The Firefox/Mozilla Thread

[trium]

ff v106.0.2

26. oct 2022

Fixed

• Fix missing content on some PDF forms (bug 1794351).

• Fix column width for the Notification sub-panel in Settings (bug 1793558).

• Fix a browser freeze with accessibility enabled on some sites such as the Proxmox Web UI (bug 1793748).

• Fix page reloading not working with Firefox View and not refreshing synced data (bug 1792680 and bug 1794474).

• Fix browser not opening if installed from the Windows Store (Bug 1796391).

[trium]

ff v106.0.3

31. oct 2022

Fixed

• Fix a startup crash for some users on Windows (bug 1797464).

• Fixed an incompatibility with the new Windows 11 22H2 Suggested Actions feature resulting in hangs when copying text on a web page (bug 1774285).

[trium]

ff v106.0.4

03. nov 2022

Fixed

• Fixed an issue with DRM Video playback (bug 1797292).

• Fixed broken layout of datetime input when switching types (bug 1797139).

• Fixes Firefox hanging when there is a Direct3D device reset (bug 1792115).

Unresolved

• We are investigating an increase in crashes reported by users with Intel Gemini Lake CPUs (fixed in 106.0.5).

[trium]

ff v106.0.5

04. nov 2022

Fixed

• Addresses a crash experienced by users with Intel Gemini Lake CPUs.

[trium]

ff v107.0

15. nov 2022

New

• Improved the performance of the instance when Microsoft's IME and Defender retrieve the URL of a focused document in Windows 11 version 22H2.

• Power profiling — visualizing performance data recorded from web browsers — is now also supported on Linux and Mac with Intel CPUs, in addition to Windows 11 and Apple Silicon.

Fixed

• Various security fixes.

Enterprise

• Various bug fixes and new policies have been implemented in the latest version of Firefox. You can find more information in the Firefox for Enterprise 107 Release Notes.

Developer

Developer Information

• There are a couple of helpful improvements in Firefox DevTools making it easier to debug WebExtensions:

  

  • Are you using the webext command line tool to run and test your web extension? There is a new argument allowing you to also automatically open DevTools just in case you want to—for example, inspect the UI (bug).
    $ webext run --devtools
    Note: web-ext npm package needs to be >= 7.3.0
  • It’s now also simple to inspect popup windows (implemented by WebExtension) using DevTools (bug).
  • When you make changes in the source code of your WebExtension, you can easily reload it using a “Reload” button in the DevTools toolbox to see the changes (bug).

Unresolved

• In order to better support certain typographical conventions, Firefox now preserves some non-breaking spaces when copying text to the clipboard instead of changing them to regular spaces.
  The new behavior is known to cause problems when non-breaking spaces are used for indentation.

[trium]

ff v102.5.0 esr

15. nov 2022

Fixed

• Various stability, functionality, and security fixes.

Quote

Security Vulnerabilities fixed in Firefox ESR 102.5

Announced November 15, 2022

Impact high

Products Firefox ESR

Fixed in

• Firefox ESR 102.5

#CVE-2022-45403: Service Workers might have learned size of cross-origin media files

Reporter Anne van Kesteren and Karl Tomlinson

Impact high

Description

Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range requests might have allowed them to determine the presence or length of a media file.

References

• Bug 1762078

#CVE-2022-45404: Fullscreen notification bypass

Reporter Irvan Kurniawan

Impact high

Description

Through a series of popup and window.print() calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks.

References

• Bug 1790815

#CVE-2022-45405: Use-after-free in InputStream implementation

Reporter Atte Kettunen

Impact high

Description

Freeing arbitrary nsIInputStream's on a different thread than creation could have led to a use-after-free and potentially exploitable crash.

References

• Bug 1791314

#CVE-2022-45406: Use-after-free of a JavaScript Realm

Reporter Samuel Groß

Impact high

Description

If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape. This could lead to a use-after-free causing a potentially exploitable crash.

References

• Bug 1791975

#CVE-2022-45408: Fullscreen notification bypass via windowName

Reporter Irvan Kurniawan

Impact high

Description

Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks.

References

• Bug 1793829

#CVE-2022-45409: Use-after-free in Garbage Collection

Reporter Gary Kwong

Impact high

Description

The garbage collector could have been aborted in several states and zones and GCRuntime::finishCollection may not have been called, leading to a use-after-free and potentially exploitable crash

References

• Bug 1796901

#CVE-2022-45410: ServiceWorker-intercepted requests bypassed SameSite cookie policy

Reporter Dongsung Kim

Impact moderate

Description

When a ServiceWorker intercepted a request with FetchEvent, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec and then in browsers.

References

• Bug 1658869

#CVE-2022-45411: Cross-Site Tracing was possible via non-standard override headers

Reporter scarlet

Impact moderate

Description

Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript (such as cookies protected by HTTPOnly). To mitigate this attack, browsers placed limits on fetch() and XMLHttpRequest; however some webservers have implemented non-standard headers such as X-Http-Method-Override that override the HTTP method, and made this attack possible again. Firefox has applied the same mitigations to the use of this and similar headers.

References

• Bug 1790311

#CVE-2022-45412: Symlinks may resolve to partially uninitialized buffers

Reporter Armin Ebert

Impact moderate

Description

When resolving a symlink such as file:///proc/self/fd/1, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer.
This bug only affects Firefox on Unix-based operated systems (Android, Linux, MacOS). Windows is unaffected.

References

• Bug 1791029

#CVE-2022-45416: Keystroke Side-Channel Leakage

Reporter Erik Kraft, Martin Schwarzl, and Andrew McCreight

Impact moderate

Description

Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timing attacks such as Prime+Probe could have possibly figured out which keys were being pressed.

References

• Bug 1793676

#CVE-2022-45418: Custom mouse cursor could have been drawn over browser UI

Reporter Hafiizh

Impact moderate

Description

If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing attacks.

References

• Bug 1795815

#CVE-2022-45420: Iframe contents could be rendered outside the iframe

Reporter Suhwan Song of SNU CompSec Lab

Impact low

Description

Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks.

References

• Bug 1792643

#CVE-2022-45421: Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5

Reporter Mozilla developers

Impact high

Description

Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Firefox 106 and Firefox ESR 102.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

References

• Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5

[trium]

ff v107.0.1

29. nov 2022

Fixed

• Fixed an issue with accessing some sites reliably in Private Browsing mode or Strict ETP due to anti-adblockers (bug 1717806).

• Fixed an issue where Color Management was not available for some users (bug 1799391).

• Fixed an issue with text overlapping in the Settings Menu for some locales (bug 1800379).

• Fixed an incompatibility with the new Windows 11 22H2 Suggested Actions feature resulting in hangs when copying phone number links (bug 1798098).

• Fixed an issue where the DevTools UI is not accessible when an alert dialog is displayed (bug 1801840).

[trium]

ff v108.0

13. dec 2022

New

• Import maps, which allow web pages to control the behavior of JavaScript imports, are now enabled by default.

• Processes used for background tabs now use efficiency mode on Windows 11 to limit resource use.
  

• The shift+esc keyboard shortcut now opens the Process Manager, offering a way to quickly identify processes that are using too many resources.

• Improved frame scheduling when under load; this substantially improves Firefox’s MotionMark scores.

Fixed

• Firefox now supports properly color correcting images tagged with ICCv4 profiles.

• Support for non-English characters when saving and printing PDF forms.

• The bookmarks toolbar's default "Only show on New Tab" state works correctly for blank new tabs. As before, you can change the bookmark toolbar's behavior using the toolbar context menu.

• Various security fixes.

Changed

• Firefox now supports the WebMIDI API and a new experimental mechanism for controlling access to dangerous capabilities.

Developer

Developer Information

[trium]

ff v102.6.0 esr

13. dec 2022

Fixed

• Various stability, functionality, and security fixes.

Quote

Security Vulnerabilities fixed in Firefox ESR 102.6

Announced December 13, 2022

Impact high

Products Firefox ESR

Fixed in

• Firefox ESR 102.6

#CVE-2022-46880: Use-after-free in WebGL

Reporter Atte Kettunen

Impact high

Description

A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.

References

• Bug 1749292

#CVE-2022-46872: Arbitrary file read from a compromised content process

Reporter Nika Layzell

Impact high

Description

An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.
This bug only affects Firefox for Linux. Other operating systems are unaffected.

References

• Bug 1799156

#CVE-2022-46881: Memory corruption in WebGL

Reporter Karl and an Anonymous ASAN Nightly User

Impact high

Description

An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash.

References

• Bug 1770930

#CVE-2022-46874: Drag and Dropped Filenames could have been truncated to malicious extensions

Reporter Matthias Zoellner

Impact moderate

Description

A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.

References

• Bug 1746139

#CVE-2022-46875: Download Protections were bypassed by .atloc and .ftploc files on Mac OS

Reporter Dohyun Lee

Impact moderate

Description

The executable file warning was not presented when downloading .atloc and .ftploc files, which can run commands on a user's computer.
Note: This issue only affected Mac OS operating systems. Other operating systems are unaffected.

References

• Bug 1786188

#CVE-2022-46882: Use-after-free in WebGL

Reporter Irvan Kurniawan

Impact moderate

Description

A use-after-free in WebGL extensions could have led to a potentially exploitable crash.

References

• Bug 1789371

#CVE-2022-46878: Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6

Reporter Mozilla developers

Impact high

Description

Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 107 and Firefox ESR 102.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

References

• Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6

[trium]

ff v108.0.1

16. dec 2022

Fixed

• Fixes the default search engine being reset on upgrade for profiles which were previously copied from a different location.

[trium]

ff v108.0.2

05. jan 2023

Fixed

• Fixes a crash for some users on Mac OS X 10.12-10.14 during video playback (bug 1806391).

• Fixes a crash that might occur when managing browser history (bug 1806408).

Changed

• The "Tabs sharing devices" menu item for WebRTC is now located in the tools menu on macOS only (bug 1807697).

[trium]

ff v109.0

17. jan 2023

New

• Manifest Version 3 (MV3) extension support is now enabled by default (MV2 remains enabled/supported). This major update also ushers an exciting user interface change in the form of the new extensions button.

• The Arbitrary Code Guard exploit protection has been enabled in the media playback utility processes, improving security for Windows users.

• The native HTML date picker for date and datetime inputs can now be used with a keyboard alone, improving its accessibility for screen reader users. Users with limited mobility can also now use common keyboard shortcuts to navigate the calendar grid and month selection spinners.

• Firefox builds in the Spanish from Spain (es-ES) and Spanish from Argentina (es-AR) locales now come with a built-in dictionary for the Firefox spellchecker.

Fixed

• Various security fixes.

Changed

• Effective on January 16, Colorways will no longer be in Firefox. Users will still be able to access saved and active Colorways from the Add-ons and themes menu option.

• On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls the page instead of zooming. This avoids accidental zooming and matches the behavior of other web browsers on macOS.

• The Recently Closed section of Firefox View now equips users with the ability to manually close/remove url links from the list.

• The empty state messages and graphic components surfaced in Firefox View for the Tab Pickup and Recently Closed sections have been updated for an improved user experience.

Enterprise

• Various bug fixes and new policies have been implemented in the latest version of Firefox. You can find more information in the Firefox for Enterprise 109 Release Notes.

Developer

Developer Information

• The ability to automatically break when code on the page hits an events handler has been available since Firefox 69. Firefox 109 now adds new support for the scrollend event. To use this new event breakpoint, open the JS debugger and find and expand the Event Listener Breakpoints section in the right hand column (learn more).

  

Web Platform

• The scrollend event is now enabled by default. The event is fired when a scroll has completed.

• Firefox now permanently partitions Storage in third-party contexts independent of Storage Access to align with other browsers and provide better Web compatibility.

[trium]

ff v102.7.0 esr

17. jan 2023

Fixed

• Various stability, functionality, and security fixes.

Quote

Security Vulnerabilities fixed in Firefox ESR 102.7

Announced January 17, 2023

Impact high

Products Firefox ESR

Fixed in

• Firefox ESR 102.7

#CVE-2022-46871: libusrsctp library out of date

Reporter Mozilla Developers

Impact high

Description

An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited.

References

• Bug 1795697

#CVE-2023-23598: Arbitrary file read from GTK drag and drop on Linux

Reporter Tom Schuster

Impact high

Description

Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to DataTransfer.setData.

References

• Bug 1800425

#CVE-2023-23599: Malicious command could be hidden in devtools output on Windows

Reporter Vadim

Impact moderate

Description

When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within.

References

• Bug 1777800

#CVE-2023-23601: URL being dragged from cross-origin iframe into same tab triggers navigation

Reporter Luan Herrera

Impact moderate

Description

Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks

References

• Bug 1794268

#CVE-2023-23602: Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers

Reporter Dave Vandyke

Impact moderate

Description

A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers.

References

• Bug 1800890

#CVE-2022-46877: Fullscreen notification bypass

Reporter Hafiizh

Impact low

Description

By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks.

References

• Bug 1795139

#CVE-2023-23603: Calls to console.log allowed bypasing Content Security Policy via format directive

Reporter Dan Veditz

Impact low

Description

Regular expressions used to filter out forbidden properties and values from style directives in calls to console.log weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser.

References

• Bug 1800832

#CVE-2023-23605: Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7

Reporter Mozilla developers and community

Impact high

Description

Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108 and Firefox ESR 102.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

References

• Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7

[trium]

ff v109.0.1

31. jan 2023

Fixed

• Reverted changes to Windows font smoothing which caused poor rendering on some configurations (bug 1803154)

• Fixed jank when loading pages containing a large number of emoji characters (bug 1809081)

• Fixed an issue causing authentication prompts to not appear when loading pages in some enterprise environments (bug 1809151)

• Fixed inconsistent sizing of event listener checkboxes inside the Inspector developer tool (bug 1811760)

[trium]

ff v110.0

14. feb 2023

New

• It's now possible to import bookmarks, history and passwords not only from Edge, Chrome or Safari but also from Opera, Opera GX, and Vivaldi for all the folks who want to move over to Firefox instead!

• GPU sandboxing has been enabled on Windows.

  Note: A bug in the popular X-Mouse Button Control (XMBC) tool may cause mouse wheel scrolling to stop working. Affected users should update to the latest version of XMBC (2.20 or higher) which contains a fix for this issue.

• On Windows, third-party modules can now be blocked from injecting themselves into Firefox, which can be helpful if they are causing crashes or other undesirable behavior.

• Date, time, and datetime-local input fields can now be cleared with Cmd+Backspace and Cmd+Delete shortcut on macOS and Ctrl+Backspace and Ctrl+Delete on Windows and Linux.

• GPU-accelerated Canvas2D is enabled by default on macOS and Linux.

• WebGL performance improvement on Windows, MacOS and Linux.

• Enables overlay of hardware-decoded video with non-Intel GPUs on Windows 10/11, improving video playback performance and video scaling quality.

Fixed

• Various security fixes.

Changed

• Colorways are no longer available in Firefox, at least not in the same way. You can still access your saved and active Colorways by selecting Add-ons and themes from the Firefox menu. Additionally, you can now install Colorways from all of the previous collections by visiting Colorways by Firefox on the Mozilla Add-ons website.

Enterprise

• Various bug fixes and new policies have been implemented in the latest version of Firefox. You can find more information in the Firefox for Enterprise 110 Release Notes.

Developer

Developer Information

Web Platform

• Firefox now supports CSS named pages, allowing web pages to perform per-page layout and add page-breaks in a declarative manner when printing.

• Firefox now supports CSS size container queries, see the MDN page for documentation on this feature.

[trium]

ff v102.8.0 esr

14. feb 2023

Fixed

• Various security fixes.

Quote

Security Vulnerabilities fixed in Firefox ESR 102.8

Announced February 14, 2023

Impact high

Products Firefox ESR

Fixed in

• Firefox ESR 102.8

#CVE-2023-25728: Content security policy leak in violation reports using iframes

Reporter Johan Carlsson

Impact high

Description

The Content-Security-Policy-Report-Only header could allow an attacker to leak a child iframe's unredacted URI when interaction with that iframe triggers a redirect.

References

• Bug 1790345

#CVE-2023-25730: Screen hijack via browser fullscreen mode

Reporter Irvan Kurniawan

Impact high

Description

A background script invoking requestFullscreen and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential user confusion or spoofing attacks.

References

• Bug 1794622

#CVE-2023-0767: Arbitrary memory write via PKCS 12 in NSS

Reporter Christian Holler

Impact high

Description

An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled.

References

• Bug 1804640

#CVE-2023-25735: Potential use-after-free from compartment mismatch in SpiderMonkey

Reporter Samuel Groß

Impact high

Description

Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free after unwrapping the proxy.

References

• Bug 1810711

#CVE-2023-25737: Invalid downcast in SVGUtils::SetupStrokeGeometry

Reporter Lukas Bernhard

Impact high

Description

An invalid downcast from nsTextNode to SVGElement could have lead to undefined behavior.

References

• Bug 1811464

#CVE-2023-25738: Printing on Windows could potentially crash Firefox with some device drivers

Reporter Mark

Impact high

Description

Members of the DEVMODEW struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn would cause the browser to attempt out of bounds access to related variables.
This bug only affects Firefox on Windows. Other operating systems are unaffected.

References

• Bug 1811852

#CVE-2023-25739: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext

Reporter Holger Fuhrmannek

Impact high

Description

Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in ScriptLoadContext.

References

• Bug 1811939

#CVE-2023-25729: Extensions could have opened external schemes without user knowledge

Reporter Vitor Torres

Impact moderate

Description

Permission prompts for opening external schemes were only shown for ContentPrincipals resulting in extensions being able to open them without user interaction via ExpandedPrincipals. This could lead to further malicious actions such as downloading files or interacting with software already installed on the system.

References

• Bug 1792138

#CVE-2023-25732: Out of bounds memory write from EncodeInputStream

Reporter Ronald Crane

Impact moderate

Description

When encoding data from an inputStream in xpcom the size of the input being encoded was not correctly calculated potentially leading to an out of bounds memory write.

References

• Bug 1804564

#CVE-2023-25734: Opening local .url files could cause unexpected network loads

Reporter Ameen Basha M K and Shaheen Fazim

Impact moderate

Description

After downloading a Windows .url shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system. This also had the potential to leak NTLM credentials to the resource.
This bug only affects Firefox on Windows. Other operating systems are unaffected.

References

• Bug 1809923
• Bug 1784451
• Bug 1810143
• Bug 1812338

#CVE-2023-25742: Web Crypto ImportKey crashes tab

Reporter Goras Francesco

Impact low

Description

When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash.

References

• Bug 1813424

#CVE-2023-25744: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8

Reporter Mozilla developers and community

Impact high

Description

Mozilla developers Kershaw Chang and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 109 and Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

References

• Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8

#CVE-2023-25746: Memory safety bugs fixed in Firefox ESR 102.8

Reporter Mozilla developers and community

Impact high

Description

Mozilla developers Philipp and Gabriele Svelto reported memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

References

• Memory safety bugs fixed in Firefox ESR 102.8

[trium]

ff v110.0.1

28. feb 2023

Fixed

• Fixed clearing recent cookies clears all cookies (bug 1816279).

• Fixed a bug causing the context menu to sometimes display on the background of other Firefox UI elements instead of the foreground on macOS (bug 1763990).

• Fixed Manage bookmarks link on empty bookmarks toolbar not responding to clicks on Windows (bug 1812636).

• Fixed WebGL crashes on Linux when ran inside a VMWare virtual machine (bug 1807942).

• Fixed a bug with CSP serialization causing bugs with the MitID Digital ID in Denmark (Bug 1819096).

[trium]

ff v111.0

14. mar 2023

New

• Windows native notifications are now enabled.

• Firefox Relay users can now opt-in to create Relay email masks directly from the Firefox credential manager. You must be signed in with your Firefox Account.

• We’ve added two new locales: Silhe Friulian (fur) and Sardinian (sc).

Fixed

• Various security fixes.

Developer

Developer Information

Web Platform

• Use of the rel attribute is now supported on form elements, allowing the specification of the relationship between the current document and the form target in a simpler, cross-browser way.

• Origin private file system access is now enabled, a new storage API that enables web applications to store and retrieve data from and to the filesystem in a sandbox.

[trium]

ff v102.9.0 esr

14. mar 2023

Fixed

• Various security fixes.

Quote

Security Vulnerabilities fixed in Firefox ESR 102.9

Announced March 14, 2023

Impact high

Products Firefox ESR

Fixed in

• Firefox ESR 102.9

#CVE-2023-25751: Incorrect code generation during JIT compilation

Reporter Lukas Bernhard

Impact high

Description

Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. This could lead to a potentially exploitable crash.

References

• Bug 1814899

#CVE-2023-28164: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation

Reporter Luan Herrera

Impact moderate

Description

Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks.

References

• Bug 1809122

#CVE-2023-28162: Invalid downcast in Worklets

Reporter Lukas Bernhard

Impact moderate

Description

While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have led to a potentially exploitable crash.

References

• Bug 1811327

#CVE-2023-25752: Potential out-of-bounds when accessing throttled streams

Reporter Ronald Crane

Impact moderate

Description

When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. This may have lead future code to be incorrect and vulnerable.

References

• Bug 1811627

#CVE-2023-28163: Windows Save As dialog resolved environment variables

Reporter Shaheen Fazim

Impact moderate

Description

When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user.
This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.

References

• Bug 1817768

#CVE-2023-28176: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9

Reporter Mozilla developers and community

Impact high

Description

Mozilla developers Timothy Nikkel, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

References

• Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9

[trium]

ff v111.0.1

21. mar 2023

Fixed

• Fixed a crash on macOS while pinch-zooming under some circumstances (bug 1658986).

• Fixed a bug causing Firefox to freeze on startup for some Windows users (bug 1823159).

[trium]

ff v112.0

11. apr 2023

New

• Right-clicking on password fields now shows an option to reveal the password.

• Ubuntu Linux users can now import their browser data from the Chromium Snap package. Currently, this will only work if Firefox is not also installed as a Snap package, but work is underway to address this!

• Do you use the tab list panel in the tab bar? If so, you can now close tabs by middle-clicking items in that list.

• You've always been able to un-close a tab by using (Cmd/Ctrl)-Shift-T. Now, that same shortcut will restore the previous session if there are no more closed tabs from the same session to re-open.

• For all ETP Strict users, we extended the list of known tracking parameters that are removed from URLs to further protect our users from cross-site tracking.

• Enables overlay of software-decoded video on Intel GPUs in Windows. Improves video down scaling quality and reduces GPU usage.

• Private windows and ETP set to strict will now include email tracking protection. This will make it harder for email trackers to learn the browsing habits of Firefox users. You can check the Tracking Content in the sub-panel on the shield icon panel.

Fixed

• Various security fixes.

Changed

• The deprecated U2F Javascript API is now disabled by default. The U2F protocol remains usable through the WebAuthn API. The U2F API can be re-enabled using the security.webauth.u2f preference.

Enterprise

• You can find information about policy updates and enterprise specific bug fixes in the Firefox for Enterprise 112 Release Notes.

Developer

Developer Information

Web Platform

• Clear button, newly added to the date picker panel, allows users to quickly clear the input with type date or datetime-local and provides a familiar experience across browsers.

Unresolved

• Under rare circumstances, animated Firefox themes can use excessive memory.
  If you encounter this problem, please change your theme to one that does not use animations to work around it. We are in the process of shipping a fix (bug 1828587) (fixed in 112.0.2).

[trium]

ff v102.10.0 esr

11. apr 2023

Fixed

• Various security fixes.

Quote

Security Vulnerabilities fixed in Firefox ESR 102.10

Announced April 11, 2023

Impact high

Products Firefox ESR

Fixed in

• Firefox ESR 102.10

#CVE-2023-29531: Out-of-bound memory access in WebGL on macOS

Reporter DoHyun Lee

Impact high

Description

An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash.
This bug only affects Firefox for macOS. Other operating systems are unaffected.

References

• Bug 1794292

#CVE-2023-29532: Mozilla Maintenance Service Write-lock bypass

Reporter Holger Fuhrmannek

Impact high

Description

A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server. The update file can be replaced after the signature check, before the use, because the write-lock requested by the service does not work on a SMB server.
Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.

References

• Bug 1806394

#CVE-2023-29533: Fullscreen notification obscured

Reporter Irvan Kurniawan

Impact high

Description

A website could have obscured the fullscreen notification by using a combination of window.open, fullscreen requests, window.name assignments, and setInterval calls. This could have led to user confusion and possible spoofing attacks.

References

• Bug 1814597
• Bug 1798219

#CVE-2023-1999: Double-free in libwebp

Reporter Irvan Kurniawan

Impact high

Description

A double-free in libwebp could have led to memory corruption and a potentially exploitable crash.

References

• Bug 1819244

#CVE-2023-29535: Potential Memory Corruption following Garbage Collector compaction

Reporter Lukas Bernhard

Impact high

Description

Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.

References

• Bug 1820543

#CVE-2023-29536: Invalid free from JavaScript code

Reporter zx from qriousec

Impact high

Description

An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.

References

• Bug 1821959

#CVE-2023-29539: Content-Disposition filename truncation leads to Reflected File Download

Reporter Trung Pham

Impact moderate

Description

When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.

References

• Bug 1784348

#CVE-2023-29541: Files with malicious extensions could have been downloaded unsafely on Linux

Reporter Ameen Basha M K

Impact moderate

Description

Firefox did not properly handle downloads of files ending in .desktop, which can be interpreted to run attacker-controlled commands.
This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.

References

• Bug 1810191

#CVE-2023-29542: Bypass of file download extension restrictions

Reporter Shaheen Fazim and Ameen Basha M K

Impact moderate

Description

A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code.
This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.

References

• Bug 1815062
• Bug 1810793

#CVE-2023-29545: Windows Save As dialog resolved environment variables

Reporter Axel Chong (@Haxatron)

Impact moderate

Description

Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user.
This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.

References

• Bug 1823077

#CVE-2023-1945: Memory Corruption in Safe Browsing Code

Reporter Gabriele Svelto

Impact moderate

Description

Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.

References

• Bug 1777588

#CVE-2023-29548: Incorrect optimization result on ARM64

Reporter JunYoung Park

Impact low

Description

A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.

References

• Bug 1822754

#CVE-2023-29550: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10

Reporter Mozilla developers and community

Impact high

Description

Mozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

References

• Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10

[trium]

ff v112.0.1

17. apr 2023

Fixed

• Fixed a bug where cookie dates appear to be set in the far future after updating Firefox. This may have caused cookies to be unintentionally purged. (bug 1827669).

Unresolved

• Under rare circumstances, animated Firefox themes can use excessive memory.
  If you encounter this problem, please change your theme to one that does not use animations to work around it. We are in the process of shipping a fix (bug 1828587) (fixed in 112.0.2).

[trium]

ff v112.0.2

25. apr 2023

Fixed

• Fixes a high memory usage issue with animated images in minimized (or completely covered) windows, especially when using animated themes (bug 1828587).

• Fixes an issue where Linux users with bitmap fonts installed may have had entire sections of text invisible to them on some sites (bug 1827950).

• Fixes an issue where web notifications with images were not displaying for Windows 8 users (bug 1822817).

[trium]

ff v113.0

09. may 2023

New

• Say hello to enhanced Picture-in-Picture! Rewind, check video duration, and effortlessly switch to full-screen mode on the web's most popular video websites.

• Firefox's address bar is already a great place to search for what you're looking for. Now you'll always be able to see your web search terms and refine them while viewing your search's results - no additional scrolling needed! Also, a new result menu has been added making it easier to remove history results and dismiss sponsored Firefox Suggest entries.
  

• Private windows now protect users even better by blocking third-party cookies and storage of content trackers.

• Passwords automatically generated by Firefox now include special characters, giving users more secure passwords by default.

• Firefox 113 introduces a redesigned accessibility engine which significantly improves the speed, responsiveness, and stability of Firefox when used with:

  • Screen readers, as well as certain other accessibility software;
  • East Asian input methods;
  • Enterprise single sign-on software; and
  • Other applications which use accessibility frameworks to access information.

• Importing bookmarks from Safari or a Chrome-based browser? The favicons for those bookmarks will now also be imported by default to make them easier to identify.

• Firefox 113 now supports AV1 Image Format files containing animations (AVIS), improving support for AVIF images across the web.

• The Windows GPU sandbox first shipped in the Firefox 110 release has been tightened to enhance the security benefits it provides.

• A 13-year-old feature request was fulfilled and Firefox now supports files being drag-and-dropped directly from Microsoft Outlook. A special thanks to volunteer contributor Marco Spiess for helping to get this across the finish line!

• Users on macOS can now access the Services sub-menu directly from Firefox context menus.

• On Windows, the elastic overscroll effect has been enabled by default. When two-finger scrolling on the touchpad or scrolling on the touchscreen, you will now see a bouncing animation when scrolling past the edge of a scroll container.

• Firefox is now available in the Tajik (tg) language.

Fixed

• Various security fixes.

Changed

• The long-deprecated mozRTCPeerConnection, mozRTCIceCandidate, and mozRTCSessionDescription WebRTC interfaces have been removed. Sites should utilize the non-prefixed versions instead.

Enterprise

• You can find information about policy updates and enterprise specific bug fixes in the Firefox for Enterprise 113 Release Notes.

Developer

Developer Information

• There have been numerous improvements to the Debugger's "Search in files" feature (also known as "Project search"):

  • The panel has been moved to a regular side panel, which allows you to keep the results list visible while opening scripts in the editor;
  • Results from minified and pretty-printed tabs, as well as matches from the node_modules folder, are displayed;
  • Results from ignored files are hidden; and
  • Glob patterns and search modifiers are also supported, making it possible to execute case-sensitive or regex searches on specific parts of your project.

• Additional features include support for pretty printing inline scripts in HTML files and column breakpoints in pretty printed sources.

• It is now possible to override a JavaScript file in the debugger. In the Debugger, under the Sources tree, you can use the "Add script override" context menu entry. This action will download the file onto your machine, allowing you to edit it. After reloading the page, the local file will be loaded instead of the original script (indicated by a purple icon when a file is overridden).
  

Web Platform

• Module scripts can now import other ES module scripts on worklets.

• Firefox 113 includes new CSS functionality, including improved support for the color (level 4) specification (such as the lab(), lch(), oklab(), oklch(), and color() functions) and the scripting media query.

• Firefox 113 adds support for a number of WebRTC features for improved interoperability: RTCMediaSourceStats, RTCPeerConnectionState, RTCPeerConnectionStats ("peer-connection" RTCStatsType), RTCRtpSender.setStreams(), and RTCSctpTransport.

• The forced-color-adjust property is now supported, allowing authors to opt an element out of color changes in Forced Color Mode for improved readability where the automatically-picked contrasting colors are not ideal.

Unresolved

• Users on some Windows systems may see incorrect and/or over-saturated colors. This is fixed in the Firefox 113.0.1 release.