Mozilla Firefox Version 64.0 Released With Security Updates

Mozilla sent Firefox Version 64.0 to the release channel today.  Firefox ESR Version 60.4 has also been released.
The update included nine (9) security updates of which one is critical, five are high, two (2) moderate and one (1) is rated low.

Critical

·        #CVE-2018-12405: Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4 

High

·        #CVE-2018-12407: Buffer overflow with ANGLE library when using VertexBuffer11 module

·        #CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11

·        #CVE-2018-18492: Use-after-free with select element

·        #CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia

·        #CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin U

Moderate

·        #CVE-2018-18495: WebExtension content scripts can be loaded in about: pages

·        #CVE-2018-18496: Embedded feed preview page can be abused for clickjacking

Low

·        #CVE-2018-12406: Memory safety bugs fixed in Firefox 64

New:

• Better recommendations: You may see suggestions in regular browsing mode for new and relevant Firefox features, services, and extensions based on how you use the web (for US users only)
• Enhanced tab management: You can now select multiple tabs from the tab bar and close, move, bookmark, or pin them quickly and easily
• Easier performance management: The new Task Manager page found at about:performance lets you see how much energy each open tab consumes and provides access to close tabs to conserve power
• Improved performance for Mac and Linux users, by enabling link time optimization (Clang LTO). (Clang LTO was enabled for Windows users in Firefox 63.)
• More seamless sharing on Windows: Windows users can now share web pages using the native sharing experience. You can access Share in the Page Actions menu
• Added option to remove add-ons using the context menu on their toolbar buttons
• New for enterprise users: Updated the policy engine on macOS to allow using configuration profiles to customize Firefox for enterprise deployments

Changed:

• RSS feed preview and live bookmarks are available only via add-ons
• TLS certificates issued by Symantec are no longer trusted by Firefox. Website operators are strongly encouraged to replace any remaining Symantec TLS certificates as soon as possible.
• about:crashes has been redesigned to make it clear when a crash is being submitted to Mozilla, as well as being clear that removing crashes locally does not remove them from crash-stats.mozilla.com
• The macOS keyboard shortcut to add "www" and ".com" to a URL is now ctrl-enter instead of [apple]-enter

Update:  To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

References

• Common questions after updating Firefox
• Security Updates
• Mozilla Firefox Release Notes
• Rapid Release Calendar

Remember - "A day without laughter is a day wasted." May the wind sing to you and the sun rise in your heart...