Jump to content

Firefox 127.0.2 release now available

AdvancedSetup

By AdvancedSetup
in Firefox

Recommended Posts

  • AdvancedSetup changed the title to Firefox 106.0.4 release now available
  • Replies 221
  • Created
  • Last Reply

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Popular Posts

AdvancedSetup
AdvancedSetup

Yes. I'm so disgusted though with the development of Firefox. In my opinion they have way too many Google Chrome developers or Leads on the Firefox team. Each version of Firefox that comes out ge

1PW
1PW

Hello All: Version 104.0, first offered to Release channel users on August 23, 2022 https://www.mozilla.org/en-US/firefox/104.0/releasenotes/ 6 Security Vulnerabilities Fixed: 4 High

1PW
1PW

Version 111.0, first offered to Release channel users on March 14, 2023

Posted Images

  • AdvancedSetup changed the title to Firefox 106.0.5 release now available
  • 2 weeks later...
  • AdvancedSetup changed the title to Firefox 107.0 release now available
  • 2 weeks later...
  • AdvancedSetup changed the title to Firefox 107.0.1 release now available
  • 2 weeks later...
  • AdvancedSetup changed the title to Firefox 108.0 release now available
  • AdvancedSetup changed the title to Firefox 108.0.1 release now available
  • 3 weeks later...
1PW

1PW

Posted
Posted

Version 108.0.2, first offered to Release channel users on January 5, 2023

https://www.mozilla.org/firefox/108.0.2/releasenotes/

2 fixes & 1 change.

Fixed

  • Fixes a crash for some users on Mac OS X 10.12-10.14 during video playback (bug 1806391).

  • Fixes a crash that might occur when managing browser history (bug 1806408).

Changed

  • The “Tabs sharing devices” menu item for WebRTC is now located in the tools menu on macOS only (bug 1807697).

  • Thanks 3
Link to post
  • AdvancedSetup changed the title to Firefox 108.0.2 release now available
  • 2 weeks later...
1PW

1PW

Posted
Posted

Version 109.0, first offered to Release channel users on January 17, 2023.

https://www.mozilla.org/firefox/109.0/releasenotes/

New

  • Manifest Version 3 (MV3) extension support is now enabled by default (MV2 remains enabled/supported). This major update also ushers an exciting user interface change in the form of the new extensions button.

  • The Arbitrary Code Guard exploit protection has been enabled in the media playback utility processes, improving security for Windows users.

  • The native HTML date picker for date and datetime inputs can now be used with a keyboard alone, improving its accessibility for screen reader users. Users with limited mobility can also now use common keyboard shortcuts to navigate the calendar grid and month selection spinners.

  • Firefox builds in the Spanish from Spain (es-ES) and Spanish from Argentina (es-AR) locales now come with a built-in dictionary for the Firefox spellchecker.

Fixed

Changed

  • Effective on January 16, Colorways will no longer be in Firefox. Users will still be able to access saved and active Colorways from the Add-ons and themes menu option.

  • On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls the page instead of zooming. This avoids accidental zooming and matches the behavior of other web browsers on macOS.

  • The Recently Closed section of Firefox View now equips users with the ability to manually close/remove URL links from the list.

  • The empty state messages and graphic components surfaced in Firefox View for the Tab Pickup and Recently Closed sections have been updated for an improved user experience.

Security Vulnerabilities fixed in Firefox 109

10 fixes: 4 high, 4 moderate and 2 low.

Mozilla Foundation Security Advisory 2023-01

Security Vulnerabilities fixed in Firefox 109

Announced
January 17, 2023
Impact
high
Products
Firefox
Fixed in
  • Firefox 109

#CVE-2023-23597: Logic bug in process allocation allowed to read arbitrary files

Reporter
Niklas Baumstark
Impact
high
Description

A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the file:// context. Given a reliable exploit primitive, this new process could be exploited again leading to arbitrary file read.

References

#CVE-2023-23598: Arbitrary file read from GTK drag and drop on Linux

Reporter
Tom Schuster
Impact
high
Description

Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to DataTransfer.setData.

References

#CVE-2023-23599: Malicious command could be hidden in devtools output on Windows

Reporter
Vadim
Impact
moderate
Description

When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within.

References

#CVE-2023-23600: Notification permissions persisted between Normal and Private Browsing on Android

Reporter
Kazuki Nomoto of Waseda University
Impact
moderate
Description

Per origin notification permissions were being stored in a way that didn't take into account what browsing context the permission was granted in. This lead to the possibility of notifications to be displayed during different browsing sessions.
This bug only affects Firefox for Android. Other operating systems are unaffected.

References

#CVE-2023-23601: URL being dragged from cross-origin iframe into same tab triggers navigation

Reporter
Luan Herrera
Impact
moderate
Description

Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks

References

#CVE-2023-23602: Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers

Reporter
Dave Vandyke
Impact
moderate
Description

A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers.

References

#CVE-2023-23603: Calls to <code>console.log</code> allowed bypasing Content Security Policy via format directive

Reporter
Dan Veditz
Impact
low
Description

Regular expressions used to filter out forbidden properties and values from style directives in calls to console.log weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser.

References

#CVE-2023-23604: Creation of duplicate <code>SystemPrincipal</code> from less secure contexts

Reporter
Nika Layzell
Impact
low
Description

A duplicate SystemPrincipal object could be created when parsing a non-system html document via DOMParser::ParseFromSafeString. This could have lead to bypassing web security checks.

References

#CVE-2023-23605: Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7

Reporter
Mozilla developers
Impact
high
Description

Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108 and Firefox ESR 102.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

References

#CVE-2023-23606: Memory safety bugs fixed in Firefox 109

Reporter
Mozilla developers
Impact
high
Description

Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

References
 

  • Thanks 3
Link to post
  • AdvancedSetup changed the title to Firefox 109.0 release now available
  • 2 weeks later...
1PW

1PW

Posted
Posted

Version 109.0.1, first offered to Release channel users on January 31, 2023

Fixed

  • Reverted changes to Windows font smoothing, which caused poor rendering on some configurations (bug 1803154)

  • Fixed jank when loading pages containing numerous emoji characters (bug 1809081)

  • Fixed an issue causing authentication prompts to not appear when loading pages in some enterprise environments (bug 1809151)

  • Fixed inconsistent sizing of event listener checkboxes inside the Inspector developer tool (bug 1811760)

No security fixes.

  • Like 1
  • Thanks 2
Link to post
  • AdvancedSetup changed the title to Firefox 109.0.1 release now available
  • 2 weeks later...
  • AdvancedSetup changed the title to Firefox 110.0 release now available
  • 2 weeks later...
1PW

1PW

Posted
Posted (edited)

Version 110.0.1, first offered to Release channel users on February 28, 2023

 

Fixed

  • Fixed clearing recent cookies clears all cookies (bug 1816279).

  • Fixed a bug causing the context menu to sometimes display on the background of other Firefox UI elements instead of the foreground on macOS (bug 1763990).

  • Fixed Manage bookmarks link on empty bookmarks toolbar not responding to clicks on Windows (bug 1812636).

  • Fixed WebGL crashes on Linux when ran inside a VMWare virtual machine (bug 1807942).

  • Fixed a bug with CSP serialization causing bugs with the MitID Digital ID in Denmark (Bug 1819096).

 
Edited by 1PW
  • Like 1
  • Thanks 1
Link to post
  • AdvancedSetup changed the title to Firefox 110.0.1 release now available
  • 2 weeks later...
1PW

1PW

Posted
Posted (edited)

Version 111.0, first offered to Release channel users on March 14, 2023

Quote

New

  • Windows native notifications are now enabled.

  • Firefox Relay users can now opt-in to create Relay email masks directly from the Firefox credential manager. You must be signed in with your Firefox Account.

  • We’ve added two new locales: Silhe Friulian (fur) and Sardinian (sc).

check.6ae3794b67ae.svg

Fixed

 
 

Mozilla Foundation Security Advisory 2023-09

Security Vulnerabilities fixed in Firefox 111

Announced
March 14, 2023
Impact
high
Products
Firefox
Fixed in
  • Firefox 111

#CVE-2023-28159: Fullscreen Notification could have been hidden by download popups on Android

Reporter
Axel Chong (@Haxatron)
Impact
high
Description

The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion or spoofing attacks.
This bug only affects Firefox for Android. Other operating systems are unaffected.

References

#CVE-2023-25748: Fullscreen Notification could have been hidden by window prompts on Android

Reporter
Hafiizh
Impact
high
Description

By displaying a prompt with a long description, the fullscreen notification could have been hidden, resulting in potential user confusion or spoofing attacks.
This bug only affects Firefox for Android. Other operating systems are unaffected.

References

#CVE-2023-25749: Firefox for Android may have opened third-party apps without a prompt

Reporter
Kirtikumar Anandrao Ramchandani
Impact
high
Description

Android applications with unpatched vulnerabilities can be launched from a browser using Intents, exposing users to these vulnerabilities. Firefox will now confirm with users that they want to launch an external application before doing so.
This bug only affects Firefox for Android. Other versions of Firefox are unaffected.

References

#CVE-2023-25750: Potential ServiceWorker cache leak during private browsing mode

Reporter
Kagami Rosylight
Impact
high
Description

Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private browsing mode.

References

#CVE-2023-25751: Incorrect code generation during JIT compilation

Reporter
Lukas Bernhard
Impact
high
Description

Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. This could lead to a potentially exploitable crash.

References

#CVE-2023-28160: Redirect to Web Extension files may have leaked local path

Reporter
Rob Wu
Impact
moderate
Description

When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual local path, leaking potentially sensitive information.

References

#CVE-2023-28164: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation

Reporter
Luan Herrera
Impact
moderate
Description

Dragging a URL from a cross-origin iframe that was removed during the drag could have lead to user confusion and website spoofing attacks.

References

#CVE-2023-28161: One-time permissions granted to a local file were extended to other local files loaded in the same tab

Reporter
Khiem Tran
Impact
moderate
Description

If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permission persisted in that tab for all other documents loaded from a file: URL. This is potentially dangerous if the local files came from different sources, such as in a download directory.

References

#CVE-2023-28162: Invalid downcast in Worklets

Reporter
Lukas Bernhard
Impact
moderate
Description

While implementing on AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have lead to a potentially exploitable crash.

References

#CVE-2023-25752: Potential out-of-bounds when accessing throttled streams

Reporter
Ronald Crane
Impact
moderate
Description

When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. This may have lead future code to be incorrect and vulnerable.

References

#CVE-2023-28163: Windows Save As dialog resolved environment variables

Reporter
Shaheen Fazim
Impact
moderate
Description

When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user.
This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.

References

#CVE-2023-28176: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9

Reporter
Mozilla developers and community
Impact
high
Description

Mozilla developers Timothy Nikkel, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

References

#CVE-2023-28177: Memory safety bugs fixed in Firefox 111

Reporter
Mozilla developers and community
Impact
high
Description

Mozilla developers and community members Calixte Denizet, Gabriele Svelto, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 110. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

References
 
Edited by 1PW
  • Thanks 4
Link to post
  • AdvancedSetup changed the title to Firefox 111.0 release now available
  • AdvancedSetup changed the title to Firefox 111.0.1 release now available
1PW

1PW

Posted
Posted (edited)

Hello @sten2:

The answer remains the same as in your other topic on the same subject.

So far, only Firefox 100+ supports HDR w/macOS Catalina (10.15) and above. Pity.

Your plea will unlikely be read here by management at Mozilla. Please consider adding your wishes to a relevant Mozilla forum.

HTH

Edited by 1PW
  • Like 1
  • Haha 1
Link to post
sten2

sten2

Posted
Posted
13 hours ago, 1PW said:

Hello @sten2:

The answer remains the same as in your other topic on the same subject.

So far, only Firefox 100+ supports HDR w/macOS Catalina (10.15) and above. Pity.

Your plea will unlikely be read here by management at Mozilla. Please consider adding your wishes to a relevant Mozilla forum.

HTH

Hello 1PW

I know that there is no representative from Mozilla at this forum,and i have mentioned the missing feature of HDR support in Firefox before.

I just wanted to express my thoughts about it. Well,lets see whats coming in future releases.

 

  • Like 1
Link to post
  • 3 weeks later...
  • AdvancedSetup changed the title to Firefox 112.0 release now available

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.