Mozilla Firefox Version 118.0 Released with Security Updates

 Mozilla sent Firefox Version 118.0 to the release channel.  The update includes fourteen security updates of which six (6) are rated high, two (2) moderate, and one (1) rated low.

Firefox ESR was updated to Versions 103.0 and 115.3.

High

#CVE-2023-5168: Out-of-bounds write in FilterNodeD2D1

#CVE-2023-5169: Out-of-bounds write in PathOps

#CVE-2023-5170: Memory leak from a privileged process

#CVE-2023-5171: Use-after-free in Ion Compiler

#CVE-2023-5172: Memory Corruption in Ion Hints

#CVE-2023-5176: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3

Moderate

#CVE-2023-5173: Out-of-bounds write in HTTP Alternate Services

#CVE-2023-5174: Double-free in process spawning on Windows

Low

#CVE-2023-5175: Use-after-free of ImageBitmap during process shutdown

New

• Automated translation of web content is now available to Firefox users! Unlike cloud-based alternatives, translation is done locally in Firefox, so that the text being translated does not leave your machine.

• Web Audio in Firefox now uses the FDLIBM math library on all systems to improve anonymity with Fingerprint Protection.

• The visibility of fonts to websites has been restricted to system fonts and language pack fonts to mitigate font fingerprinting in Private Browsing windows.

• Video Effects and background blur are now available to Firefox users on Google Meet! (Note: These effects have also been released retroactively to support Firefox versions back to Firefox 115.)

• Firefox Suggest users (US-only at this time) will now be able to see browser add-on suggestions right in the address bar based on their keywords.

Update: To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

References

• Security Updates
• Release Notes
• Rapid Release Calendar

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Pale Moon Version 32.4.0.1 Released to Address Critical Security Vulnerability

  

Pale Moon has been updated to version 32.4.0.1.  This update addresses a critical security vulnerability.

Changes/Fixes:

• Fixed a WebP decoder issue (CVE 2023-4863)

Notes:

DiD: This means that a fix is "Defense-in-Depth": It is a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code, e.g. when surrounding code changes, exposing the problem, or when new attack vectors are discovered.

Pale Moon includes both 32- and 64-bit versions for Windows: Pale Moon for Windows downloads.

Update: To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Release Notes
Release Cycle

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Microsoft September 2023 Security Updates

 

The Microsoft September 2023 security updates have been released and consist of 59 new patches and 2 advisories. Of the CVEs released, 5 are rated critical, 55 are rated important and 1 is rated moderated in severity. At the time of release, one is listed as being under active attack and as publicly known.

The security updates apply to the following products, features and roles: Microsoft Windows and Windows Components; Exchange Server; Office and Office Components; .NET and Visual Studio; Azure; Microsoft Dynamics; and Windows Defender.

See the list of KBs at the bottom of the page at September 2023 Security Updates - Release Notes - Security Update Guide - Microsoft for information regarding known issues with the security updates as well as the CVEs with FAQs, Mitigations and/or Workarounds. For specific information on Windows 11, version 22H2, see KB5030129 and KB5030217 for Windows 11, version 21H2.  For Windows 10, Version 22H2 and 21H2, see KB5030211.

Important: The September 2023 non-security preview update will be the last optional release for Windows 11, Version 21H2.

Recommended Reading:   See Dustin Childs review and analysis in Zero Day Initiative -- The September 2023 Security Update Review.

 

Additional Update Notes:

• MSRT -- The Malicious Software Removal Tool is now run on a quarterly basis rather than monthly.  See Remove specific prevalent malware with Windows Malicious Software Removal Tool. 
• Servicing Stack Updates -- Microsoft now combines the latest servicing stack update (SSU) for your operating system with the Latest Cumulative Updates (LCU). For general information about SSUs, see Servicing stack updates and Servicing Stack Updates (SSU): Frequently Asked Questions.
  
• Windows updates are cumulative. The monthly security release includes all security fixes for vulnerabilities that affect Windows, in addition to non-security updates. The updates are also available via search for the KB number in the Microsoft Update Catalog.
• For information on lifecycle and support dates for Windows 10 and Windows 11 operating systems, please see Windows 10 Home and Pro and Windows 11 Home and Pro.
• Windows Update History:
• Windows 11
• Windows 10

 

References

• Security Update FAQ
• Security Updates Guide

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...