firefox-128.2.0

[Joe Locash]

New minor version. Release notes not available yet, but probably contains security fixes like most esr releases.

cbindgen changes not needed. I built with the bundled icu so not sure about that.

[Joe Locash]

Release notes:

Various security fixes and other quality improvements.

Security Fixes

• CVE-2024-8385: WASM type confusion involving ArrayTypes (High)
• CVE-2024-8381: Type confusion when looking up a property name in a "with" block (HIGH)
• CVE-2024-8382: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran (Moderate)
• CVE-2024-8383: Firefox did not ask before openings news: links in an external application (Moderate)
• CVE-2024-8384: Garbage collection could mis-color cross-compartment objects in OOM conditions (Moderate)
• CVE-2024-8386: SelectElements could be shown over another site if popups are allowed (Low)
• CVE-2024-8387: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2 (High)

[Douglas R. Reno]

The change for ICU seems to still be needed

[Douglas R. Reno]

Some of these vulnerabilities have been updated to Critical by NVD

[Douglas R. Reno]

Fixed at 801d1d1d0af79c74687cd8aa07fcd83b98600223

SA-12.2-004 issued