This Red Hat security advisory addresses six distinct vulnerabilities in Mozilla Firefox, fixed in version 115.11.0 ESR. The vulnerabilities include CVE-2024-4367 (arbitrary JavaScript execution in PDF.js), CVE-2024-4767 (IndexedDB files retained in private browsing mode), CVE-2024-4768 (potential permissions request bypass via clickjacking), CVE-2024-4769 (cross-origin responses distinguishable by content-type), CVE-2024-4770 (use-after-free when printing to PDF), and CVE-2024-4777 (memory safety bugs). The update is provided for Red Hat Enterprise Linux 9.0 Extended Update Support and related variants. No CVSS scores are provided in the advisory; however, Red Hat rates the update as important. The advisory includes detailed package updates for multiple architectures and instructs users to apply all relevant errata before updating.

The vulnerabilities fixed could allow arbitrary JavaScript execution, privacy leaks via retained IndexedDB files in private browsing, bypass of permissions requests through clickjacking, information disclosure via cross-origin response content-type distinctions, use-after-free memory corruption when printing PDFs, and other memory safety issues. These could potentially lead to unauthorized code execution, privacy violations, or application crashes. The overall security impact is rated as important by Red Hat, indicating significant risk if unpatched.

Red Hat has released an official security update upgrading Firefox to version 115.11.0 ESR that addresses all listed vulnerabilities. Users should apply this update promptly after ensuring all previously released errata relevant to their system have been applied. Detailed update instructions are available at Red Hat's official documentation. No additional mitigation steps are indicated beyond applying the official patch.