Mozilla Firefox Version 102.0 Released with Security Updates

              Mozilla sent Firefox Version 102.0 to the release channel today.  The update includes eighteen security updates of which four (4) are rated high, ten (10) moderate and four (4) are rated low.

Firefox ESR was updated to Version 91.11.

Note: While Bug 1771084 does not represent a specific vulnerability that was fixed, we recommend anyone rebasing patches to include it. 102 branch: Patch 1 and 2. 91 Branch: Patch 1 and 2 (Despite saying Parts 2 and 3, there is no Part 1)

High

• #CVE-2022-34479: A popup window could be resized in a way to overlay the address bar with web content

• #CVE-2022-34470: Use-after-free in nsSHistory

• #CVE-2022-34468: CSP sandbox header without `allow-scripts` can be bypassed via retargeted javascript: URI

• #CVE-2022-34484: Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11

Moderate

• #CVE-2022-34482: Drag and drop of malicious image could have led to malicious executable and potential code execution

• #CVE-2022-34483: Drag and drop of malicious image could have led to malicious executable and potential code execution

• #CVE-2022-34476: ASN.1 parser could have been tricked into accepting malformed ASN.1

• #CVE-2022-34481: Potential integer overflow in ReplaceElementsAt

• #CVE-2022-34474: Sandboxed iframes could redirect to external schemes

• #CVE-2022-34469: TLS certificate errors on HSTS-protected domains could be bypassed by the user on Firefox for Android

• #CVE-2022-34471: Compromised server could trick a browser into an addon downgrade

• #CVE-2022-34472: Unavailable PAC file resulted in OCSP requests being blocked

• #CVE-2022-34478: Microsoft protocols can be attacked if a user accepts a prompt

• #CVE-2022-2200: Undesired attributes could be set as part of prototype pollution

Low

• #CVE-2022-34480: Free of uninitialized pointer in lg_init

• #CVE-2022-34477: MediaError message property leaked information on cross-origin same-site pages

• #CVE-2022-34475: HTML Sanitizer could have been bypassed via same-origin script via use tags
• #CVE-2022-34473: HTML Sanitizer could have been bypassed via use tags

New

• Tired of too many windows crowding your screen? You can now disable automatic opening of the download panel every time a new download starts. Read more.
• Firefox now mitigates query parameter tracking when navigating sites in ETP strict mode.
• Subtitles and captions for Picture-in-Picture (PiP) are now available at HBO Max, Funimation, Dailymotion, Tubi, Disney+ Hotstar, and SonyLIV. This allows you to view video in a small window pinned to a corner of the screen while navigating between apps or browsing content on the main screen.

Fixed

• When using a screen reader on Windows, pressing enter to activate an element no longer fails or clicks the wrong element and/or another application window. For those blind or with very limited vision, this technology reads out loud what is on the screen, and users can adapt them to their needs (now, on our platform, without errors).

Changed

• Improved security by moving audio decoding into a separate process with stricter sandboxing, thus improving process isolation.

Update: To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

References

• Security Updates
• Release Notes
• Rapid Release Calendar

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...