This Red Hat security advisory addresses several vulnerabilities in Mozilla Firefox, fixed by upgrading to version 115.11.0 ESR. The key issues include CVE-2024-4367 (arbitrary JavaScript execution in PDF.js), CVE-2024-4767 (IndexedDB files retained in private browsing mode), CVE-2024-4768 (permissions request bypass via clickjacking), CVE-2024-4769 (distinguishing cross-origin responses by content-type), CVE-2024-4770 (use-after-free when printing to PDF), and CVE-2024-4777 (memory safety bugs). These vulnerabilities affect Firefox running on Red Hat Enterprise Linux 7 and related products. The advisory references fixes and updated packages available from Red Hat. No CVSS scores are provided in the advisory, but the update is rated as important.

The vulnerabilities fixed in this update could allow arbitrary JavaScript execution, privacy leaks via retained IndexedDB files in private browsing, bypass of permissions requests through clickjacking, information disclosure through cross-origin response content-type distinctions, use-after-free memory corruption when printing PDFs, and other memory safety issues. These issues could potentially be exploited to compromise browser security, user privacy, or stability. The advisory does not report known exploits in the wild at this time.

A security update to Firefox version 115.11.0 ESR is available from Red Hat for Red Hat Enterprise Linux 7 and related variants. Users should apply this update promptly after ensuring all previously released errata relevant to their system have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigation steps are indicated beyond applying the official update.