Jump to content

trium

Experienced Members
 View Profile  See their activity

  • Posts

    2,544

  • Joined

  • Last visited

 Content Type 

Posts posted by trium

    The Firefox/Mozilla Thread

    in Software

    Posted

    On 02/08/2023 at 21:45, trium said:

    ff v115.1.0 esr

     

    there are today no entrys from mozilla - perhaps later

    hello mods -> i cant edit my post above... can one of you insert this new with the belated infos into there and overwrite the old entry? thanks

     

    ff v115.1.0 esr

    01. aug 2023

    Fixed

    Quote

    Security Vulnerabilities fixed in Firefox ESR 115.1

    Announced August 1, 2023
    Impact high
    Products Firefox ESR
    Fixed in
    • Firefox ESR 115.1

    #CVE-2023-4045: Offscreen Canvas could have bypassed cross-origin restrictions

    Reporter Max Vlasov
    Impact high
    Description

    Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy.

    References

    #CVE-2023-4046: Incorrect value used during WASM compilation

    Reporter Alexander Guryanov
    Impact high
    Description

    In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process.

    References

    #CVE-2023-4047: Potential permissions request bypass via clickjacking

    Reporter Axel Chong (@Haxatron)
    Impact high
    Description

    A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions.

    References

    #CVE-2023-4048: Crash in DOMParser due to out-of-memory conditions

    Reporter Irvan Kurniawan
    Impact high
    Description

    An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations.

    References

    #CVE-2023-4049: Fix potential race conditions when releasing platform objects

    Reporter Nika Layzell
    Impact high
    Description

    Race conditions in reference counting code were found through code inspection. These could have resulted in potentially exploitable use-after-free vulnerabilities.

    References

    #CVE-2023-4050: Stack buffer overflow in StorageManager

    Reporter Mark Brand
    Impact high
    Description

    In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a potentially exploitable crash which could have led to a sandbox escape.

    References

    #CVE-2023-4052: File deletion and privilege escalation through Firefox uninstaller

    Reporter ycdxsb
    Impact moderate
    Description

    The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be recursively deleted with the permissions of the uninstalling user account. This could be combined with creation of a junction (a form of symbolic link) to allow arbitrary file deletion controlled by the non-privileged user.
    This bug only affects Firefox on Windows. Other operating systems are unaffected.

    References

    #CVE-2023-4054: Lack of warning when opening appref-ms files

    Reporter P Umar Farooq
    Impact moderate
    Description

    When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code.
    This bug only affects Firefox on Windows. Other operating systems are unaffected.

    References

    #CVE-2023-4055: Cookie jar overflow caused unexpected cookie jar state

    Reporter Marco Squarcina
    Impact low
    Description

    When the number of cookies per domain was exceeded in document.cookie, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing.

    References

    #CVE-2023-4056: Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14

    Reporter Dianna Smith, Ryan VanderMeulen, Timothy Nikkel, and the Mozilla Fuzzing Team
    Impact high
    Description

    Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

    References

    #CVE-2023-4057: Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1

    Reporter The Mozilla Fuzzing Team
    Impact high
    Description

    Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

    References

    The Firefox/Mozilla Thread

    in Software

    Posted

    ff v102.14.0 esr

    01. aug 2023

    Fixed

    • Various security fixes and other quality improvements.

    Quote

    Security Vulnerabilities fixed in Firefox ESR 102.14

    Announced August 1, 2023
    Impact high
    Products Firefox ESR
    Fixed in
    • Firefox ESR 102.14

    #CVE-2023-4045: Offscreen Canvas could have bypassed cross-origin restrictions

    Reporter Max Vlasov
    Impact high
    Description

    Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy.

    References

    #CVE-2023-4046: Incorrect value used during WASM compilation

    Reporter Alexander Guryanov
    Impact high
    Description

    In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process.

    References

    #CVE-2023-4047: Potential permissions request bypass via clickjacking

    Reporter Axel Chong (@Haxatron)
    Impact high
    Description

    A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions.

    References

    #CVE-2023-4048: Crash in DOMParser due to out-of-memory conditions

    Reporter Irvan Kurniawan
    Impact high
    Description

    An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations.

    References

    #CVE-2023-4049: Fix potential race conditions when releasing platform objects

    Reporter Nika Layzell
    Impact high
    Description

    Race conditions in reference counting code were found through code inspection. These could have resulted in potentially exploitable use-after-free vulnerabilities.

    References

    #CVE-2023-4050: Stack buffer overflow in StorageManager

    Reporter Mark Brand
    Impact high
    Description

    In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a potentially exploitable crash which could have led to a sandbox escape.

    References

    #CVE-2023-4054: Lack of warning when opening appref-ms files

    Reporter P Umar Farooq
    Impact moderate
    Description

    When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code.
    This bug only affects Firefox on Windows. Other operating systems are unaffected.

    References

    #CVE-2023-4055: Cookie jar overflow caused unexpected cookie jar state

    Reporter Marco Squarcina
    Impact low
    Description

    When the number of cookies per domain was exceeded in document.cookie, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing.

    References

    #CVE-2023-4056: Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14

    Reporter Dianna Smith, Ryan VanderMeulen, Timothy Nikkel, and the Mozilla Fuzzing Team
    Impact high
    Description

    Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

    References

    Special Notes

    There is one more planned release of Firefox 102 ESR, and then it will go out of support on September 26, 2023. Users will then be automatically upgraded to the Firefox 115 ESR.

    If you need to prevent upgrades for any reason, you can use the new AppUpdatePin policy.

     

    The Firefox/Mozilla Thread

    in Software

    Posted

    ff v116.0

    01. aug 2023

    New

    • Sidebar switcher allows users to access Bookmarks, History and Synced Tabs panels easily, quickly switch between them, move the sidebar to another side of the browser window, or close the sidebar. Now, keyboard users would be able to do it all with ease too, with or without any assistive technology running, without needing to memorize keyboard shortcuts to access these panels.

    • When an update is available in English locales, users will now have access to the release notes in the update notification prompt in the form of a "Learn More" link.

    • It is now possible to copy any file from your operating system and paste it into Firefox.

    • You asked, and we listened! The volume slider is now available in Picture-in-Picture.

    • We added the possibility to edit existing text annotations.

    Fixed

    • The upload performance of HTTP/2 has been significantly improved starting with Firefox 115.0, particularly on those with a higher bandwidth delay product (i.e., networks characterized by both high bandwidth and high latency).

    • Various security fixes.

    Changed

    • The keyboard shortcut to reopen closed tabs (command + shift + t) now reopens last closed tab or last closed window, in the order items were closed. If there aren't any tabs or windows to reopen, this command restores the previous session. This change is in anticipation of upcoming changes to recently closed tabs.

    Enterprise

    • You can find information about policy updates and enterprise specific bug fixes in the Firefox for Enterprise 116 Release Notes.

    Developer

    Developer Information

    • Added support for the dirname attribute to pass text directionality information about input and textarea elements to the server. (learn more)

    • Firefox now supports CSP3 external hashes.

    • The Audio Output Devices API now enables sites to redirect audio from media elements to permitted output devices (speakers) other than the system default for the user-agent.
      For example, WebRTC conferencing sites can now redirect audio either to the speakers in a headset or to external speakers.

    • With custom formatters, websites can now define how to display specific JavaScript objects and functions within different parts of the DevTools. This feature is disabled by default and can be enabled via the Settings panel. (Learn more)

    Web Platform

    • This release now supports proper BYOB readers on Fetch and WebTransport, which allows developers to prepare their ArrayBuffer so that it can be reused for read requests and thus saves memory allocation. .getReader({ mode: "byob" }) on Fetch and WebTransport streams was supported on previous releases but without true BYOB support, as new memory allocation still occurred internally.

    The Firefox/Mozilla Thread

    in Software

    Posted

    ff v115.0.2 esr

    11. july 2023

    Fixed

    • Fixed a startup crash experienced by some Windows 10 and 11 users by blocking instances of a malicious injected DLL (bug 1841751)

    • Fixed a bug with displaying a caret in the text editor on some websites (bug 1840804)

    • Fixed a bug with broken audio rendering on some websites (bug 1841982)

    • Fixed a bug with patternTransform translate using the wrong units (bug 1840746)

    • A security fix.

    • Fixed a crash affecting Windows 7 users related to the DLL blocklist.

    Quote

    Security Vulnerabilities fixed in Firefox 115.0.2 and Firefox ESR 115.0.2

    Announced July 11, 2023
    Impact high
    Products Firefox, Firefox ESR
    Fixed in
    • Firefox 115.0.2
    • Firefox ESR 115.0.2

    #CVE-2023-3600: Use-after-free in workers

    Reporter Andrew McCreight
    Impact moderate
    Description

    During the worker lifecycle, a use-after-free condition could have occured, which could have led to a potentially exploitable crash.

    References

    The Firefox/Mozilla Thread

    in Software

    Posted

    ff v115.0.2

    11. july 2023

    Fixed

    • Fixed a startup crash experienced by some Windows 10 and 11 users by blocking instances of a malicious injected DLL (bug 1841751)

    • Fixed a bug with displaying a caret in the text editor on some websites (bug 1840804)

    • Fixed a bug with broken audio rendering on some websites (bug 1841982)

    • Fixed a bug with patternTransform translate using the wrong units (bug 1840746)

    • A security fix.

    • Fixed a crash affecting Windows 7 users related to the DLL blocklist.

    The Firefox/Mozilla Thread

    in Software

    Posted

    ff v115.0 esr     <-- last line for w7/8/8.1 with only security updates until sep 2024

    04. july 2023

    New

      • Required fields are now highlighted in PDF forms.
      • Improved performance on high-refresh rate monitors (120Hz+).
      • Buttons in the Tabs toolbar can now be reached with Tab, Shift+Tab, and Arrow keys. View this article for additional details.
      • Windows' "Make text bigger" accessibility setting now affects all the UI and content pages, rather than only applying to system font sizes.
      • Non-breaking spaces are now preserved—preventing automatic line breaks—when copying text from a form control.
      • Fixed WebGL performance issues on NVIDIA binary drivers via DMA-Buf on Linux.
      • Fixed an issue in which Firefox startup could be significantly slowed down by the processing of Web content local storage. This had the greatest impact on users with platter hard drives and significant local storage.
      • Removed a configuration option to allow SHA-1 signatures in certificates: SHA-1 signatures in certificates—long since determined to no longer be secure enough—are now not supported.
      • Highlight color is preserved correctly after typing Enter in the mail composer of Yahoo Mail and Outlook.
        After bypassing the https only error page navigating back would take you to the error page that was previously dismissed. Back now takes you to the previous site that was visited.
      • Paste unformatted shortcut (shift+ctrl/cmd+v) now works in plain text contexts, such as input and text area.
      • Added an option to print only the current page from the print preview dialog.
      • Swipe to navigate (two fingers on a touchpad swiped left or right to perform history back or forward) on Windows is now enabled.
      • Stability on Windows is significantly improved as Firefox handles low-memory situations much better.
      • Touchpad scrolling on macOS was made more accessible by reducing unintended diagonal scrolling opposite of the intended scroll axis.
      • Firefox is less likely to run out of memory on Linux and performs more efficiently for the rest of the system when memory runs low.
      • It is now possible to edit PDFs: including writing text, drawing, and adding signatures.
      • Setting Firefox as your default browser now also makes it the default PDF application on Windows systems if the default PDF application is another browser.
      • Swipe-to-navigate (two fingers on a touchpad swiped left or right to perform history back or forward) now works for Linux users on Wayland.
      • Text Recognition in images allows users on macOS 10.15 and higher to extract text from the selected image (such as a meme or screenshot).
      • Firefox View helps you get back to content you previously discovered. A pinned tab allows you to find and open recently closed tabs on your current device and access tabs from other devices (via our “Tab Pickup” feature).
      • Import maps, which allow web pages to control the behavior of JavaScript imports, are now enabled by default.
      • Processes used for background tabs now use efficiency mode on Windows 11 to limit resource use.
      • The shift+esc keyboard shortcut now opens the Process Manager, offering a way to quickly identify processes that are using too many resources.
      • Firefox now supports properly color correcting images tagged with ICCv4 profiles.
      • Support for non-English characters when saving and printing PDF forms.
      • The bookmarks toolbar's default "Only show on New Tab" state works correctly for blank new tabs. As before, you can change the bookmark toolbar's behavior using the toolbar context menu.
      • Manifest Version 3 (MV3) extension support is now enabled by default (MV2 remains enabled/supported). This major update also ushers an exciting user interface change in the form of the new extensions button.
      • The Arbitrary Code Guard exploit protection has been enabled in the media playback utility processes, improving security for Windows users.
      • The native HTML date picker for date and datetime inputs can now be used with a keyboard alone, improving its accessibility for screen reader users. Users with limited mobility can also now use common keyboard shortcuts to navigate the calendar grid and month selection spinners.
      • Firefox builds in the Spanish from Spain (es-ES) and Spanish from Argentina (es-AR) locales now come with a built-in dictionary for the Firefox spellchecker.
      • On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls the page instead of zooming. This avoids accidental zooming and matches the behavior of other web browsers on macOS.
      • It's now possible to import bookmarks, history and passwords not only from Edge, Chrome or Safari but also from Opera, Opera GX, and Vivaldi.
      • GPU sandboxing has been enabled on Windows.
      • On Windows, third-party modules can now be blocked from injecting themselves into Firefox, which can be helpful if they are causing crashes or other undesirable behavior.
      • Date, time, and datetime-local input fields can now be cleared with Cmd+Backspace and Cmd+Delete shortcut on macOS and Ctrl+Backspace and Ctrl+Delete on Windows and Linux.
      • GPU-accelerated Canvas2D is enabled by default on macOS and Linux.
      • WebGL performance improvement on Windows, MacOS and Linux.
      • Enables overlay of hardware-decoded video with non-Intel GPUs on Windows 10/11, improving video playback performance and video scaling quality.
      • Windows native notifications are now enabled.
      • Firefox Relay users can now opt-in to create Relay email masks directly from the Firefox credential manager. You must be signed in with your Firefox Account.
      • We’ve added two new locales: Silhe Friulian (fur) and Sardinian (sc).
      • Right-clicking on password fields now shows an option to reveal the password.
      • Private windows and ETP set to strict will now include email tracking protection. This will make it harder for email trackers to learn the browsing habits of Firefox users. You can check the Tracking Content in the sub-panel on the shield icon panel.
      • The deprecated U2F Javascript API is now disabled by default. The U2F protocol remains usable through the WebAuthn API. The U2F API can be re-enabled using the security.webauth.u2f preference.
      • Say hello to enhanced Picture-in-Picture! Rewind, check video duration, and effortlessly switch to full-screen mode on the web's most popular video websites.
      • Firefox's address bar is already a great place to search for what you're looking for. Now you'll always be able to see your web search terms and refine them while viewing your search's results - no additional scrolling needed! Also, a new result menu has been added making it easier to remove history results and dismiss sponsored Firefox Suggest entries.
      • Private windows now protect users even better by blocking third-party cookies and storage of content trackers.
      • Passwords automatically generated by Firefox now include special characters, giving users more secure passwords by default.
      • Firefox 113 introduces a redesigned accessibility engine which significantly improves the speed, responsiveness, and stability of Firefox when used with:
      • Screen readers, as well as certain other accessibility software;
      • East Asian input methods;
      • Enterprise single sign-on software; and
      • Other applications which use accessibility frameworks to access information.
      • Firefox 113 now supports AV1 Image Format files containing animations (AVIS), improving support for AVIF images across the web.
      • The Windows GPU sandbox first shipped in the Firefox 110 release has been tightened to enhance the security benefits it provides.
      • A 13-year-old feature request was fulfilled and Firefox now supports files being drag-and-dropped directly from Microsoft Outlook. A special thanks to volunteer contributor Marco Spiess for helping to get this across the finish line!
      • Users on macOS can now access the Services sub-menu directly from Firefox context menus.
      • On Windows, the elastic overscroll effect has been enabled by default. When two-finger scrolling on the touchpad or scrolling on the touchscreen, you will now see a bouncing animation when scrolling past the edge of a scroll container.
      • Firefox is now available in the Tajik (tg) language.
      • Added UI to manage the DNS over HTTPS exception list.
      • Bookmarks can now be searched from the Bookmarks menu. The Bookmarks menu is accessible by adding the Bookmarks menu button to the toolbar.
      • Restrict searches to your local browsing history by selecting Search history from the History, Library or Application menu buttons.
      • Mac users can now capture video from their cameras in all supported native resolutions. This enables resolutions higher than 1280x720.
      • It is now possible to reorder the extensions listed in the extensions panel.
      • Users on macOS, Linux, and Windows 7 can now use FIDO2 / WebAuthn authenticators over USB. Some advanced features, such as fully passwordless logins, require a PIN to be set on the authenticator.
      • Pocket Recommended content can now be seen in France, Italy, and Spain.
      • DNS over HTTPS settings are now part of the Privacy & Security section of the Settings page and allow the user to choose from all the supported modes.
      • Migrating from another browser? Now you can bring over payment methods you've saved in Chrome-based browsers to Firefox.
      • Hardware video decoding enabled for Intel GPUs on Linux.
      • The Tab Manager dropdown now features close buttons, so you can close tabs more quickly.
      • Windows Magnifier now follows the text cursor correctly when the Firefox title bar is visible.
      • Undo and redo are now available in Password fields.

    Fixed

    Developer

    Developer Information

    Quote

    Security Vulnerabilities fixed in Firefox 115

    Announced July 4, 2023
    Impact high
    Products Firefox
    Fixed in
    • Firefox 115

    #CVE-2023-3482: Block all cookies bypass for localstorage

    Reporter Martin Hostettler
    Impact moderate
    Description

    When Firefox is configured to block storage of all cookies, it was still possible to store data in localstorage by using an iframe with a source of 'about:blank'. This could have led to malicious websites storing tracking data without permission.

    References

    #CVE-2023-37201: Use-after-free in WebRTC certificate generation

    Reporter Irvan Kurniawan
    Impact high
    Description

    An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS.

    References

    #CVE-2023-37202: Potential use-after-free from compartment mismatch in SpiderMonkey

    Reporter zx
    Impact high
    Description

    Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free.

    References

    #CVE-2023-37203: Drag and Drop API may provide access to local system files

    Reporter Paul Nickerson
    Impact moderate
    Description

    Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed an attacker to trick end-users into creating a shortcut to local system files. This could have been leveraged to execute arbitrary code.

    References

    #CVE-2023-37204: Fullscreen notification obscured via option element

    Reporter Irvan Kurniawan
    Impact moderate
    Description

    A website could have obscured the fullscreen notification by using an option element by introducing lag via an expensive computational function. This could have led to user confusion and possible spoofing attacks.

    References

    #CVE-2023-37205: URL spoofing in address bar using RTL characters

    Reporter Rohan Sharma
    Impact moderate
    Description

    The use of RTL Arabic characters in the address bar may have allowed for URL spoofing.

    References

    #CVE-2023-37206: Insufficient validation of symlinks in the FileSystem API

    Reporter Ameen Basha M K
    Impact moderate
    Description

    Uploading files which contain symlinks may have allowed an attacker to trick a user into submitting sensitive data to a malicious website.

    References

    #CVE-2023-37207: Fullscreen notification obscured

    Reporter Shaheen Fazim
    Impact moderate
    Description

    A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks.

    References

    #CVE-2023-37208: Lack of warning when opening Diagcab files

    Reporter P Umar Farooq
    Impact moderate
    Description

    When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code.

    References

    #CVE-2023-37209: Use-after-free in `NotifyOnHistoryReload`

    Reporter Simon Descarpentries
    Impact moderate
    Description

    A use-after-free condition existed in NotifyOnHistoryReload where a LoadingSessionHistoryEntry object was freed and a reference to that object remained. This resulted in a potentially exploitable condition when the reference to that object was later reused.

    References

    #CVE-2023-37210: Full-screen mode exit prevention

    Reporter Hafiizh
    Impact low
    Description

    A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spoofing attacks.

    References

    #CVE-2023-37211: Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13

    Reporter Andrew McCreight, Matthew Gaudet, Tom Ritter, and the Mozilla Fuzzing Team,
    Impact high
    Description

    Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

    References

    #CVE-2023-37212: Memory safety bugs fixed in Firefox 115

    Reporter Andrew McCreight, and the Mozilla Fuzzing Team
    Impact high
    Description

    Memory safety bugs present in Firefox 114. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

    References

    The Firefox/Mozilla Thread

    in Software

    Posted

    ff v102.13.0 esr

    04. july 2023

    Fixed

    • Various security fixes and other quality improvements.

    Quote

    Security Vulnerabilities fixed in Firefox ESR 102.13

    Announced July 4, 2023
    Impact high
    Products Firefox ESR
    Fixed in
    • Firefox ESR 102.13

    #CVE-2023-37201: Use-after-free in WebRTC certificate generation

    Reporter Irvan Kurniawan
    Impact high
    Description

    An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS.

    References

    #CVE-2023-37202: Potential use-after-free from compartment mismatch in SpiderMonkey

    Reporter zx
    Impact high
    Description

    Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free.

    References

    #CVE-2023-37207: Fullscreen notification obscured

    Reporter Shaheen Fazim
    Impact moderate
    Description

    A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks.

    References

    #CVE-2023-37208: Lack of warning when opening Diagcab files

    Reporter P Umar Farooq
    Impact moderate
    Description

    When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code.

    References

    #CVE-2023-37211: Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13

    Reporter Andrew McCreight, Matthew Gaudet, Tom Ritter, and the Mozilla Fuzzing Team,
    Impact high
    Description

    Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

    References

    The Firefox/Mozilla Thread

    in Software

    Posted

    ff v115.0

    04. july 2023

    In January 2023, Microsoft ended support for Windows 7 and Windows 8. As a consequence, this is the last version of Firefox that users on those operating systems will receive. Users on Windows 7 and Windows 8 will automatically be migrated to the ESR 115 version of Firefox so that they continue to receive important security updates. Visit this Firefox support article for more information.

    -> support until sep 2024 with security updates

    Similarly, this is the last major version of Firefox that will support Apple macOS 10.12, 10.13, and 10.14. Users on those operating systems will be migrated to the ESR 115 version of Firefox so that they continue to receive important updates. Visit this Firefox support article for more information.

     

    New

    • Migrating from another browser? Now you can bring over payment methods you've saved in Chrome-based browsers to Firefox.

    • Hardware video decoding is now enabled for Intel GPUs on Linux.

    • The Tab Manager dropdown now features close buttons, so you can close tabs more quickly.

    • We've refreshed and streamlined the user interface for importing data in from other browsers.

    • Users without platform support for H264 video decoding can now fallback to Cisco's OpenH264 plugin for playback.

    Fixed

    • Windows Magnifier now follows the text cursor correctly when the Firefox title bar is visible.

    • Windows users on low-end/USB wifi drivers and with OS geolocation disabled can now approve geolocation on a case by case basis without causing system-wide network instability.

    • Various security fixes.

    Changed

    • Undo and redo are now available in Password fields.

    • On Linux, middle clicks on the new tab button will now open the xclipboard contents in the new tab. If the xclipboard content is a URL then that URL is opened, any other text is opened with your default search provider.

    • For users with a Firefox Colorways built-in theme, the theme will be automatically migrated to the same theme hosted on addons.mozilla.org for Firefox profiles that have disabled add-ons auto-updates. This will allow users to keep their Colorways theme when they are later removed from Firefox installer files.

    • Certain Firefox users may come across a message in the extensions panel indicating that their add-ons are not allowed on the site currently open. We have introduced a new back-end feature to only allow some extensions monitored by Mozilla to run on specific websites for various reasons, including security concerns.

    Enterprise

    • You can find information about policy updates and enterprise specific bug fixes in the Firefox for Enterprise 115 Release Notes.

    Developer

    Developer Information

    • In web development, we rely on third-party libraries which you may not be interested in while debugging. These can be ignored. Ignoring them means that breakpoints will not get hit and they are skipped during stepping.

      You can now choose to Hide ignore-listed sources in the Developer Tools source tree (bug).

      developer tools screenshot of the Hide ignore-listed sources option

      Ignored sources are also skipped by JavaScript tracing feature (bug).

    • We have introduced a new option, devtools.f12_enabled, that can be utilized to prevent the accidental use of the F12 key, which opens the DevTools toolbox (bug).

    Web Platform

    • The builtin editor now behaves similarly to other browsers with contenteditable and designMode when splitting a node, e.g. typing Enter to split a paragraph, and also when joining two nodes, e.g. typing Backspace at the start of a paragraph to join the paragraph and the previous one.

      When a node is split, the builtin editor creates a new node after the original one instead of before, i.e. creates the right node instead of the left node.

      Similarly, when two nodes are joined, the builtin editor deletes the latter node and moves its children to the end of the preceding node instead of deleting the former node and moving its child to the start of the following node.

    • WebRTC application developers can now specify a target in milliseconds of media for the jitter buffer to hold. Altering the target value allows applications to control the tradeoff between playout delay and the risk of running out of audio or video frames due to network jitter.

    • Change array by copy provides additional methods on Array.prototype and TypedArray.prototype to enable changes on the array by returning a new copy of it with the change.

    • The animation-composition property is now supported, allowing a declarative way to define the composite operation used when multiple animations affect the same property simultaneously.

    • Added the URL.canParse() function to allow easy and fast checking if URLs are valid and parseable.

    • IndexedDB is now also supported in private browsing without memory limits thanks to encrypted storage on disk. The temporary keys to decrypt the information are held in RAM only and all stored information is purged at the normal end of a private browsing session from disk.

    • Supports conditions are now supported in CSS import rules @import supports(...)

    The Firefox/Mozilla Thread

    in Software

    Posted

    ff v102.12.0 esr

    06. jun 2023

    Fixed

    • Various security fixes and other quality improvements.

    Quote

    Security Vulnerabilities fixed in Firefox ESR 102.12

    Announced June 6, 2023
    Impact high
    Products Firefox ESR
    Fixed in
    • Firefox ESR 102.12

    #CVE-2023-34414: Click-jacking certificate exceptions through rendering lag

    Reporter Irvan Kurniawan
    Impact high
    Description

    The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks that exploit human response time delays. If a malicious page elicited user clicks in precise locations immediately before navigating to a site with a certificate error and made the renderer extremely busy at the same time, it could create a gap between when the error page was loaded and when the display actually refreshed. With the right timing the elicited clicks could land in that gap and activate the button that overrides the certificate error for that site.

    References

    #CVE-2023-34416: Memory safety bugs fixed in Firefox 114 and Firefox ESR 102.12

    Reporter Mozilla developers and community
    Impact high
    Description

    Mozilla developers and community members Gabriele Svelto, Andrew McCreight, the Mozilla Fuzzing Team, Sean Feng, and Sebastian Hengst reported memory safety bugs present in Firefox 113 and Firefox ESR 102.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

    References

    The Firefox/Mozilla Thread

    in Software

    Posted

    ff v114.0

    06. jun 2023

    New

    • Added UI to manage the DNS over HTTPS exception list.

    • Bookmarks can now be searched from the Bookmarks menu. The Bookmarks menu is accessible by adding the Bookmarks menu button to the toolbar.

    • Restrict searches to your local browsing history by selecting Search history from the History, Library or Application menu buttons.

    • Mac users can now capture video from their cameras in all supported native resolutions. This enables resolutions higher than 1280x720.

    • It is now possible to reorder the extensions listed in the extensions panel.

    • Users on macOS, Linux, and Windows 7 can now use FIDO2 / WebAuthn authenticators over USB. Some advanced features, such as fully passwordless logins, require a PIN to be set on the authenticator.

    • Pocket Recommended content can now be seen in France, Italy, and Spain.

    Fixed

    Changed

    • DNS over HTTPS settings are now part of the Privacy & Security section of the Settings page and allow the user to choose from all the supported modes.

    Enterprise

    • You can find information about policy updates and enterprise specific bug fixes in the Firefox for Enterprise 114 Release Notes.

    Developer

    Developer Information

    • The Copy as cURL feature, available in the Network panel, has been enhanced. It now supports the --compressed argument.

    • The Accessibility Inspector has been improved to accurately recognize all the ARIA roles like banner, main, navigation, and contentinfo, etc. This enhancement is particularly beneficial for web developers working with ARIA roles to improve web accessibility.

    • Firefox now provides support for the CSS Cascading Level 4 supports() syntax for @import rules. This allows for the importation of other stylesheets based on support-dependency. In addition, the Inspector panel now accurately displays the conditions at the top of the imported rule.

      developer tools screenshot of the new @import syntax rule

    Web Platform

    • DOM: Added support for ES Modules on DedicatedWorker and SharedWorker

    • WebTransport is now enabled by default and will be going to release with 114. As the original Explainer notes, it enables multiple use-cases that are hard or impossible to handle without it, especially for Gaming and live streaming. It covers cases that are problematic for alternative mechanisms, such as WebSockets.

      Built on top of HTTP3 (HTTP2 support will be coming later). The current implementation in Firefox is passing 505 out of 565 Web-Platform Tests.

    • CSS: The infinity and NaN constants are now supported inside the calc() function.

    The Firefox/Mozilla Thread

    in Software

    Posted

    ff v113.0.2

    23. may 2023

    Fixed

    • Fixed an issue which caused Picture-in-Picture windows to not be snappable on Windows 11 or on systems with the FancyZones PowerToy installed (bug 1832331)

    • Fixed a video playback crash on some Windows systems with Intel graphics (bug 1831329)

    • Fixed a bug which could cause Firefox to freeze on some pages when loading them with the Developer Tools Web Console open (bug 1828026)

    • Fixed a bug which would cause the bookmarks and history sidebars to not properly react to the browser window being vertically resized (bug 1831535)

    The Firefox/Mozilla Thread

    in Software

    Posted

    ff v113.0.1

    12. may 2023

    Fixed

    • Fixed incorrect colors for Windows users with installed monitor/display color profiles, particularly on wide gamut displays (bug 1832215)

    • Fixed borders being visible around fullscreen windows for some configurations (bug 1830721)

    • Fixed an issue which may cause users in some configurations to experience tearing when watching videos in fullscreen mode (bug 1830792)

    The Firefox/Mozilla Thread

    in Software

    Posted

    ff v102.11.0 esr

    09. may 2023

    Fixed

    Quote

    Security Vulnerabilities fixed in Firefox ESR 102.11

    Announced May 9, 2023
    Impact high
    Products Firefox ESR
    Fixed in
    • Firefox ESR 102.11

    #CVE-2023-32205: Browser prompts could have been obscured by popups

    Reporter Alesandro Ortiz
    Impact high
    Description

    In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks.

    References

    #CVE-2023-32206: Crash in RLBox Expat driver

    Reporter Irvan Kurniawan
    Impact high
    Description

    An out-of-bound read could have led to a crash in the RLBox Expat driver.

    References

    #CVE-2023-32207: Potential permissions request bypass via clickjacking

    Reporter Hafiizh
    Impact high
    Description

    A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions.

    References

    #CVE-2023-32211: Content process crash due to invalid wasm code

    Reporter P1umer and xmzyshypnc
    Impact moderate
    Description

    A type checking bug would have led to invalid code being compiled.

    References

    #CVE-2023-32212: Potential spoof due to obscured address bar

    Reporter Hafiizh
    Impact moderate
    Description

    An attacker could have positioned a datalist element to obscure the address bar.

    References

    #CVE-2023-32213: Potential memory corruption in FileReader::DoReadData()

    Reporter Ronald Crane
    Impact moderate
    Description

    When reading a file, an uninitialized value could have been used as read limit.

    References

    #CVE-2023-32214: Potential DoS via exposed protocol handlers

    Reporter Edward Prior
    Impact low
    Description

    Protocol handlers ms-cxh and ms-cxh-full could have been leveraged to trigger a denial of service.
    Note: This attack only affects Windows. Other operating systems are not affected.

    References

    #CVE-2023-32215: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11

    Reporter Mozilla developers and community
    Impact high
    Description

    Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

    References

    The Firefox/Mozilla Thread

    in Software

    Posted

    ff v113.0

    09. may 2023

    New

    • Say hello to enhanced Picture-in-Picture! Rewind, check video duration, and effortlessly switch to full-screen mode on the web's most popular video websites.

    • Firefox's address bar is already a great place to search for what you're looking for. Now you'll always be able to see your web search terms and refine them while viewing your search's results - no additional scrolling needed! Also, a new result menu has been added making it easier to remove history results and dismiss sponsored Firefox Suggest entries.
      Image demonstrating search terms persisting in the address bar after hitting Enter for easier editing

    • Private windows now protect users even better by blocking third-party cookies and storage of content trackers.

    • Passwords automatically generated by Firefox now include special characters, giving users more secure passwords by default.

    • Firefox 113 introduces a redesigned accessibility engine which significantly improves the speed, responsiveness, and stability of Firefox when used with:

      • Screen readers, as well as certain other accessibility software;
      • East Asian input methods;
      • Enterprise single sign-on software; and
      • Other applications which use accessibility frameworks to access information.

    • Importing bookmarks from Safari or a Chrome-based browser? The favicons for those bookmarks will now also be imported by default to make them easier to identify.

    • Firefox 113 now supports AV1 Image Format files containing animations (AVIS), improving support for AVIF images across the web.

    • The Windows GPU sandbox first shipped in the Firefox 110 release has been tightened to enhance the security benefits it provides.

    • A 13-year-old feature request was fulfilled and Firefox now supports files being drag-and-dropped directly from Microsoft Outlook. A special thanks to volunteer contributor Marco Spiess for helping to get this across the finish line!

    • Users on macOS can now access the Services sub-menu directly from Firefox context menus.

    • On Windows, the elastic overscroll effect has been enabled by default. When two-finger scrolling on the touchpad or scrolling on the touchscreen, you will now see a bouncing animation when scrolling past the edge of a scroll container.

    • Firefox is now available in the Tajik (tg) language.

    Fixed

    Changed

    • The long-deprecated mozRTCPeerConnection, mozRTCIceCandidate, and mozRTCSessionDescription WebRTC interfaces have been removed. Sites should utilize the non-prefixed versions instead.

    Enterprise

    Developer

    Developer Information

    • There have been numerous improvements to the Debugger's "Search in files" feature (also known as "Project search"):

      • The panel has been moved to a regular side panel, which allows you to keep the results list visible while opening scripts in the editor;
      • Results from minified and pretty-printed tabs, as well as matches from the node_modules folder, are displayed;
      • Results from ignored files are hidden; and
      • Glob patterns and search modifiers are also supported, making it possible to execute case-sensitive or regex searches on specific parts of your project.

    • Additional features include support for pretty printing inline scripts in HTML files and column breakpoints in pretty printed sources.

    • It is now possible to override a JavaScript file in the debugger. In the Debugger, under the Sources tree, you can use the "Add script override" context menu entry. This action will download the file onto your machine, allowing you to edit it. After reloading the page, the local file will be loaded instead of the original script (indicated by a purple icon when a file is overridden).
      Screenshot of new script override debugger option

    Web Platform

    • Module scripts can now import other ES module scripts on worklets.

    • Firefox 113 includes new CSS functionality, including improved support for the color (level 4) specification (such as the lab(), lch(), oklab(), oklch(), and color() functions) and the scripting media query.

    • Firefox 113 adds support for a number of WebRTC features for improved interoperability: RTCMediaSourceStats, RTCPeerConnectionState, RTCPeerConnectionStats ("peer-connection" RTCStatsType), RTCRtpSender.setStreams(), and RTCSctpTransport.

    • The forced-color-adjust property is now supported, allowing authors to opt an element out of color changes in Forced Color Mode for improved readability where the automatically-picked contrasting colors are not ideal.

    Unresolved

    • Users on some Windows systems may see incorrect and/or over-saturated colors. This is fixed in the Firefox 113.0.1 release.

    The Firefox/Mozilla Thread

    in Software

    Posted

    ff v112.0.2

    25. apr 2023

    Fixed

    • Fixes a high memory usage issue with animated images in minimized (or completely covered) windows, especially when using animated themes (bug 1828587).

    • Fixes an issue where Linux users with bitmap fonts installed may have had entire sections of text invisible to them on some sites (bug 1827950).

    • Fixes an issue where web notifications with images were not displaying for Windows 8 users (bug 1822817).

    The Firefox/Mozilla Thread

    in Software

    Posted

    ff v112.0.1

    17. apr 2023

    Fixed

    • Fixed a bug where cookie dates appear to be set in the far future after updating Firefox. This may have caused cookies to be unintentionally purged. (bug 1827669).

    Unresolved

    • Under rare circumstances, animated Firefox themes can use excessive memory.
      If you encounter this problem, please change your theme to one that does not use animations to work around it. We are in the process of shipping a fix (bug 1828587) (fixed in 112.0.2).

×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.

  I accept