Jump to content

trium

Experienced Members
  • Posts

    2,544
  • Joined

  • Last visited

Posts posted by trium

  1. ff v102.10.0 esr

    11. apr 2023

    Fixed

    Quote

    Security Vulnerabilities fixed in Firefox ESR 102.10

    Announced April 11, 2023
    Impact high
    Products Firefox ESR
    Fixed in
    • Firefox ESR 102.10

    #CVE-2023-29531: Out-of-bound memory access in WebGL on macOS

    Reporter DoHyun Lee
    Impact high
    Description

    An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash.
    This bug only affects Firefox for macOS. Other operating systems are unaffected.

    References

    #CVE-2023-29532: Mozilla Maintenance Service Write-lock bypass

    Reporter Holger Fuhrmannek
    Impact high
    Description

    A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server. The update file can be replaced after the signature check, before the use, because the write-lock requested by the service does not work on a SMB server.
    Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.

    References

    #CVE-2023-29533: Fullscreen notification obscured

    Reporter Irvan Kurniawan
    Impact high
    Description

    A website could have obscured the fullscreen notification by using a combination of window.open, fullscreen requests, window.name assignments, and setInterval calls. This could have led to user confusion and possible spoofing attacks.

    References

    #CVE-2023-1999: Double-free in libwebp

    Reporter Irvan Kurniawan
    Impact high
    Description

    A double-free in libwebp could have led to memory corruption and a potentially exploitable crash.

    References

    #CVE-2023-29535: Potential Memory Corruption following Garbage Collector compaction

    Reporter Lukas Bernhard
    Impact high
    Description

    Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.

    References

    #CVE-2023-29536: Invalid free from JavaScript code

    Reporter zx from qriousec
    Impact high
    Description

    An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.

    References

    #CVE-2023-29539: Content-Disposition filename truncation leads to Reflected File Download

    Reporter Trung Pham
    Impact moderate
    Description

    When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.

    References

    #CVE-2023-29541: Files with malicious extensions could have been downloaded unsafely on Linux

    Reporter Ameen Basha M K
    Impact moderate
    Description

    Firefox did not properly handle downloads of files ending in .desktop, which can be interpreted to run attacker-controlled commands.
    This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.

    References

    #CVE-2023-29542: Bypass of file download extension restrictions

    Reporter Shaheen Fazim and Ameen Basha M K
    Impact moderate
    Description

    A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code.
    This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.

    References

    #CVE-2023-29545: Windows Save As dialog resolved environment variables

    Reporter Axel Chong (@Haxatron)
    Impact moderate
    Description

    Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user.
    This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.

    References

    #CVE-2023-1945: Memory Corruption in Safe Browsing Code

    Reporter Gabriele Svelto
    Impact moderate
    Description

    Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.

    References

    #CVE-2023-29548: Incorrect optimization result on ARM64

    Reporter JunYoung Park
    Impact low
    Description

    A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.

    References

    #CVE-2023-29550: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10

    Reporter Mozilla developers and community
    Impact high
    Description

    Mozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

    References
  2. Quote

    I have only post the new comments to ublock and ff/mozilla threads with the known way. 

    - i write something, insert the "release-news" from mozilla with some corrects in the text (a lot of work) an click "send the post" or what was there...

     

    The post about the end of support windows 7/8/8.1 of course is on the write-date an my post (with all the past and newer ff-releases are after your post because your post is older as my ones... sorry for the long time of no-here-in-the-forum).

    Also i have sometime a lot of problems with the internet connection... 

    Im now on the way but i can perhaps later write something...

     

    Greeting

    Copy my answer via email... 

  3. ff v112.0

    11. apr 2023

    New

    • Right-clicking on password fields now shows an option to reveal the password.

    • Ubuntu Linux users can now import their browser data from the Chromium Snap package. Currently, this will only work if Firefox is not also installed as a Snap package, but work is underway to address this!

    • Do you use the tab list panel in the tab bar? If so, you can now close tabs by middle-clicking items in that list.

    • You've always been able to un-close a tab by using (Cmd/Ctrl)-Shift-T. Now, that same shortcut will restore the previous session if there are no more closed tabs from the same session to re-open.

    • For all ETP Strict users, we extended the list of known tracking parameters that are removed from URLs to further protect our users from cross-site tracking.

    • Enables overlay of software-decoded video on Intel GPUs in Windows. Improves video down scaling quality and reduces GPU usage.

    • Private windows and ETP set to strict will now include email tracking protection. This will make it harder for email trackers to learn the browsing habits of Firefox users. You can check the Tracking Content in the sub-panel on the shield icon panel.

    Fixed

    Changed

    • The deprecated U2F Javascript API is now disabled by default. The U2F protocol remains usable through the WebAuthn API. The U2F API can be re-enabled using the security.webauth.u2f preference.

    Enterprise

    Web Platform

    • Clear button, newly added to the date picker panel, allows users to quickly clear the input with type date or datetime-local and provides a familiar experience across browsers.

    Unresolved

    • Under rare circumstances, animated Firefox themes can use excessive memory.
      If you encounter this problem, please change your theme to one that does not use animations to work around it. We are in the process of shipping a fix (bug 1828587) (fixed in 112.0.2).

  4. ff v102.9.0 esr

    14. mar 2023

    Fixed

    Quote

    Security Vulnerabilities fixed in Firefox ESR 102.9

    Announced March 14, 2023
    Impact high
    Products Firefox ESR
    Fixed in
    • Firefox ESR 102.9

    #CVE-2023-25751: Incorrect code generation during JIT compilation

    Reporter Lukas Bernhard
    Impact high
    Description

    Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. This could lead to a potentially exploitable crash.

    References

    #CVE-2023-28164: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation

    Reporter Luan Herrera
    Impact moderate
    Description

    Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks.

    References

    #CVE-2023-28162: Invalid downcast in Worklets

    Reporter Lukas Bernhard
    Impact moderate
    Description

    While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have led to a potentially exploitable crash.

    References

    #CVE-2023-25752: Potential out-of-bounds when accessing throttled streams

    Reporter Ronald Crane
    Impact moderate
    Description

    When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. This may have lead future code to be incorrect and vulnerable.

    References

    #CVE-2023-28163: Windows Save As dialog resolved environment variables

    Reporter Shaheen Fazim
    Impact moderate
    Description

    When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user.
    This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.

    References

    #CVE-2023-28176: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9

    Reporter Mozilla developers and community
    Impact high
    Description

    Mozilla developers Timothy Nikkel, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

    References
  5. ff v111.0

    14. mar 2023

    New

    • Windows native notifications are now enabled.

    • Firefox Relay users can now opt-in to create Relay email masks directly from the Firefox credential manager. You must be signed in with your Firefox Account.

    • We’ve added two new locales: Silhe Friulian (fur) and Sardinian (sc).

    Fixed

    Web Platform

    • Use of the rel attribute is now supported on form elements, allowing the specification of the relationship between the current document and the form target in a simpler, cross-browser way.

    • Origin private file system access is now enabled, a new storage API that enables web applications to store and retrieve data from and to the filesystem in a sandbox.

  6. ff v110.0.1

    28. feb 2023

    Fixed

    • Fixed clearing recent cookies clears all cookies (bug 1816279).

    • Fixed a bug causing the context menu to sometimes display on the background of other Firefox UI elements instead of the foreground on macOS (bug 1763990).

    • Fixed Manage bookmarks link on empty bookmarks toolbar not responding to clicks on Windows (bug 1812636).

    • Fixed WebGL crashes on Linux when ran inside a VMWare virtual machine (bug 1807942).

    • Fixed a bug with CSP serialization causing bugs with the MitID Digital ID in Denmark (Bug 1819096).

  7. ff v102.8.0 esr

    14. feb 2023

    Fixed

    Quote

    Security Vulnerabilities fixed in Firefox ESR 102.8

    Announced February 14, 2023
    Impact high
    Products Firefox ESR
    Fixed in
    • Firefox ESR 102.8

    #CVE-2023-25728: Content security policy leak in violation reports using iframes

    Reporter Johan Carlsson
    Impact high
    Description

    The Content-Security-Policy-Report-Only header could allow an attacker to leak a child iframe's unredacted URI when interaction with that iframe triggers a redirect.

    References

    #CVE-2023-25730: Screen hijack via browser fullscreen mode

    Reporter Irvan Kurniawan
    Impact high
    Description

    A background script invoking requestFullscreen and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential user confusion or spoofing attacks.

    References

    #CVE-2023-0767: Arbitrary memory write via PKCS 12 in NSS

    Reporter Christian Holler
    Impact high
    Description

    An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled.

    References

    #CVE-2023-25735: Potential use-after-free from compartment mismatch in SpiderMonkey

    Reporter Samuel Groß
    Impact high
    Description

    Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free after unwrapping the proxy.

    References

    #CVE-2023-25737: Invalid downcast in SVGUtils::SetupStrokeGeometry

    Reporter Lukas Bernhard
    Impact high
    Description

    An invalid downcast from nsTextNode to SVGElement could have lead to undefined behavior.

    References

    #CVE-2023-25738: Printing on Windows could potentially crash Firefox with some device drivers

    Reporter Mark
    Impact high
    Description

    Members of the DEVMODEW struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn would cause the browser to attempt out of bounds access to related variables.
    This bug only affects Firefox on Windows. Other operating systems are unaffected.

    References

    #CVE-2023-25739: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext

    Reporter Holger Fuhrmannek
    Impact high
    Description

    Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in ScriptLoadContext.

    References

    #CVE-2023-25729: Extensions could have opened external schemes without user knowledge

    Reporter Vitor Torres
    Impact moderate
    Description

    Permission prompts for opening external schemes were only shown for ContentPrincipals resulting in extensions being able to open them without user interaction via ExpandedPrincipals. This could lead to further malicious actions such as downloading files or interacting with software already installed on the system.

    References

    #CVE-2023-25732: Out of bounds memory write from EncodeInputStream

    Reporter Ronald Crane
    Impact moderate
    Description

    When encoding data from an inputStream in xpcom the size of the input being encoded was not correctly calculated potentially leading to an out of bounds memory write.

    References

    #CVE-2023-25734: Opening local .url files could cause unexpected network loads

    Reporter Ameen Basha M K and Shaheen Fazim
    Impact moderate
    Description

    After downloading a Windows .url shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system. This also had the potential to leak NTLM credentials to the resource.
    This bug only affects Firefox on Windows. Other operating systems are unaffected.

    References

    #CVE-2023-25742: Web Crypto ImportKey crashes tab

    Reporter Goras Francesco
    Impact low
    Description

    When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash.

    References

    #CVE-2023-25744: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8

    Reporter Mozilla developers and community
    Impact high
    Description

    Mozilla developers Kershaw Chang and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 109 and Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

    References

    #CVE-2023-25746: Memory safety bugs fixed in Firefox ESR 102.8

    Reporter Mozilla developers and community
    Impact high
    Description

    Mozilla developers Philipp and Gabriele Svelto reported memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

    References
  8. ff v110.0

    14. feb 2023

    New

    • It's now possible to import bookmarks, history and passwords not only from Edge, Chrome or Safari but also from Opera, Opera GX, and Vivaldi for all the folks who want to move over to Firefox instead!

    • GPU sandboxing has been enabled on Windows.

      Note: A bug in the popular X-Mouse Button Control (XMBC) tool may cause mouse wheel scrolling to stop working. Affected users should update to the latest version of XMBC (2.20 or higher) which contains a fix for this issue.

    • On Windows, third-party modules can now be blocked from injecting themselves into Firefox, which can be helpful if they are causing crashes or other undesirable behavior.

    • Date, time, and datetime-local input fields can now be cleared with Cmd+Backspace and Cmd+Delete shortcut on macOS and Ctrl+Backspace and Ctrl+Delete on Windows and Linux.

    • GPU-accelerated Canvas2D is enabled by default on macOS and Linux.

    • WebGL performance improvement on Windows, MacOS and Linux.

    • Enables overlay of hardware-decoded video with non-Intel GPUs on Windows 10/11, improving video playback performance and video scaling quality.

    Fixed

    Changed

    • Colorways are no longer available in Firefox, at least not in the same way. You can still access your saved and active Colorways by selecting Add-ons and themes from the Firefox menu. Additionally, you can now install Colorways from all of the previous collections by visiting Colorways by Firefox on the Mozilla Add-ons website.

    Enterprise

    Web Platform

    • Firefox now supports CSS named pages, allowing web pages to perform per-page layout and add page-breaks in a declarative manner when printing.

    • Firefox now supports CSS size container queries, see the MDN page for documentation on this feature.

  9. ff v109.0.1

    31. jan 2023

    Fixed

    • Reverted changes to Windows font smoothing which caused poor rendering on some configurations (bug 1803154)

    • Fixed jank when loading pages containing a large number of emoji characters (bug 1809081)

    • Fixed an issue causing authentication prompts to not appear when loading pages in some enterprise environments (bug 1809151)

    • Fixed inconsistent sizing of event listener checkboxes inside the Inspector developer tool (bug 1811760)

  10. ff v102.7.0 esr

    17. jan 2023

    Fixed

    • Various stability, functionality, and security fixes.

    Quote

    Security Vulnerabilities fixed in Firefox ESR 102.7

    Announced January 17, 2023
    Impact high
    Products Firefox ESR
    Fixed in
    • Firefox ESR 102.7

    #CVE-2022-46871: libusrsctp library out of date

    Reporter Mozilla Developers
    Impact high
    Description

    An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited.

    References

    #CVE-2023-23598: Arbitrary file read from GTK drag and drop on Linux

    Reporter Tom Schuster
    Impact high
    Description

    Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to DataTransfer.setData.

    References

    #CVE-2023-23599: Malicious command could be hidden in devtools output on Windows

    Reporter Vadim
    Impact moderate
    Description

    When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within.

    References

    #CVE-2023-23601: URL being dragged from cross-origin iframe into same tab triggers navigation

    Reporter Luan Herrera
    Impact moderate
    Description

    Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks

    References

    #CVE-2023-23602: Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers

    Reporter Dave Vandyke
    Impact moderate
    Description

    A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers.

    References

    #CVE-2022-46877: Fullscreen notification bypass

    Reporter Hafiizh
    Impact low
    Description

    By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks.

    References

    #CVE-2023-23603: Calls to console.log allowed bypasing Content Security Policy via format directive

    Reporter Dan Veditz
    Impact low
    Description

    Regular expressions used to filter out forbidden properties and values from style directives in calls to console.log weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser.

    References

    #CVE-2023-23605: Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7

    Reporter Mozilla developers and community
    Impact high
    Description

    Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108 and Firefox ESR 102.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

    References
  11. ff v109.0

    17. jan 2023

    New

    • Manifest Version 3 (MV3) extension support is now enabled by default (MV2 remains enabled/supported). This major update also ushers an exciting user interface change in the form of the new extensions button.

    • The Arbitrary Code Guard exploit protection has been enabled in the media playback utility processes, improving security for Windows users.

    • The native HTML date picker for date and datetime inputs can now be used with a keyboard alone, improving its accessibility for screen reader users. Users with limited mobility can also now use common keyboard shortcuts to navigate the calendar grid and month selection spinners.

    • Firefox builds in the Spanish from Spain (es-ES) and Spanish from Argentina (es-AR) locales now come with a built-in dictionary for the Firefox spellchecker.

    Fixed

    Changed

    • Effective on January 16, Colorways will no longer be in Firefox. Users will still be able to access saved and active Colorways from the Add-ons and themes menu option.

    • On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls the page instead of zooming. This avoids accidental zooming and matches the behavior of other web browsers on macOS.

    • The Recently Closed section of Firefox View now equips users with the ability to manually close/remove url links from the list.

    • The empty state messages and graphic components surfaced in Firefox View for the Tab Pickup and Recently Closed sections have been updated for an improved user experience.

    Enterprise

    Developer

    Developer Information

    • The ability to automatically break when code on the page hits an events handler has been available since Firefox 69. Firefox 109 now adds new support for the scrollend event. To use this new event breakpoint, open the JS debugger and find and expand the Event Listener Breakpoints section in the right hand column (learn more).

      Screenshot of Breakpoint options showing new scrollend event availability

    Web Platform

    • The scrollend event is now enabled by default. The event is fired when a scroll has completed.

    • Firefox now permanently partitions Storage in third-party contexts independent of Storage Access to align with other browsers and provide better Web compatibility.

  12. ff v102.6.0 esr

    13. dec 2022

    Fixed

    • Various stability, functionality, and security fixes.

    Quote

    Security Vulnerabilities fixed in Firefox ESR 102.6

    Announced December 13, 2022
    Impact high
    Products Firefox ESR
    Fixed in
    • Firefox ESR 102.6

    #CVE-2022-46880: Use-after-free in WebGL

    Reporter Atte Kettunen
    Impact high
    Description

    A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.

    References

    #CVE-2022-46872: Arbitrary file read from a compromised content process

    Reporter Nika Layzell
    Impact high
    Description

    An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.
    This bug only affects Firefox for Linux. Other operating systems are unaffected.

    References

    #CVE-2022-46881: Memory corruption in WebGL

    Reporter Karl and an Anonymous ASAN Nightly User
    Impact high
    Description

    An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash.

    References

    #CVE-2022-46874: Drag and Dropped Filenames could have been truncated to malicious extensions

    Reporter Matthias Zoellner
    Impact moderate
    Description

    A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.

    References

    #CVE-2022-46875: Download Protections were bypassed by .atloc and .ftploc files on Mac OS

    Reporter Dohyun Lee
    Impact moderate
    Description

    The executable file warning was not presented when downloading .atloc and .ftploc files, which can run commands on a user's computer.
    Note: This issue only affected Mac OS operating systems. Other operating systems are unaffected.

    References

    #CVE-2022-46882: Use-after-free in WebGL

    Reporter Irvan Kurniawan
    Impact moderate
    Description

    A use-after-free in WebGL extensions could have led to a potentially exploitable crash.

    References

    #CVE-2022-46878: Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6

    Reporter Mozilla developers
    Impact high
    Description

    Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 107 and Firefox ESR 102.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

    References
  13. ff v108.0

    13. dec 2022

    New

    • Import maps, which allow web pages to control the behavior of JavaScript imports, are now enabled by default.

    • Processes used for background tabs now use efficiency mode on Windows 11 to limit resource use.
      Efficiency mode on Windows 11

    • The shift+esc keyboard shortcut now opens the Process Manager, offering a way to quickly identify processes that are using too many resources.

    • Improved frame scheduling when under load; this substantially improves Firefox’s MotionMark scores.

    Fixed

    • Firefox now supports properly color correcting images tagged with ICCv4 profiles.

    • Support for non-English characters when saving and printing PDF forms.

    • The bookmarks toolbar's default "Only show on New Tab" state works correctly for blank new tabs. As before, you can change the bookmark toolbar's behavior using the toolbar context menu.

    • Various security fixes.

    Changed

    • Firefox now supports the WebMIDI API and a new experimental mechanism for controlling access to dangerous capabilities.

  14. ff v107.0.1

    29. nov 2022

    Fixed

    • Fixed an issue with accessing some sites reliably in Private Browsing mode or Strict ETP due to anti-adblockers (bug 1717806).

    • Fixed an issue where Color Management was not available for some users (bug 1799391).

    • Fixed an issue with text overlapping in the Settings Menu for some locales (bug 1800379).

    • Fixed an incompatibility with the new Windows 11 22H2 Suggested Actions feature resulting in hangs when copying phone number links (bug 1798098).

    • Fixed an issue where the DevTools UI is not accessible when an alert dialog is displayed (bug 1801840).

  15. ff v102.5.0 esr

    15. nov 2022

    Fixed

    • Various stability, functionality, and security fixes.

    Quote

    Security Vulnerabilities fixed in Firefox ESR 102.5

    Announced November 15, 2022
    Impact high
    Products Firefox ESR
    Fixed in
    • Firefox ESR 102.5

    #CVE-2022-45403: Service Workers might have learned size of cross-origin media files

    Reporter Anne van Kesteren and Karl Tomlinson
    Impact high
    Description

    Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range requests might have allowed them to determine the presence or length of a media file.

    References

    #CVE-2022-45404: Fullscreen notification bypass

    Reporter Irvan Kurniawan
    Impact high
    Description

    Through a series of popup and window.print() calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks.

    References

    #CVE-2022-45405: Use-after-free in InputStream implementation

    Reporter Atte Kettunen
    Impact high
    Description

    Freeing arbitrary nsIInputStream's on a different thread than creation could have led to a use-after-free and potentially exploitable crash.

    References

    #CVE-2022-45406: Use-after-free of a JavaScript Realm

    Reporter Samuel Groß
    Impact high
    Description

    If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape. This could lead to a use-after-free causing a potentially exploitable crash.

    References

    #CVE-2022-45408: Fullscreen notification bypass via windowName

    Reporter Irvan Kurniawan
    Impact high
    Description

    Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks.

    References

    #CVE-2022-45409: Use-after-free in Garbage Collection

    Reporter Gary Kwong
    Impact high
    Description

    The garbage collector could have been aborted in several states and zones and GCRuntime::finishCollection may not have been called, leading to a use-after-free and potentially exploitable crash

    References

    #CVE-2022-45410: ServiceWorker-intercepted requests bypassed SameSite cookie policy

    Reporter Dongsung Kim
    Impact moderate
    Description

    When a ServiceWorker intercepted a request with FetchEvent, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec and then in browsers.

    References

    #CVE-2022-45411: Cross-Site Tracing was possible via non-standard override headers

    Reporter scarlet
    Impact moderate
    Description

    Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript (such as cookies protected by HTTPOnly). To mitigate this attack, browsers placed limits on fetch() and XMLHttpRequest; however some webservers have implemented non-standard headers such as X-Http-Method-Override that override the HTTP method, and made this attack possible again. Firefox has applied the same mitigations to the use of this and similar headers.

    References

    #CVE-2022-45412: Symlinks may resolve to partially uninitialized buffers

    Reporter Armin Ebert
    Impact moderate
    Description

    When resolving a symlink such as file:///proc/self/fd/1, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer.
    This bug only affects Firefox on Unix-based operated systems (Android, Linux, MacOS). Windows is unaffected.

    References

    #CVE-2022-45416: Keystroke Side-Channel Leakage

    Reporter Erik Kraft, Martin Schwarzl, and Andrew McCreight
    Impact moderate
    Description

    Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timing attacks such as Prime+Probe could have possibly figured out which keys were being pressed.

    References

    #CVE-2022-45418: Custom mouse cursor could have been drawn over browser UI

    Reporter Hafiizh
    Impact moderate
    Description

    If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing attacks.

    References

    #CVE-2022-45420: Iframe contents could be rendered outside the iframe

    Reporter Suhwan Song of SNU CompSec Lab
    Impact low
    Description

    Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks.

    References

    #CVE-2022-45421: Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5

    Reporter Mozilla developers
    Impact high
    Description

    Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Firefox 106 and Firefox ESR 102.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

    References
  16. ff v107.0

    15. nov 2022

    New

    • Improved the performance of the instance when Microsoft's IME and Defender retrieve the URL of a focused document in Windows 11 version 22H2.

    • Power profiling — visualizing performance data recorded from web browsers — is now also supported on Linux and Mac with Intel CPUs, in addition to Windows 11 and Apple Silicon.

    Fixed

    Enterprise

    Developer

    Developer Information

    • There are a couple of helpful improvements in Firefox DevTools making it easier to debug WebExtensions:

      DevTools screenshot

      • Are you using the webext command line tool to run and test your web extension? There is a new argument allowing you to also automatically open DevTools just in case you want to—for example, inspect the UI (bug).
        $ webext run --devtools
        Note: web-ext npm package needs to be >= 7.3.0
      • It’s now also simple to inspect popup windows (implemented by WebExtension) using DevTools (bug).
      • When you make changes in the source code of your WebExtension, you can easily reload it using a “Reload” button in the DevTools toolbox to see the changes (bug).

    Unresolved

    • In order to better support certain typographical conventions, Firefox now preserves some non-breaking spaces when copying text to the clipboard instead of changing them to regular spaces.
      The new behavior is known to cause problems when non-breaking spaces are used for indentation.

  17. ff v106.0.2

    26. oct 2022

    Fixed

    • Fix missing content on some PDF forms (bug 1794351).

    • Fix column width for the Notification sub-panel in Settings (bug 1793558).

    • Fix a browser freeze with accessibility enabled on some sites such as the Proxmox Web UI (bug 1793748).

    • Fix page reloading not working with Firefox View and not refreshing synced data (bug 1792680 and bug 1794474).

    • Fix browser not opening if installed from the Windows Store (Bug 1796391).

×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.