Mozilla Firefox Version 93.0 Released with Security Updates

     Mozilla sent Firefox Version 93.0 to the release channel today.  The update includes seven security updates of which four (4) are rated high and three (3) are rated moderate.

Firefox ESR was updated to Version 78.15.

High

• CVE-2021-38496: Use-after-free in MessageTask
• CVE-2021-38500: Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15, and Firefox ESR 91.2
• CVE-2021-38501: Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2
• CVE-2021-38499: Memory safety bugs fixed in Firefox 93

Moderate

• CVE-2021-38497: Validation message could have been overlaid on another origin
• CVE-2021-38498: Use-after-free of nsLanguageAtomService object
• CVE-2021-32810: Data race in crossbeam-deque

New

• Firefox now supports the new AVIF image format, which is based on the modern and royalty free AV1 video codec. It offers significant bandwidth savings for sites compared to existing image formats. It also supports transparency and other advanced features.
• Firefox PDF viewer now supports filling more forms (XFA-based forms, used by multiple governments and banks). Learn more.
• When available system memory is critically low, Firefox on Windows will automatically unload tabs based on their last access time, memory usage, and other attributes. This should help reduce Firefox out-of-memory crashes. Switching to an unloaded tab automatically reloads it.
• To prevent session loss for macOS users who are running Firefox from a mounted .dmg file, they’ll now be prompted to finish installation. This permission prompt only appears the first time these users run Firefox on their computer.
• Firefox now blocks downloads that rely on insecure connections, protecting against potentially malicious or unsafe downloads. Learn more and see where to find downloads in Firefox.
• Improved web compatibility for privacy protections with SmartBlock 3.0. Learn more
• Introducing a new referrer tracking protection in Strict Tracking Protection and Private Browsing. Learn more

Fixed

• The VoiceOver screen reader now correctly reports checkable items in accessible tree controls as checked or unchecked.
• The Orca screen reader now works correctly with Firefox, no longer requiring users to switch to another application after starting Firefox.\
• Various security fixes

Changed

• TLS ciphersuites that use 3DES have been disabled. Such ciphersuites can only be enabled when deprecated versions of TLS are also enabled. Learn more.
• The download panel now follows the Firefox visual styles.
  

Update To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

References

• Security Updates
• Release Notes
• Rapid Release Calendar