security update for firefox

This security update for Mozilla Firefox ESR 115.10.0 addresses several vulnerabilities: CVE-2024-3852 (GetBoundName in JIT returned the wrong object), CVE-2024-3854 (out-of-bounds read after a mis-optimized switch statement), CVE-2024-3857 (incorrect JITting of arguments causing use-after-free during garbage collection), CVE-2024-2609 (permission prompt input delay expiration when not in focus), CVE-2024-3859 (integer overflow leading to out-of-bounds read in the OpenType sanitizer), CVE-2024-3861 (potential use-after-free due to AlignedBuffer self-move), and CVE-2024-3864 (memory safety bug fixed in Firefox 125, ESR 115.10, and Thunderbird 115.10). These vulnerabilities involve memory safety issues such as use-after-free and out-of-bounds reads, which could potentially be exploited to compromise the browser's security. The update is provided by Red Hat for multiple Red Hat Enterprise Linux 7 variants and requires a browser restart after installation.

The vulnerabilities fixed include memory safety bugs such as use-after-free and out-of-bounds reads, which can lead to crashes or potentially arbitrary code execution if exploited. The permission prompt input delay issue could affect user interaction security. These issues impact the security and stability of Firefox ESR 115.10.0 and related products. Red Hat rates the update as important, indicating a high security impact but no known active exploits in the wild at the time of the advisory.

A security update to Firefox ESR 115.10.0 is available and should be applied promptly. The update is provided by Red Hat for Red Hat Enterprise Linux 7 and related distributions. After applying the update, a restart of Firefox is required for the fixes to take effect. Users should follow vendor guidance for patch installation as detailed in the Red Hat advisory (https://access.redhat.com/errata/RHSA-2024:1910). No additional mitigation actions are indicated by the vendor.