This Red Hat security advisory addresses several vulnerabilities in Mozilla Firefox ESR, fixed by upgrading to version 115.11.0 ESR. The vulnerabilities include CVE-2024-4367 (arbitrary JavaScript execution in PDF.js), CVE-2024-4767 (IndexedDB files retained in private browsing mode), CVE-2024-4768 (potential permissions request bypass via clickjacking), CVE-2024-4769 (cross-origin responses could be distinguished between script and non-script content-types), CVE-2024-4770 (use-after-free when printing to PDF), and CVE-2024-4777 (memory safety bugs). The update is provided for Red Hat Enterprise Linux 8.6 Extended Update Support and related platforms. No CVSS scores are provided in the advisory; however, Red Hat rates the update as important.

The vulnerabilities fixed could allow arbitrary JavaScript execution, privacy leaks through retained IndexedDB files in private browsing, bypass of permissions requests via clickjacking, information disclosure through cross-origin response content-type distinctions, use-after-free memory corruption when printing to PDF, and other memory safety issues. These issues could impact browser security and user privacy. No known exploits in the wild have been reported at this time.

A security update upgrading Firefox ESR to version 115.11.0 is available from Red Hat for affected systems. Users should apply this update promptly after ensuring all previous relevant errata are applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigation steps are indicated beyond applying the official update.