Mozilla Firefox 21.0 Released

Mozilla sent Firefox Version 21.0 to the release channel. The current update information does not indicate that security updates are included.  

Update:  The security updates were posted after this was published.  The update includes eight (8) security updates, in which three are critical, four high and one moderate.  The security updates are listed below.  

Fixed in Firefox 21

MFSA 2013-48 Memory corruption found using Address Sanitizer
MFSA 2013-47 Uninitialized functions in DOMSVGZoomEvent
MFSA 2013-46 Use-after-free with video and onresize event
MFSA 2013-45 Mozilla Updater fails to update some Windows Registry entries
MFSA 2013-44 Local privilege escalation through Mozilla Maintenance Service
MFSA 2013-43 File input control has access to full path
MFSA 2013-42 Privileged access for content level constructor
MFSA 2013-41 Miscellaneous memory safety hazards (rv:21.0 / rv:17.0.6)

What’s New

• NEW -- The Social API now supports multiple providers
• NEW -- Enhanced three-state UI for Do Not Track (DNT)
• NEW -- Firefox will suggest how to improve your application startup time if needed
• NEW -- Preliminary implementation of Firefox Health Report
• CHANGED -- Ability to restore removed thumbnails on New Tab Page
• CHANGED -- CSS -moz-user-select:none selection changed to improve compatibility with -webkit-user-select:none (bug 816298)
• CHANGED -- Graphics related performance improvements (bug 809821)
• CHANGED -- Removed E4X support from Spidermonkey
• FIXED -- Some function keys may not work when pressed (833719)
• FIXED -- Browsing and Download history clearing needs unification to avoid confusion on clearing download history (847627) 

Known Issues

• Unresolved-- If you try to start Firefox using a locked profile, it will crash (see 573369)
• Unresolved-- Download statusbar add-on continues downloading files from Normal Browsing, when switching to Private Browsing (see 853463)

Update

To get the update now, select "Help" from the Firefox menu at the upper left of the browser window, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu.

If you do not use the English language version, Fully Localized Versions are available for download.

References

• Common questions after updating Firefox
• Security Updates
• Mozilla Firefox Release Notes
• Bug Fixes 

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Security Bulletin Advance Notice for May 2013

On Tuesday, May 14, 2013, Microsoft is planning to release ten (10) bulletins.  Two bulletins are identified as Critical with eight bulletins rated Important.

The critical bulletins will address vulnerabilities in Microsoft Windows and Internet Explorer. The bulletins rated Important and will address issues in Microsoft Windows, Microsoft Office, Server and Tools, and .NET Framework. 

Microsoft is also working to have the Internet Explorer Security Update address the issue for Internet Explorer 8 as described in Security Advisory 2847140.  This anticipated update will supplement the Fix it solution as detailed yesterday here:  Microsoft FixIt for Security Advisory 2847140.

As happens each month, Microsoft will also release an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center.

References

• MSRC Blog:  Advance Notification Service for May 2013 Security Bulletin Release
• TechNet: Microsoft Security Bulletin Advance Notification for May 2013

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Microsoft FixIt for Security Advisory 2847140

Microsoft released a Microsoft Fix it solution for Security Advisory 2847140, which relates to a vulnerability for IE8.

Although it is anticipated that there will be an update included with next week's security updates, anyone with IE8 installed is advised to install the Fix it solution.  The Fix it uses the Windows application compatibility toolkit to make a small change at runtime to mshtml.dll every time IE is loaded. 

Below are the links to both apply and uninstall the Fix it solution: 
 

Apply Fix it	Uninstall Fix it
Microsoft Fix it 50992	Microsoft Fix it 50991

Another option is to install the Enhanced Mitigation Experience Toolkit (EMET), described in the "workarounds" section of the Tech Net Advisory.

If you have Windows Vista or Windows 7 installed, you should have updated to IE9 or IE10.  In the event you haven't, it is strongly advised that you update!

References:

• MSRC: Security Advisory 2798897 released, Certificate Trust List updated
• Tech Net Advisory: Microsoft Security Advisory (2847140): Vulnerability in Internet Explorer Could Allow Remote Code Execution

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...