This Red Hat security advisory addresses six distinct vulnerabilities in Mozilla Firefox ESR, fixed by upgrading to version 115.11.0 ESR. The vulnerabilities include CVE-2024-4367 (arbitrary JavaScript execution in PDF.js), CVE-2024-4767 (IndexedDB files retained in private browsing mode), CVE-2024-4768 (permissions request bypass via clickjacking), CVE-2024-4769 (cross-origin response content-type distinction), CVE-2024-4770 (use-after-free when printing to PDF), and CVE-2024-4777 (memory safety bugs). The update is provided for Red Hat Enterprise Linux 9 and related extended support versions. Red Hat rates the security impact as Important and recommends applying the update to mitigate these issues.

The vulnerabilities fixed by this update could allow arbitrary JavaScript execution, privacy leaks due to IndexedDB file retention in private browsing, bypass of permissions requests, information disclosure via cross-origin content-type distinctions, use-after-free memory corruption, and other memory safety issues. These could potentially lead to unauthorized code execution, privacy violations, or application crashes. Red Hat classifies the overall impact as Important (high severity). There are no known exploits in the wild at the time of this advisory.

Red Hat has released an official update upgrading Firefox ESR to version 115.11.0 that addresses all listed vulnerabilities. Users and administrators should apply this update promptly to affected Red Hat Enterprise Linux 9 systems and variants. Before applying this update, ensure all previously released errata relevant to the system are applied. No additional mitigations are indicated or required beyond applying the official update.