requests through clickjacking, information disclosure through cross-origin response content-type distinctions, use-after-free memory corruption when printing to PDF, and other memory safety issues. These issues could potentially be exploited to compromise browser security and user privacy. However, no active exploits have been reported so far.

A security update to Firefox ESR version 115.11.0 is available from Red Hat and should be applied to affected systems running Red Hat Enterprise Linux 9.2 Extended Update Support and related variants. Before applying this update, ensure all previously released errata relevant to your system have been applied. Refer to Red Hat's official update instructions at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor.