This advisory addresses several security vulnerabilities in Mozilla Firefox as packaged by Red Hat for Enterprise Linux 7. The update to Firefox ESR 115.10.0 fixes multiple issues: CVE-2024-3852 (JIT GetBoundName returning wrong object), CVE-2024-3854 (out-of-bounds read from mis-optimized switch), CVE-2024-3857 (use-after-free from incorrect JITting of arguments during garbage collection), CVE-2024-2609 (permission prompt input delay expiration when not in focus), CVE-2024-3859 (integer overflow causing out-of-bounds read in OpenType sanitizer), CVE-2024-3861 (potential use-after-free due to AlignedBuffer self-move), and CVE-2024-3864 (memory safety bug). These fixes mitigate memory safety and logic errors that could impact browser stability and security. The update is available for multiple Red Hat Enterprise Linux 7 architectures and variants.

The vulnerabilities fixed include memory safety issues such as use-after-free and out-of-bounds reads, which could lead to crashes or potentially exploitable conditions. The permission prompt input delay flaw could affect user interaction security. While no known exploits in the wild have been reported, the issues collectively pose a high security risk if unpatched, potentially allowing attackers to compromise browser integrity or user security.

Red Hat has released an official security update upgrading Firefox to version 115.10.0 ESR for Red Hat Enterprise Linux 7 and related products. Applying this update and restarting Firefox fully mitigates the addressed vulnerabilities. Users should follow Red Hat's update instructions at https://access.redhat.com/articles/11258 to ensure their systems are protected.