Pale Moon Version 26.5.0 Released with Security Updates

Pale Moon has been updated to Version 26.5.0. The update includes two Defense-in-Depth (DiD) fixes. "Defense-in-Depth" is a fix that does not apply to an actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code when surrounding code changes, exposing the problem.

The Linux version will be released shortly.

Details from the Release Notes:

Security fixes:

• Fixed a potentially exploitable crash related to text writing direction. (CVE-2016-5280)
• Made checking for invalid PNG files more strict. Pale Moon will now reject more PNG files that have corrupted/invalid data that could otherwise lead to potential security issues.
• Changed the way paletted image frames are allocated so the space is cleared before it's used. DiD 
• Fixed a crash in nsNodeUtils::CloneAndAdopt() due to a typo. DiD
• Fixed several memory safety issues and crashes.

Fixes/Changes:

• Implemented a breaking CSP (content security policy) spec change; when a page with CSP is loaded over http, Pale Moon now interprets CSP directives to also include https versions of the hosts listed in CSP if a scheme (http/https) isn't explicitly listed. This breaks with CSP 1.0 which is more restrictive and doesn't allow this cross-protocol access, but is in line with CSP 2 where this is allowed.
• Fixed an issue with the XML parser where it would sometimes end up in an unknown state and throw an error (e.g. when specific networking errors would occur).
• Improved the performance of canvas poisoning by explicitly parallelizing it.

Minimum system Requirements (Windows):

• Windows Vista/Windows 7/Windows 8/Server 2008 or later
• A processor with SSE2 support
  
• 256 MB of free RAM (512 MB or more recommended)
  
• At least 150 MB of free (uncompressed) disk space

Pale Moon includes both 32- and 64-bit versions for Windows:

• 32x:  Download the Pale Moon browser
• 64x:  Pale Moon - x64 builds

Other versions:

• PM4XP (Pale Moon for XP) has reached end of support and has been replaced with Pale Moon for Atom. 
• Linux version: Available from http://www.palemoon.org/contributed-builds.shtml

Update

To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Firefox Version 49.0 Released with Critical Security Updates

Mozilla sent Firefox Version 49.0 to the release channel today.  The update is a major release and includes four (4) critical, ten (10) high, two (2) moderate and two (2) low security updates. 
Detailed information about the security updates is available at Security vulnerabilities fixed in Firefox 49 — Mozilla.

The next scheduled release is November 8, 2016.

Firefox ESR will continue to ship point releases on the same day that Firefox ships and can be downloaded from here and has been updated to Version 45.4.0.

New

• Updated Firefox Login Manager to allow HTTPS pages to use saved HTTP logins. It’s one more way Firefox is supporting Let’s Encrypt and helping users transition to a more secure web.
  
• Added features to Reader Mode that make it easier on the eyes and the ears
  
  • Controls that allow users to adjust the width and line spacing of text
  • Narrate, which reads the content of a page out loud
• Improved video performance for users on systems that support SSSE3 without hardware acceleration
  
• Added context menu controls to HTML5 audio and video that let users loops files or play files at 1.25x speed
  
• Enhancements for Mac users
  
  • Improved performance on OS X systems without hardware acceleration
  • Improved appearance of anti-aliased OS X fonts
• Improvements in about:memory reports for tracking font memory usage
  
• Improve performance on Windows systems without hardware acceleration
  

Fixed

• Fixed an issue that prevented users from updating Firefox for Mac unless they originally installed Firefox. Now, those users as well as any user with administrative credentials can update Firefox.
  

Changed

• Ended Firefox for Mac support for OS X 10.6, 10.7, and 10.8.
  
• Ended Firefox for Windows support for SSE processors
  
• Removed Firefox Hello
  
• Re-enabled the default for Graphite2 font shaping
  

Update

To get the update now, select "Help" from the Firefox menu at the upper left of the browser window, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

References

• Common questions after updating Firefox
• Security Updates
• Mozilla Firefox Release Notes
• Bug Fixes  
• Update Release Schedule for 2016

Remember - "A day without laughter is a day wasted." May the wind sing to you and the sun rise in your heart...

Microsoft Security Bulletin Release for September, 2016

Microsoft released fourteen (14) bulletins.  Seven (7) bulletins are identified as Critical and the remaining seven (7) are rated Important in severity. 

The updates address vulnerabilities in Microsoft Windows, Internet Explorer, Microsoft Edge, Microsoft Office, Microsoft Office Services and Web Apps and Microsoft Exchange.

Addressed in the updates are Remote Code Execution, Elevation of Privilege and Information Disclosure.

Information about the update for Windows 10 is available at Windows 10 update history.

Critical:

• MS16-104 -- Cumulative Security Update for Internet Explorer (3183038)
• MS16-105 -- Cumulative Security Update for Microsoft Edge (3183043
• MS16-106 -- Security Update for Microsoft Graphics Component (3185848)
• MS16-107 -- Security Update for Microsoft Office (3185852)
• MS16-108 -- Security Update for Microsoft Exchange Server (3185883) 
• MS16-116 -- Security Update in OLE Automation for VBScript Scripting Engine (3188724)
• MS16-117 -- Security Update for Adobe Flash Player (3188128)

Important:

• MS16-109 -- Security Update for Silverlight (3182373)
• MS16-110 -- Security Update for Windows (3178467)
• MS16-111 -- Security Update for Windows Kernel (3186973)
• MS16-112 -- Security Update for Windows Lock Screen (3178469)
• MS16-113 -- Security Update for Windows Secure Kernel Mode (3185876)
• MS16-114 -- Security Update for SMBv1 Server (3185879)
• MS16-115 -- Security Update for Microsoft Windows PDF Library (3188733)

Additional Update Notes

• Adobe Flash Player -- For Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, Windows 10, and Windows 10 Version 1511, Adobe Flash Player is now a security bulletin rather than a security advisory and is included with the updates.
• MSRT -- Microsoft released an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center. 
• Windows 8.x and Windows 10 -- Non-security new features and improvements for Windows 8.1 and Windows 10 are included with the updates.
• Windows 10 -- A summary of important product developments included in each update, with links to more details is available at Windows 10 Update History. The page will be regularly refreshed, as new updates are released.

References

• MSRC
• TechNet: Microsoft Security Bulletin for September 2016 
• Windows 10 Update History

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Adobe Flash Player and AIR Security Update Released

Adobe has released Version 23.0.0.162 of Adobe Flash Player for Microsoft Windows, Macintosh and Chrome as well as Version 11.2.202.635 for Linux.  The Extended Support Release for Windows and Macintosh was updated to Version 18.0.0.375. 

The updates are to address important bug fixes and critical vulnerabilities that could potentially allow an attacker to take control of the affected system.

Release date: September 13, 2016
Vulnerability identifier: APSB16-29
CVE number: CVE-2016-4182, CVE-2016-4237, CVE-2016-4238, CVE-2016-4271, CVE-2016-4272, CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4277, CVE-2016-4278, CVE-2016-4279, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-4287, CVE-2016-6921, CVE-2016-6922, CVE-2016-6923, CVE-2016-6924, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, CVE-2016-6932
Platform: Windows, Macintosh, Linux and Chrome OS

Warning:  Although Adobe suggests downloading the update from the Adobe Flash Player Download Center, that link includes a pre-checked option to install unnecessary extras, such as McAfee Scan Plus or Google Drive.  If you use the download center, uncheck any unnecessary extras. 

• Non-IE Plugin (Opera, Firefox, Etc.):  http://download.macromedia.com/get/flashplayer/current/licensing/win/install_flash_player_23_plugin.exe
• Flash Player For Internet Explorer, Windows 7 and earlier:  http://download.macromedia.com/get/flashplayer/current/licensing/win/install_flash_player_23_active_x.exe
• Internet Explorer and Microsoft Edge:  Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1 and Windows 10: Adobe Flash Player is now a security bulletin rather than a security advisory and is distributed via the normal Windows Update channel.
  
• Flash Player Uninstaller:  http://download.macromedia.com/get/flashplayer/current/support/uninstall_flash_player.exe
• Adobe AIR:  http://get.adobe.com/air/

Notes:

• If you use the Adobe Flash Player Download Center, be careful to uncheck any optional downloads that you do not want.  Any pre-checked option is not needed for the Flash Player update.
• Uncheck any toolbar offered with Adobe products if not wanted.
• If you use alternate browsers, it is necessary to install the update for both Internet Explorer as well as the update for alternate browsers.
• The separate 32-bit and 64-bit uninstallers have been replaced with a single uninstaller.

Verify Installation

To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu. 

Do this for each browser installed on your computer.

To verify the version of Adobe Flash Player for Android, go to Settings > Applications > Manage Applications > Adobe Flash Player x.x.

References

• Adobe Priority Ratings
• AIR Download Center 
• Release Notes:  Flash Player® 23 AIR® 23
• Security Bulletin
• PSIRT

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Pale Moon 26.4.1 Released

Pale Moon has been updated to Version 26.4.1. The update includes security fixes as well as minor bug fixes.

Details from the Release Notes:

Security fixes:

• Updated the HSTS preload list to a much more updated source list, and performing our own checks on validity from now on to have the list be as accurate as possible.
• Disabled Triple-DES cipher suites by default (mitigating SWEET32).

Changes/fixes:

• Fixed a crash in the XSS filter.
• Slightly changed the address bar shading on secure sites to be more subtle and easily-blended.
• Fixed the occurrence of "null" titles in bookmarks dragged from special folders.
• Fixed an error initializing the browser due to trying to restore scratchpad data from a stored session when having switched from a version with devtools to a version without devtools, and the previous version had scratchpad data saved.
• Fixed some minor issues in scratchpad and gcli devtools.

Portable-only: Changed the behavior to, by default, allow it to start a new copy or multiple copies without checking if Pale Moon is already running on the system. You will need separate profiles to run multiple browsers concurrently.
(To revert this to the previous behavior, comment out the line MOZ_NO_REMOTE=1 in the .ini file)

Minimum system Requirements (Windows):

• Windows Vista/Windows 7/Windows 8/Server 2008 or later
• A processor with SSE2 support
  
• 256 MB of free RAM (512 MB or more recommended)
  
• At least 150 MB of free (uncompressed) disk space

Pale Moon includes both 32- and 64-bit versions for Windows:

• 32x:  Download the Pale Moon browser
• 64x:  Pale Moon - x64 builds

Other versions:

• PM4XP (Pale Moon for XP) has reached end of support and has been replaced with Pale Moon for Atom. 
• Linux version: Available from http://www.palemoon.org/contributed-builds.shtml

Update

To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...