This Red Hat security advisory addresses several vulnerabilities in Mozilla Firefox ESR, fixed by upgrading to version 115.11.0. The fixed issues include CVE-2024-4367 (arbitrary JavaScript execution in PDF.js), CVE-2024-4767 (IndexedDB files retained in private browsing mode), CVE-2024-4768 (permissions request bypass via clickjacking), CVE-2024-4769 (cross-origin response content-type distinction), CVE-2024-4770 (use-after-free when printing to PDF), and CVE-2024-4777 (memory safety bugs). The advisory covers Red Hat Enterprise Linux 8.10 and related extended lifecycle variants. Red Hat rates the security impact as moderate and provides updated packages to remediate these vulnerabilities.

The vulnerabilities fixed include arbitrary JavaScript execution which could allow malicious code execution within PDF.js, privacy issues with IndexedDB files persisting in private browsing mode, potential bypass of permissions requests via clickjacking, information leakage through cross-origin response content-type distinctions, use-after-free conditions that could lead to crashes or code execution when printing to PDF, and multiple memory safety bugs. These issues collectively pose risks to browser security, privacy, and stability. No known exploits in the wild have been reported at this time.

A security update to Firefox ESR 115.11.0 is available from Red Hat for affected Red Hat Enterprise Linux 8 systems. Users should apply this update promptly after ensuring all prior errata are applied. The vendor advisory provides detailed instructions for applying the update. No additional mitigations are noted or required beyond applying the official update.