The Firefox/Mozilla Thread

[trium]

ff v69.0.1

 

18. sept. 2019

 

Fixed

• Fixed external programs launching in the background when clicking a link from inside Firefox to launch them (bug 1570845)

• Usability improvements to the Add-ons Manager for users with screen readers (bug 1567600)

• Fixed the Captive Portal notification bar not being dismissable in some situations after login is complete (bug 1578633)

• Fixed the maximum size of fonts in Reader Mode when zoomed (bug 1578454)

• Fixed missing stacks in the Developer Tools Performance section (bug 1578354)

• Security and stability fixes

Developer

• Developer Information

[trium]

ff v69.0.2

 

03. oct. 2019

 

Fixed

• Fixed a crash when editing files on Office 365 websites (bug 1579858)

• Fixed detection of the Windows 10 Parental Controls feature being enabled (bug 1584613)

• Fixed a Linux-only crash when changing the playback speed while watching YouTube videos (bug 1582222)

[trium]

ff v69.0.3

 

10. oct. 2019

 

Fixed

• Fixed download errors for Windows 10 users with Parental Controls enabled (bug 1586228)

• Fixed Yahoo mail users being prompted to download files when clicking on emails (bug 1582848)

[trium]

ff v68.2.0 esr

 

22. oct. 2019

 

Fixed

• Various security fixes

Enterprise

• New administrative policies were added. More information and templates are available at the Policy Templates page.

 

 

Quote

 

CVE-2019-15903: Heap overflow in expat library in XML_GetCurrentLineNumber

Reporter

Sebastian Pipping

Impact

high

Description

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early. A subsequent call to XML_GetCurrentLineNumber or XML_GetCurrentColumnNumber then resulted in a heap-based buffer over-read.

References

• Bug 1584907

#CVE-2019-11757: Use-after-free when creating index updates in IndexedDB

Reporter

Zhanjia Song

Impact

high

Description

When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. This resulted in a use-after-free and a potentially exploitable crash.

References

• Bug 1577107

#CVE-2019-11758: Potentially exploitable crash due to 360 Total Security

Reporter

Mozilla developers and community

Impact

high

Description

Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed evidence of memory corruption in the accessibility engine and we presume that with enough effort that it could be exploited to run arbitrary code.

References

• Bug 1536227

#CVE-2019-11759: Stack buffer overflow in HKDF output

Reporter

Guido Vranken

Impact

moderate

Description

An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an attacker to execute arbitrary code or more likely lead to a crash.

References

• Bug 1577953

#CVE-2019-11760: Stack buffer overflow in WebRTC networking

Reporter

Nils

Impact

moderate

Description

A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some instances.

References

• Bug 1577719

#CVE-2019-11761: Unintended access to a privileged JSONView object

Reporter

Cody Crews

Impact

moderate

Description

By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms.

References

• Bug 1561502

#CVE-2019-11762: document.domain-based origin isolation has same-origin-property violation

Reporter

Kris Maglione

Impact

moderate

Description

If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin window.

References

• Bug 1582857

#CVE-2019-11763: Incorrect HTML parsing results in XSS bypass technique

Reporter

Gareth Heyes

Impact

moderate

Description

Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML comment text being treated as HTML which could have led to XSS in a web application under certain conditions. It could have also led to HTML entities being masked from filters - enabling the use of entities to mask the actual characters of interest from filters.

References

• Bug 1584216

#CVE-2019-11764: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2

Reporter

Mozilla developers and community

Impact

critical

Description

Mozilla developers and community members Bob Clary, Jason Kratzer, Aaron Klotz, Iain Ireland, Tyson Smith, Christian Holler, Steve Fink, Honza Bambas, Byron Campen, and Cristian Brindusan reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could be exploited to run arbitrary code.

References

• Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2

 

•  

[trium]

ff v70.0

 

22. oct. 2019

 

New

• More privacy protections from Enhanced Tracking Protection:

  • Social tracking protection, which blocks cross-site tracking cookies from sites like Facebook, Twitter, and LinkedIn, is now a standard feature of Enhanced Tracking Protection.
  • The Privacy Protections report shows an overview, with details, of the trackers Firefox has blocked. It provides consolidated reports from Monitor and Lockwise.

• More security protections from Firefox Lockwise, our digital identity and password management tool:

  • Lockwise for desktop lets you create, update, and delete your logins and passwords to sync across all your devices, including the Lockwise mobile apps and Firefox mobile browsers
.
  • Integrated breach alerts from Firefox Monitor, to alert you when saved logins and passwords are compromised in online data breaches.
  • Complex password generation, to help you create and save strong passwords for new online accounts.

• Improvements to core engine components, for better browsing on more sites

  • A faster Javascript Baseline Interpreter to handle the modern web’s
    large codebases and improve page load performance by as much as 8
    percent.
  • WebRender rolled out to more Firefox for Windows users, now available by default on Windows desktops with integrated Intel graphics cards and resolution of 1920x1200 or less) for improved graphics rendering.
  • Compositor improvements in Firefox for macOS that reduce power
    consumption, speed up page load by as much as 22 percent, and reduce
    resource use for video by up to 37 percent.

• More browser features to help you get the most out of Firefox products and services

  • A stand-alone Firefox account menu for easy access to Firefox services like Monitor and Send.
  • A message panel accessed from the gift icon in the toolbar that offers a quick overview of new releases and key features.
  • When a website uses your geolocation, an indicator is shown in the
    address bar.

Fixed

• Various security fixes

Changed

• Built-in Firefox pages now follow the system dark mode preference

• Aliased theme properties have been removed, which may affect some themes

• Passwords can now be imported from Chrome on macOS in addition to existing support for Windows

• Readability is now greatly improved on under- or overlined texts, including links. The lines will now be interrupted instead of crossing over a glyph.

• Improved privacy and security indicators

  • A new crossed-out lock icon will indicate sites delivered via
    insecure HTTP
  • The formerly green lock icon is now grey
  • The Extended Validation (EV) indicator has been moved to the identity
    popup that appears when clicking the lock icon

Developer

• Developer Information

• Developer Information
  For additional developer resources from Mozilla, visit our Mozilla Developer YouTube channel for new videos every week.

• The Developer Tools Accessibility panel now includes an audit for keyboard accessibility and a color deficiency simulator for systems with WebRender enabled

• Inactive CSS: The Inspector now grays out CSS declarations that don’t affect the selected element and shows a tooltip explaining why -- and even how to fix it.

• The new DOM Mutation Breakpoints in Developer Tools allows developers to diagnose when scripts add, remove or update page content. This makes debugging of complex script interactions and dependencies a lot easier.

• WebExtensions developers can now inspect browser.storage.local data using the "Addon Debugging" Firefox Developer Tools.

• With new network resource search in Developer Tools, you can quickly find resources based on their request and response data, including headers, cookies and content.

unresolved

• Some websites or page elements using dynamic JavaScript fail to load. This can be fixed with a temporary workaround.

[trium]

ff v70.0.1

 

31. oct. 2019

 

Fixed

• Fix for an issue that caused some websites or page elements using dynamic JavaScript to fail to load. (Bug 1592136)

• Update OpenH264 video plugin for macOS 10.15 users (Bug 1587543)

• Title bar no longer shows in full screen view (Bug 1588747)

Changed

• OpenH264 video codec version bump for macOS 10.15 users (Bug 1587543)

[hazelnut]

Mozilla launches Firefox Private Network VPN for $4.99 per month

https://www.ghacks.net/2019/12/03/mozilla-launches-firefox-private-network-vpn-for-4-99-per-month/

[trium]

ff v71.0

 

03. dec. 2019

 

New

• Improvements to Lockwise, our integrated password manager:

  • Firefox now suggests saved logins from other subdomains of a site
  • Integrated breach alerts from Firefox Monitor are now available to users with screen readers

• More information about Enhanced Tracking Protection in action:

  • Notifications when Firefox blocks cryptominers
  • A running tally of blocked trackers in the protection panel accessed by clicking the address bar shield

• Picture-in-picture video comes to Firefox for Windows: Select the blue icon from the right edge of a video to pop open a floating window so you can keep watching while working in other tabs. Learn how the feature works.

• Native MP3 decoding on Windows, Linux, and macOS

Fixed

• Various security fixes.

Changed

• Configuration page (about:config) reimplemented in HTML

• Firefox will now ship with Catalan (Valencian) (ca-valencia), Tagalog (tl), and Triqui (trs)

Enterprise

• New kiosk mode functionality, which allows maximum screen space for customer-facing displays

Developer

• Developer Information

• Added support for developers, including:

  • DevTools’ Network panel can now inspect WebSocket messages and automatically formats a variety of framework formats
  • Console’s new multi-line editor mode provides an IDE-like experience that makes it convenient to iterate on longer code snippets
  • The Network panel’s new resource blocking can simulate the impact of tracking protection, security, service outages, and bad connectivity for more robust testing
  • More features and improvements can be found every release in DevTools’ “What’s New” panel in en-US

• New videos every week on the Mozilla Developer YouTube channel

• Improvements to the website certificate viewer, with more features and more detailed information

• Improvements to the extensions downloads API for handling download failures

• Extension popup windows now include the extension name instead of its moz-extension:// url when using the windows.create API

• Extension-registered devtools panels now interact better with screen readers

unresolved

• Some Windows users who had previously installed and uninstalled Comodo antivirus software may not be able to start Firefox. Information on how to resolve this issue is described on support.mozilla.org or in the support knowledgebase.

[trium]

ff v68.3.0 esr

 

03. dec. 2019

 

Fixed

• Updates to improve performance and stability (full list of fixes)

• Various security fixes

 

 

Quote

 

Security Vulnerabilities fixed in - Firefox ESR 68.3

Announced

December 3, 2019

Impact

high

Products

Firefox ESR

Fixed in

• Firefox ESR 68.3

#CVE-2019-17008: Use-after-free in worker destruction

Reporter

Looben Yang

Impact

high

Description

When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash.

References

• Bug 1546331

#CVE-2019-13722: Stack corruption due to incorrect number of arguments in WebRTC code

Reporter

Alexandru Michis

Impact

high

Description

When setting a thread name on Windows in WebRTC, an incorrect number of arguments could have been supplied, leading to stack corruption and a potentially exploitable crash.
Note: this issue only occurs on Windows. Other operating systems are unaffected.

References

• Bug 1580156

#CVE-2019-11745: Out of bounds write in NSS when encrypting with a block cipher

Reporter

Craig Disselkoen

Impact

high

Description

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash.

References

• Bug 1586176

#CVE-2019-17009: Updater temporary files accessible to unprivileged processes

Reporter

Robert Strong

Impact

moderate

Description

When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service.
Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.

References

• Bug 1510494

#CVE-2019-17010: Use-after-free when performing device orientation checks

Reporter

Nils

Impact

moderate

Description

Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash.

References

• Bug 1581084

#CVE-2019-17005: Buffer overflow in plain text serializer

Reporter

Mirko Brodesser

Impact

moderate

Description

The plain text serializer used a fixed-size array for the number of

1. elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash.

    

   References

   • Bug 1584170

#CVE-2019-17011: Use-after-free when retrieving a document in antitracking

Reporter

Nils

Impact

moderate

Description

Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable crash.

References

• Bug 1591334

#CVE-2019-17012: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3

Reporter

Mozilla developers and community

Impact

high

Description

Mozilla developers Christoph Diehl, Nathan Froyd, Jason Kratzer, Christian Holler, Karl Tomlinson, Tyson Smith reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

References

• Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3

 

 

[trium]

ff v72.0

 

07. jan. 2020

 

New

• Firefox’s Enhanced Tracking Protection marks a major new milestone in our battle against cross-site tracking: we now block fingerprinting scripts by default for all users, taking a new bold step in the fight for our users’ privacy.

• Firefox replaces annoying notification request pop-ups with a more delightful experience, by default for all users. The pop-ups no longer interrupt your browsing, in its place, a speech bubble will appear in the address bar when you interact with the site.

• Picture-in-picture video is now also available in Firefox for Mac and Linux: Select the blue icon from the right edge of a video to pop open a floating window so you can keep watching while working in other tabs or apps. Learn how the feature works.

Fixed

• Various security fixes

Changed

• Support for blocking images from individual domains has been removed from Firefox, because of low usage and poor user experience.

Enterprise

• Experimental support for using client certificates from the OS certificate store can be enabled by setting the preference security.osclientcerts.autoload to true (Windows only).

Developer

• Developer Information

• Debugger Watchpoints let developers observe object property access and writes for easier to track data flow through an application.

• Firefox now supports simulation of meta viewport in Responsive Design Mode.

 

 

[trium]

ff v72.0.1

 

08. jan. 2020

 

Fixed

• Security fix

[trium]

ff v68.4.0 esr

 

07. jan. 2020

 

Fixed

• Various security fixes

 

 

Quote

 

Security Vulnerabilities fixed in Firefox ESR 68.4

#CVE-2019-17015: Memory corruption in parent process during new content process initialization on Windows

Reporter

Thomas Imbert

Impact

high

Description

During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially exploitable crash in the parent process.
Note: this issue only occurs on Windows. Other operating systems are unaffected.

References

• Bug 1599005

#CVE-2019-17016: Bypass of @namespace CSS sanitization during pasting

Reporter

Michał Bentkowski

Impact

high

Description

When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration.

References

• Bug 1599181

#CVE-2019-17017: Type Confusion in XPCVariant.cpp

Reporter

bo13oy

Impact

high

Description

Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code.

References

• Bug 1603055

#CVE-2019-17021: Heap address disclosure in parent process during content process initialization on Windows

Reporter

Thomas Imbert

Impact

moderate

Description

During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process.
Note: this issue only occurs on Windows. Other operating systems are unaffected.

References

• Bug 1599008

#CVE-2019-17022: CSS sanitization does not escape HTML tags

Reporter

Michał Bentkowski

Impact

moderate

Description

When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this behavior, more may exist.

References

• Bug 1602843

#CVE-2019-17024: Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4

Reporter

Mozilla developers

Impact

high

Description

Mozilla developers Jason Kratzer, Christian Holler, and Bob Clary reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

References

• Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4

[trium]

ff v68.4.1 esr

 

08. jan. 2020

 

Fixed

• Security fix

 

 

Quote

 

Security Vulnerabilities fixed in Firefox 72.0.1 and Firefox ESR 68.4.1

#CVE-2019-17026: IonMonkey type confusion with StoreElementHole and FallibleStoreElement

Reporter

Qihoo 360 ATA

Impact

critical

Description

Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw.

References

• Bug 1607443

[JDPower]

9 minutes ago, trium said:

...a more delightful experience...

 

 

Who wrote this? Mozilla or a dodgy chinese junkware dev

[trium]

i dont have see something that i can called "delightful experience"

[Andavari]

8 hours ago, JDPower said:

Who wrote this? Mozilla or a dodgy chinese junkware dev

A "delightful experience" would be for them to replace the hamburger icons with donut icons!

[JDPower]

On 09/01/2020 at 04:24, Andavari said:

A "delightful experience" would be for them to replace the hamburger icons with donut icons!

I'm still on the last pre-Quantum release on laptop, so FF is still quite delightful lol. Though I think I've given it long enough for addons that broke with FF60 to become functional again. Plus I quite like the privacy and anti-tracking functionality being added to FF at present, so will finally be making the jump to the NEW 'delightful' Firefox at some point. Probably

[nukecad]

On 08/01/2020 at 20:11, JDPower said:

Who wrote this? Mozilla or a dodgy chinese junkware dev

My current wireless mouse is made by "Bongem".

It took me a while to work out that it a translation from Chinese to a mixture of French/English. "Lucky Jewel / Fortunate Jewel" = Bon Gem.

Nice mouse for a very cheap price and has lasted well, the right button is getting a bit erratic but it is 14 months old.

[Andavari]

22 hours ago, JDPower said:

I'm still on the last pre-Quantum release on laptop

 

I'm on 68.4.1 which is Quantum from the PortableApps build. Nothing all that much different for me, although under the hood there's more files making it as of writing this a hefty 497 MB.

[JDPower]

2 hours ago, Andavari said:

 

I'm on 68.4.1 which is Quantum from the PortableApps build. Nothing all that much different for me, although under the hood there's more files making it as of writing this a hefty 497 MB.

Yeah, I occasionally use (current version of) Tor and the difference doesn't bother me much. Just laziness and sticking with what I'm used to. But as my laptop also uses Win7 I can't really stick with an old browser as of today anyway, so not updating FF sharpish would be lazy AND dumb lol

[trium]

ff v72.0.2

 

20. jan. 2020

 

Fixed

• Various stability fixes

• Fixed issues opening files with spaces in their path (bug 1601905)

• Fixed a web compatibility issue with CSS Shadow Parts which shipped in Firefox 72 (bug 1604989)

• Fixed inconsistent playback performance for fullscreen 1080p videos on some systems (bug 1608485)

[trium]

ff v68.4.2 esr

 

20. jan. 2020

 

Fixed

• Fixed various issues opening files with spaces in their path (bug 1601905, bug 1602726)

[JDPower]

Probably long overdue, but just wanted to say thank you to Trium for being a one man Firefox notification service for us here

[trium]

nothing to thanks :-) my pleasure; youre welcome

[trium]

ff v73.0

 

11. feb. 2020

 

New

• Today’s Firefox release includes two features that help users view and read website content more easily, quickly. Like all accessibility improvements, these features improve browsing for everyone.

  • Firefox has offered a page zoom feature for more than a decade that allows users to set the zoom level on a per-site basis. For users who need to zoom most websites, having to adjust zoom for each new site can be an annoyance. To address this, we have implemented a new global default zoom level setting. This option is available in about:preferences under "Language and Appearance" and can be scaled up or down from 100% as needed and sets the default zoom level for all sites. Per-site zoom is still available to make adjustments to individual sites as needed.
  • Many users with low vision rely on Windows' High Contrast Mode to make websites more readable. Traditionally, to increase the readability of text, Firefox has disabled background images when High Contrast Mode is enabled. With today’s release of Firefox 73, we introduce a “readability backplate” solution which places a block of background color between the text and background image. Now, websites in High Contrast Mode are more readable without disabling background images.

Fixed

• Various security fixes.

• Improved audio quality when playing back audio at a faster or slower speed.

• Firefox will now only prompt you to save logins if a field in a login form was modified.

Changed

• WebRender will roll out to laptops with Nvidia graphics cards with drivers newer than 432.00, and screen sizes smaller than 1920x1200.

Developer

• Developer Information

• WAMP-formatted WebSocket messages (JSON, MsgPack and CBOR) are now nicely decoded for inspection in the Network panel.

Web Platform

• Improved auto-detection of legacy text encodings on old web pages which don’t explicitly declare the text encoding.

unresolved

• Users with 0patch security software may encounter crashes at startup after updating to Firefox 73. This will be fixed in a future Firefox release. As a workaround, an exclusion for firefox.exe can be added within the 0patch settings.