Pale Moon Version 28.4.1 Released

Pale Moon has been updated to version 28.4.1.  This is a security and bugfix update.  The Linux version will follow later today.

A fix identified as "DiD" ("Defense-in-Depth") means that it is a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code, e.g. when surrounding code changes, exposing the problem, or when new attack vectors are discovered. 

From the Release Notes:

Changes/fixes:

• Fixed hover state arrows on some controls.
• Fixed potential denial-of-service issues involving FTP (loading of subresources and spamming errors).
• Disabled Microsoft Family Safety (Win 8.1) by default. This prevents security issues as a result of a local MitM setup.
• Added several site-specific overrides (Firefox Send and polyfill.io) to work around website UA-sniffing isues.
• Implemented the origin-clean algorithm for controlling access to image resources.
• Cleaned up the helper application service code.
• Ported applicable security fixes from Mozilla (CVE-2019-9791, CVE-2019-9792, CVE-2019-9796, CVE-2019-9801, CVE-2019-9793, CVE-2019-9794, CVE-2019-9808 and ZDI-CAN-8368).
  
• Implemented several defense-in-depth measures (for CVE-2019-9790, CVE-2019-9797, CVE-2019-9804, and a JavaScript issue).
• Fixed several memory safety hazards and crashes.
• Binaries are now code-signed again (including the setup program for the installer).

 Download:

• Pale Moon for Windows
• Pale Moon for Linux

Update

To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Mozilla Firefox Version 66.0.1 Released With Critical Security Updates

Mozilla sent Firefox Version 66.0.1 to the release channel today.  The update addresses two (2) CVE's rated critical, Firefox ESR has been updated to Version 60.6.1.

The critical flaws were disclosed in the Zero Day Initiative #Pawn2Own event in Vancouver.

Critical

• #CVE-2019-9810: IonMonkey MArraySlice has incorrect alias information
• #CVE-2019-9813: Ionmonkey type confusion with __proto__ mutations

Update:  To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

References

• Common questions after updating Firefox
• Security Updates
• Release Notes
• Rapid Release Calendar

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Mozilla Firefox Version 66.0 Released With Critical Security Updates

Mozilla sent Firefox Version 66.0 to the release channel today.  The update addresses 21 CVE's of which five (5) are rated critical, seven (7) high, five (5) moderate and four (4) low in severity.

Firefox ESR has been updated to Version 60.6.

Critical

• #CVE-2019-9790: Use-after-free when removing in-use DOM elements
• #CVE-2019-9791: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey
• #CVE-2019-9792: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script 
• #CVE-2019-9789: Memory safety bugs fixed in Firefox 66
• #CVE-2019-9788: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6

High

• #CVE-2019-9793: Improper bounds checks when Spectre mitigations are disabled
• #CVE-2019-9794: Command line arguments not discarded during execution
• #CVE-2019-9795: Type-confusion in IonMonkey JIT compiler
• #CVE-2019-9796: Use-after-free with SMIL animation controller
• #CVE-2019-9797: Cross-origin theft of images with createImageBitmap
• #CVE-2019-9798: Library is loaded from world writable APITRACE_LIB location
• #CVE-2019-9799: Information disclosure via IPC channel messages

Moderate

• #CVE-2019-9801: Windows programs that are not 'URL Handlers' are exposed to web content
• #CVE-2019-9802: Chrome process information leak
• #CVE-2019-9803: Upgrade-Insecure-Requests incorrectly enforced for same-origin navigation
• #CVE-2019-9804: Code execution through 'Copy as cURL' in Firefox Developer Tools on macOS
• #CVE-2019-9805: Potential use of uninitialized memory in Prio

Low

• #CVE-2019-9806: Denial of service through successive FTP authorization prompts
• #CVE-2019-9807: Text sent through FTP connection can be incorporated into alert messages
• #CVE-2019-9809: Denial of service through FTP modal alert error messages
• #CVE-2019-9808: WebRTC permissions can display incorrect origin with data: and blob: URLs

New

• Firefox now prevents websites from automatically playing sound. You can add individual sites to an exceptions list or turn blocking off. To learn more about block autoplay, which will be rolled out gradually to all users, visit the Mozilla blog.
  
• Improved search experience:
  
  • Find a specific webpage faster when you have a lot of tabs open: You
    can now search within all of your open tabs from the tab overflow
    menu
  • Easier search via a redesigned new tab in Private Windows
• Smoother scrolling: Scroll anchoring keeps content from jumping as images and ads load at the top of the page
  
• Improved performance and better user experience for extensions:
  
  • Extensions now store their settings in a Firefox database, rather
    than individual JSON files, making every site you visit faster
  • A redesigned keyboard shortcuts section in about:addons makes it
    easier to view and adjust default shortcuts
• Redesigned certificate error pages help you better understand and resolve issues, including identification of certificate issuers for anti-virus software
  
• Added basic support for macOS Touch Bar
  
• Experimenting with an improved Pocket experience in New Tab with different layouts and more topical content
  
• Improved performance and reduced crash rates by [doubling web content loading processes from 4 to 8 [1]
  
• Easier, passwordless security: Added support for Windows Hello on Windows 10, allowing you to use your face, fingerprint, or external security keys for website authentication
  

Fixed

• The Dark and Light Firefox themes now override the system setting for title bar accent color on Windows 10
  
• Linux users: Resolved an issue that caused Firefox to freeze when downloading files
  

Changed

• System title bar is hidden by default to match Gnome guideline for Linux users

Update:  To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

References

• Common questions after updating Firefox
• Security Updates
• Release Notes
• Rapid Release Calendar

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...