-
Posts
2,544 -
Joined
-
Last visited
Posts posted by trium
-
-
hello hazelnut,
yes, since nukecads post about the last ff-version for w7/8/8.1 are my posts from the same day late in the night :-) a lots of version-descriptions.
and there are some others to nr. 115 incl. esr-versions - provided my internet works
-
Quote
I have only post the new comments to ublock and ff/mozilla threads with the known way.
- i write something, insert the "release-news" from mozilla with some corrects in the text (a lot of work) an click "send the post" or what was there...
The post about the end of support windows 7/8/8.1 of course is on the write-date an my post (with all the past and newer ff-releases are after your post because your post is older as my ones... sorry for the long time of no-here-in-the-forum).
Also i have sometime a lot of problems with the internet connection...
Im now on the way but i can perhaps later write something...
Greeting
Copy my answer via email...
-
hi fans,
can someone unlock the mozilla/firefox topic? -> to complete the version-history for ff and ff-esr until to the last/newest one.
thanks
-
ff v112.0
11. apr 2023
New
-
Right-clicking on password fields now shows an option to reveal the password.
-
Ubuntu Linux users can now import their browser data from the Chromium Snap package. Currently, this will only work if Firefox is not also installed as a Snap package, but work is underway to address this!
-
Do you use the tab list panel in the tab bar? If so, you can now close tabs by middle-clicking items in that list.
-
You've always been able to un-close a tab by using (Cmd/Ctrl)-Shift-T. Now, that same shortcut will restore the previous session if there are no more closed tabs from the same session to re-open.
-
For all ETP Strict users, we extended the list of known tracking parameters that are removed from URLs to further protect our users from cross-site tracking.
-
Enables overlay of software-decoded video on Intel GPUs in Windows. Improves video down scaling quality and reduces GPU usage.
-
Private windows and ETP set to strict will now include email tracking protection. This will make it harder for email trackers to learn the browsing habits of Firefox users. You can check the Tracking Content in the sub-panel on the shield icon panel.
Fixed
-
Various security fixes.
Changed
-
The deprecated U2F Javascript API is now disabled by default. The U2F protocol remains usable through the WebAuthn API. The U2F API can be re-enabled using the
security.webauth.u2f
preference.
Enterprise
-
You can find information about policy updates and enterprise specific bug fixes in the Firefox for Enterprise 112 Release Notes.
Developer
Web Platform
-
Clear
button, newly added to the date picker panel, allows users to quickly clear the input with typedate
ordatetime-local
and provides a familiar experience across browsers.
Unresolved
-
Under rare circumstances, animated Firefox themes can use excessive memory.If you encounter this problem, please change your theme to one that does not use animations to work around it. We are in the process of shipping a fix (bug 1828587)(fixed in 112.0.2).
-
-
ff v111.0.1
21. mar 2023
Fixed
-
Fixed a crash on macOS while pinch-zooming under some circumstances (bug 1658986).
-
Fixed a bug causing Firefox to freeze on startup for some Windows users (bug 1823159).
-
-
ff v102.9.0 esr
14. mar 2023
Fixed
-
Various security fixes.
QuoteSecurity Vulnerabilities fixed in Firefox ESR 102.9
- Announced March 14, 2023
- Impact high
- Products Firefox ESR
- Fixed in
-
- Firefox ESR 102.9
#CVE-2023-25751: Incorrect code generation during JIT compilation
- Reporter Lukas Bernhard
- Impact high
Description
Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. This could lead to a potentially exploitable crash.
References
#CVE-2023-28164: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation
- Reporter Luan Herrera
- Impact moderate
Description
Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks.
References
#CVE-2023-28162: Invalid downcast in Worklets
- Reporter Lukas Bernhard
- Impact moderate
Description
While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have led to a potentially exploitable crash.
References
#CVE-2023-25752: Potential out-of-bounds when accessing throttled streams
- Reporter Ronald Crane
- Impact moderate
Description
When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. This may have lead future code to be incorrect and vulnerable.
References
#CVE-2023-28163: Windows Save As dialog resolved environment variables
- Reporter Shaheen Fazim
- Impact moderate
Description
When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user.
This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.References
#CVE-2023-28176: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9
- Reporter Mozilla developers and community
- Impact high
Description
Mozilla developers Timothy Nikkel, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
References
-
-
ff v111.0
14. mar 2023
New
-
Windows native notifications are now enabled.
-
Firefox Relay users can now opt-in to create Relay email masks directly from the Firefox credential manager. You must be signed in with your Firefox Account.
-
We’ve added two new locales: Silhe Friulian (fur) and Sardinian (sc).
Fixed
-
Various security fixes.
Developer
Web Platform
-
Use of the rel attribute is now supported on form elements, allowing the specification of the relationship between the current document and the form target in a simpler, cross-browser way.
-
Origin private file system access is now enabled, a new storage API that enables web applications to store and retrieve data from and to the filesystem in a sandbox.
-
-
ff v110.0.1
28. feb 2023
Fixed
-
Fixed clearing recent cookies clears all cookies (bug 1816279).
-
Fixed a bug causing the context menu to sometimes display on the background of other Firefox UI elements instead of the foreground on macOS (bug 1763990).
-
Fixed Manage bookmarks link on empty bookmarks toolbar not responding to clicks on Windows (bug 1812636).
-
Fixed WebGL crashes on Linux when ran inside a VMWare virtual machine (bug 1807942).
-
Fixed a bug with CSP serialization causing bugs with the MitID Digital ID in Denmark (Bug 1819096).
-
-
ff v102.8.0 esr
14. feb 2023
Fixed
-
Various security fixes.
QuoteSecurity Vulnerabilities fixed in Firefox ESR 102.8
- Announced February 14, 2023
- Impact high
- Products Firefox ESR
- Fixed in
-
- Firefox ESR 102.8
#CVE-2023-25728: Content security policy leak in violation reports using iframes
- Reporter Johan Carlsson
- Impact high
Description
The
Content-Security-Policy-Report-Only
header could allow an attacker to leak a child iframe's unredacted URI when interaction with that iframe triggers a redirect.References
#CVE-2023-25730: Screen hijack via browser fullscreen mode
- Reporter Irvan Kurniawan
- Impact high
Description
A background script invoking
requestFullscreen
and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential user confusion or spoofing attacks.References
#CVE-2023-0767: Arbitrary memory write via PKCS 12 in NSS
- Reporter Christian Holler
- Impact high
Description
An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled.
References
#CVE-2023-25735: Potential use-after-free from compartment mismatch in SpiderMonkey
- Reporter Samuel Groß
- Impact high
Description
Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free after unwrapping the proxy.
References
#CVE-2023-25737: Invalid downcast in SVGUtils::SetupStrokeGeometry
- Reporter Lukas Bernhard
- Impact high
Description
An invalid downcast from
nsTextNode
toSVGElement
could have lead to undefined behavior.References
#CVE-2023-25738: Printing on Windows could potentially crash Firefox with some device drivers
- Reporter Mark
- Impact high
Description
Members of the
DEVMODEW
struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn would cause the browser to attempt out of bounds access to related variables.
This bug only affects Firefox on Windows. Other operating systems are unaffected.References
#CVE-2023-25739: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext
- Reporter Holger Fuhrmannek
- Impact high
Description
Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in
ScriptLoadContext
.References
#CVE-2023-25729: Extensions could have opened external schemes without user knowledge
- Reporter Vitor Torres
- Impact moderate
Description
Permission prompts for opening external schemes were only shown for
ContentPrincipals
resulting in extensions being able to open them without user interaction viaExpandedPrincipals
. This could lead to further malicious actions such as downloading files or interacting with software already installed on the system.References
#CVE-2023-25732: Out of bounds memory write from EncodeInputStream
- Reporter Ronald Crane
- Impact moderate
Description
When encoding data from an
inputStream
inxpcom
the size of the input being encoded was not correctly calculated potentially leading to an out of bounds memory write.References
#CVE-2023-25734: Opening local .url files could cause unexpected network loads
- Reporter Ameen Basha M K and Shaheen Fazim
- Impact moderate
Description
After downloading a Windows
.url
shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system. This also had the potential to leak NTLM credentials to the resource.
This bug only affects Firefox on Windows. Other operating systems are unaffected.References
#CVE-2023-25742: Web Crypto ImportKey crashes tab
- Reporter Goras Francesco
- Impact low
Description
When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash.
References
#CVE-2023-25744: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
- Reporter Mozilla developers and community
- Impact high
Description
Mozilla developers Kershaw Chang and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 109 and Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
References
#CVE-2023-25746: Memory safety bugs fixed in Firefox ESR 102.8
- Reporter Mozilla developers and community
- Impact high
Description
Mozilla developers Philipp and Gabriele Svelto reported memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
References
-
-
ff v110.0
14. feb 2023
New
-
It's now possible to import bookmarks, history and passwords not only from Edge, Chrome or Safari but also from Opera, Opera GX, and Vivaldi for all the folks who want to move over to Firefox instead!
-
GPU sandboxing has been enabled on Windows.
Note: A bug in the popular X-Mouse Button Control (XMBC) tool may cause mouse wheel scrolling to stop working. Affected users should update to the latest version of XMBC (2.20 or higher) which contains a fix for this issue.
-
On Windows, third-party modules can now be blocked from injecting themselves into Firefox, which can be helpful if they are causing crashes or other undesirable behavior.
-
Date, time, and datetime-local input fields can now be cleared with
Cmd+Backspace
andCmd+Delete
shortcut on macOS andCtrl+Backspace
andCtrl+Delete
on Windows and Linux. -
GPU-accelerated Canvas2D is enabled by default on macOS and Linux.
-
WebGL performance improvement on Windows, MacOS and Linux.
-
Enables overlay of hardware-decoded video with non-Intel GPUs on Windows 10/11, improving video playback performance and video scaling quality.
Fixed
-
Various security fixes.
Changed
-
Colorways are no longer available in Firefox, at least not in the same way. You can still access your saved and active Colorways by selecting Add-ons and themes from the Firefox menu. Additionally, you can now install Colorways from all of the previous collections by visiting Colorways by Firefox on the Mozilla Add-ons website.
Enterprise
-
Various bug fixes and new policies have been implemented in the latest version of Firefox. You can find more information in the Firefox for Enterprise 110 Release Notes.
Developer
Web Platform
-
Firefox now supports CSS named pages, allowing web pages to perform per-page layout and add page-breaks in a declarative manner when printing.
-
Firefox now supports CSS size container queries, see the MDN page for documentation on this feature.
-
-
ff v109.0.1
31. jan 2023
Fixed
-
Reverted changes to Windows font smoothing which caused poor rendering on some configurations (bug 1803154)
-
Fixed jank when loading pages containing a large number of emoji characters (bug 1809081)
-
Fixed an issue causing authentication prompts to not appear when loading pages in some enterprise environments (bug 1809151)
-
Fixed inconsistent sizing of event listener checkboxes inside the Inspector developer tool (bug 1811760)
-
-
ff v102.7.0 esr
17. jan 2023
Fixed
-
Various stability, functionality, and security fixes.
QuoteSecurity Vulnerabilities fixed in Firefox ESR 102.7
- Announced January 17, 2023
- Impact high
- Products Firefox ESR
- Fixed in
-
- Firefox ESR 102.7
#CVE-2022-46871: libusrsctp library out of date
- Reporter Mozilla Developers
- Impact high
Description
An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited.
References
#CVE-2023-23598: Arbitrary file read from GTK drag and drop on Linux
- Reporter Tom Schuster
- Impact high
Description
Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to
DataTransfer.setData
.References
#CVE-2023-23599: Malicious command could be hidden in devtools output on Windows
- Reporter Vadim
- Impact moderate
Description
When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within.
References
#CVE-2023-23601: URL being dragged from cross-origin iframe into same tab triggers navigation
- Reporter Luan Herrera
- Impact moderate
Description
Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks
References
#CVE-2023-23602: Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers
- Reporter Dave Vandyke
- Impact moderate
Description
A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers.
References
#CVE-2022-46877: Fullscreen notification bypass
- Reporter Hafiizh
- Impact low
Description
By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks.
References
#CVE-2023-23603: Calls to console.log allowed bypasing Content Security Policy via format directive
- Reporter Dan Veditz
- Impact low
Description
Regular expressions used to filter out forbidden properties and values from style directives in calls to
console.log
weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser.References
#CVE-2023-23605: Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7
- Reporter Mozilla developers and community
- Impact high
Description
Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108 and Firefox ESR 102.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
References
-
-
ff v109.0
17. jan 2023
New
-
Manifest Version 3 (MV3) extension support is now enabled by default (MV2 remains enabled/supported). This major update also ushers an exciting user interface change in the form of the new extensions button.
-
The Arbitrary Code Guard exploit protection has been enabled in the media playback utility processes, improving security for Windows users.
-
The native HTML date picker for date and datetime inputs can now be used with a keyboard alone, improving its accessibility for screen reader users. Users with limited mobility can also now use common keyboard shortcuts to navigate the calendar grid and month selection spinners.
-
Firefox builds in the Spanish from Spain (es-ES) and Spanish from Argentina (es-AR) locales now come with a built-in dictionary for the Firefox spellchecker.
Fixed
-
Various security fixes.
Changed
-
Effective on January 16, Colorways will no longer be in Firefox. Users will still be able to access saved and active Colorways from the Add-ons and themes menu option.
-
On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls the page instead of zooming. This avoids accidental zooming and matches the behavior of other web browsers on macOS.
-
The Recently Closed section of Firefox View now equips users with the ability to manually close/remove url links from the list.
-
The empty state messages and graphic components surfaced in Firefox View for the Tab Pickup and Recently Closed sections have been updated for an improved user experience.
Enterprise
-
Various bug fixes and new policies have been implemented in the latest version of Firefox. You can find more information in the Firefox for Enterprise 109 Release Notes.
Developer
-
The ability to automatically break when code on the page hits an events handler has been available since Firefox 69. Firefox 109 now adds new support for the
scrollend
event. To use this new event breakpoint, open the JS debugger and find and expand the Event Listener Breakpoints section in the right hand column (learn more).
Web Platform
-
The
scrollend
event is now enabled by default. The event is fired when a scroll has completed. -
Firefox now permanently partitions Storage in third-party contexts independent of Storage Access to align with other browsers and provide better Web compatibility.
-
-
ff v108.0.2
05. jan 2023
Fixed
-
Fixes a crash for some users on Mac OS X 10.12-10.14 during video playback (bug 1806391).
-
Fixes a crash that might occur when managing browser history (bug 1806408).
Changed
-
The "Tabs sharing devices" menu item for WebRTC is now located in the tools menu on macOS only (bug 1807697).
-
-
ff v108.0.1
16. dec 2022
Fixed
-
Fixes the default search engine being reset on upgrade for profiles which were previously copied from a different location.
-
-
ff v102.6.0 esr
13. dec 2022
Fixed
-
Various stability, functionality, and security fixes.
QuoteSecurity Vulnerabilities fixed in Firefox ESR 102.6
- Announced December 13, 2022
- Impact high
- Products Firefox ESR
- Fixed in
-
- Firefox ESR 102.6
#CVE-2022-46880: Use-after-free in WebGL
- Reporter Atte Kettunen
- Impact high
Description
A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.
References
#CVE-2022-46872: Arbitrary file read from a compromised content process
- Reporter Nika Layzell
- Impact high
Description
An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.
This bug only affects Firefox for Linux. Other operating systems are unaffected.References
#CVE-2022-46881: Memory corruption in WebGL
- Reporter Karl and an Anonymous ASAN Nightly User
- Impact high
Description
An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash.
References
#CVE-2022-46874: Drag and Dropped Filenames could have been truncated to malicious extensions
- Reporter Matthias Zoellner
- Impact moderate
Description
A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.
References
#CVE-2022-46875: Download Protections were bypassed by .atloc and .ftploc files on Mac OS
- Reporter Dohyun Lee
- Impact moderate
Description
The executable file warning was not presented when downloading .atloc and .ftploc files, which can run commands on a user's computer.
Note: This issue only affected Mac OS operating systems. Other operating systems are unaffected.References
#CVE-2022-46882: Use-after-free in WebGL
- Reporter Irvan Kurniawan
- Impact moderate
Description
A use-after-free in WebGL extensions could have led to a potentially exploitable crash.
References
#CVE-2022-46878: Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6
- Reporter Mozilla developers
- Impact high
Description
Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 107 and Firefox ESR 102.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
References
-
-
ff v108.0
13. dec 2022
New
-
Import maps, which allow web pages to control the behavior of JavaScript imports, are now enabled by default.
-
Processes used for background tabs now use efficiency mode on Windows 11 to limit resource use.
-
The shift+esc keyboard shortcut now opens the Process Manager, offering a way to quickly identify processes that are using too many resources.
-
Improved frame scheduling when under load; this substantially improves Firefox’s MotionMark scores.
Fixed
-
Firefox now supports properly color correcting images tagged with ICCv4 profiles.
-
Support for non-English characters when saving and printing PDF forms.
-
The bookmarks toolbar's default "Only show on New Tab" state works correctly for blank new tabs. As before, you can change the bookmark toolbar's behavior using the toolbar context menu.
-
Various security fixes.
Changed
-
Firefox now supports the WebMIDI API and a new experimental mechanism for controlling access to dangerous capabilities.
Developer
-
-
ff v107.0.1
29. nov 2022
Fixed
-
Fixed an issue with accessing some sites reliably in Private Browsing mode or Strict ETP due to anti-adblockers (bug 1717806).
-
Fixed an issue where Color Management was not available for some users (bug 1799391).
-
Fixed an issue with text overlapping in the Settings Menu for some locales (bug 1800379).
-
Fixed an incompatibility with the new Windows 11 22H2 Suggested Actions feature resulting in hangs when copying phone number links (bug 1798098).
-
Fixed an issue where the DevTools UI is not accessible when an alert dialog is displayed (bug 1801840).
-
-
ff v102.5.0 esr
15. nov 2022
Fixed
-
Various stability, functionality, and security fixes.
QuoteSecurity Vulnerabilities fixed in Firefox ESR 102.5
- Announced November 15, 2022
- Impact high
- Products Firefox ESR
- Fixed in
-
- Firefox ESR 102.5
#CVE-2022-45403: Service Workers might have learned size of cross-origin media files
- Reporter Anne van Kesteren and Karl Tomlinson
- Impact high
Description
Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range requests might have allowed them to determine the presence or length of a media file.
References
#CVE-2022-45404: Fullscreen notification bypass
- Reporter Irvan Kurniawan
- Impact high
Description
Through a series of popup and
window.print()
calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks.References
#CVE-2022-45405: Use-after-free in InputStream implementation
- Reporter Atte Kettunen
- Impact high
Description
Freeing arbitrary
nsIInputStream
's on a different thread than creation could have led to a use-after-free and potentially exploitable crash.References
#CVE-2022-45406: Use-after-free of a JavaScript Realm
- Reporter Samuel Groß
- Impact high
Description
If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape. This could lead to a use-after-free causing a potentially exploitable crash.
References
#CVE-2022-45408: Fullscreen notification bypass via windowName
- Reporter Irvan Kurniawan
- Impact high
Description
Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks.
References
#CVE-2022-45409: Use-after-free in Garbage Collection
- Reporter Gary Kwong
- Impact high
Description
The garbage collector could have been aborted in several states and zones and
GCRuntime::finishCollection
may not have been called, leading to a use-after-free and potentially exploitable crashReferences
#CVE-2022-45410: ServiceWorker-intercepted requests bypassed SameSite cookie policy
- Reporter Dongsung Kim
- Impact moderate
Description
When a ServiceWorker intercepted a request with
FetchEvent
, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec and then in browsers.References
#CVE-2022-45411: Cross-Site Tracing was possible via non-standard override headers
- Reporter scarlet
- Impact moderate
Description
Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript (such as cookies protected by HTTPOnly). To mitigate this attack, browsers placed limits on
fetch()
and XMLHttpRequest; however some webservers have implemented non-standard headers such asX-Http-Method-Override
that override the HTTP method, and made this attack possible again. Firefox has applied the same mitigations to the use of this and similar headers.References
#CVE-2022-45412: Symlinks may resolve to partially uninitialized buffers
- Reporter Armin Ebert
- Impact moderate
Description
When resolving a symlink such as
file:///proc/self/fd/1
, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer.
This bug only affects Firefox on Unix-based operated systems (Android, Linux, MacOS). Windows is unaffected.References
#CVE-2022-45416: Keystroke Side-Channel Leakage
- Reporter Erik Kraft, Martin Schwarzl, and Andrew McCreight
- Impact moderate
Description
Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timing attacks such as Prime+Probe could have possibly figured out which keys were being pressed.
References
#CVE-2022-45418: Custom mouse cursor could have been drawn over browser UI
- Reporter Hafiizh
- Impact moderate
Description
If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing attacks.
References
#CVE-2022-45420: Iframe contents could be rendered outside the iframe
- Reporter Suhwan Song of SNU CompSec Lab
- Impact low
Description
Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks.
References
#CVE-2022-45421: Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5
- Reporter Mozilla developers
- Impact high
Description
Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Firefox 106 and Firefox ESR 102.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
References
-
-
ff v107.0
15. nov 2022
New
-
Improved the performance of the instance when Microsoft's IME and Defender retrieve the URL of a focused document in Windows 11 version 22H2.
-
Power profiling — visualizing performance data recorded from web browsers — is now also supported on Linux and Mac with Intel CPUs, in addition to Windows 11 and Apple Silicon.
Fixed
-
Various security fixes.
Enterprise
-
Various bug fixes and new policies have been implemented in the latest version of Firefox. You can find more information in the Firefox for Enterprise 107 Release Notes.
Developer
-
There are a couple of helpful improvements in Firefox DevTools making it easier to debug WebExtensions:
-
Are you using the webext command line tool to run and test your web extension? There is a new argument allowing you to also automatically open DevTools just in case you want to—for example, inspect the UI (bug).
$ webext run --devtools
Note: web-ext npm package needs to be >= 7.3.0 - It’s now also simple to inspect popup windows (implemented by WebExtension) using DevTools (bug).
- When you make changes in the source code of your WebExtension, you can easily reload it using a “Reload” button in the DevTools toolbox to see the changes (bug).
-
Are you using the webext command line tool to run and test your web extension? There is a new argument allowing you to also automatically open DevTools just in case you want to—for example, inspect the UI (bug).
Unresolved
-
In order to better support certain typographical conventions, Firefox now preserves some non-breaking spaces when copying text to the clipboard instead of changing them to regular spaces.
The new behavior is known to cause problems when non-breaking spaces are used for indentation.
-
-
ff v106.0.5
04. nov 2022
Fixed
-
Addresses a crash experienced by users with Intel Gemini Lake CPUs.
-
-
ff v106.0.4
03. nov 2022
Fixed
-
Fixed an issue with DRM Video playback (bug 1797292).
-
Fixed broken layout of datetime input when switching types (bug 1797139).
-
Fixes Firefox hanging when there is a Direct3D device reset (bug 1792115).
Unresolved
-
We are investigating an increase in crashes reported by users with Intel Gemini Lake CPUs(fixed in 106.0.5).
-
-
ff v106.0.3
31. oct 2022
Fixed
-
Fix a startup crash for some users on Windows (bug 1797464).
-
Fixed an incompatibility with the new Windows 11 22H2 Suggested Actions feature resulting in hangs when copying text on a web page (bug 1774285).
-
-
ff v106.0.2
26. oct 2022
Fixed
-
Fix missing content on some PDF forms (bug 1794351).
-
Fix column width for the Notification sub-panel in Settings (bug 1793558).
-
Fix a browser freeze with accessibility enabled on some sites such as the Proxmox Web UI (bug 1793748).
-
Fix page reloading not working with Firefox View and not refreshing synced data (bug 1792680 and bug 1794474).
-
Fix browser not opening if installed from the Windows Store (Bug 1796391).
-
The Firefox/Mozilla Thread
in Software
Posted
ff v102.10.0 esr
11. apr 2023
Fixed
Various security fixes.