firefox-128.3.0

[Bruce Dubbs]

New minor version.

[Douglas R. Reno]

Release notes will become available tomorrow

[Douglas R. Reno]

Note that a Thunderbird release is incoming as well.

Security fixes:

• CVE-2024-9392: Compromised content process can bypass site isolation (High)
• CVE-2024-9393: Cross-origin access to PDF contents through multipart responses (High)
• CVE-2024-9394: Cross-origin access to JSON contents through multipart responses (High)
• CVE-2024-8900: Clipboard write permission bypass (Moderate)
• CVE-2024-9396: Potential memory corruption may occur when cloning certain objects (Moderate)
• CVE-2024-9397: Potential directory upload bypass via clickjacking (Moderate)
• CVE-2024-9398: External protocol handlers could be enumerated via popups (Low)
• CVE-2024-9399: Specially crafted WebTransport requests could lead to denial of service (Low)
• CVE-2024-9400: Potential memory corruption during JIT compilation (Low)
• CVE-2024-9401: Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3 (High)
• CVE-2024-9402: Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3 (High)

[Xi Ruoyao]

Douglas: by the way, have you figured out your Firefox crash?

[Douglas R. Reno]

No I haven't :( I originally thought it was on my laptop only, but because you reminded me I checked on my development system and noticed that going to x.com (formerly Twitter) results in the same crash. I'll try it on 128.3.0 and see if it works there.