All Firefox users are urged to update to Firefox 39.0.3

[Bindee]

All Firefox users are urged to update to Firefox 39.0.3

http://www.theregister.co.uk/2015/08/07 ... ln_exploit

[quote]

On Windows the exploit looked for subversion, s3browser, and Filezilla configurations files, .purple and Psi+ account information, and site configuration files from eight different popular FTP clients.

On Linux the exploit goes after the usual global configuration files like /etc/passwd, and then in all the user directories it can access it looks for .bash_history, .mysql_history, .pgsql_history, .ssh configuration files and keys, configuration files for remina, Filezilla, and Psi+, text files with “pass

[darry1966]

Current version of firefox esr is at 38.1.1 so should be patched for this according to the article.

[perdido]

Code: Select all

Mozilla products which don't contain the PDF Viewer, such as Firefox for Android, remain unaffected by the vuln.

Firefox versions that do not contain the built-in PDF Viewer are not affected by this vulnurability.


.

[darry1966]

Those that do change pdf opening action to either using xpdf or similar or download the file instead of opening in FF.

[Barkin]

Current version of firefox esr is at 38.1.1 so should be patched for this according to the article.

Not at the moment it isn't : on Linux & Windows current version of ESR is #31 ...

[8Geee]

If I got this right, a remote hacker uses the browser's pdf.js reader,

In Edit --> Preferences --> Applications --> PDF change to always ask

In about: config use search term pdf

newer FF versions have a "disable auto fetch" listing: set this to true

pdfjs.disabled true
pdfjs.firstRun false
pdfjs.previousHandler.alwaysAskBeforeHandling true

There are other settings with numeric values that support.mozilla does not enlighten.

This routine will cause D/L of the file, or open with... thus a bit dodgy IF D/L option taken.

Editted 8/18/15

[perdido]

If I got this right, a remote hacker uses the browser's pdf.js reader,

Thats how I read it.

In Edit Preferences change to always ask

To clarify; In Edit > Preferences > Applications change Content Type > PDF file to Always Ask

In about: config use search term pdf

pdfjs.disabled true
pdfjs.firstRun false
pdfjs.previousHandler.alwaysAskBeforeHandling true

There are other settings with numeric values that support.mozilla does not enlighten.

This routine will cause D/L of the file, or click X to cancel... thus a bit dodgy.

Good Stuff, doing what you recommend will allow people to keep using their browser safely without upgrading.

One other thing, it is a good idea to install the NoScript Add-on to Firefox and Seamonkey. https://noscript.net/

.

[OscarTalks]

current version of ESR is #31 ...

As I understand it, because ESR's are Extended Support Releases there is always an overlap of the "current" version.

The current release with the highest number is indeed 38.1.1 which was released very recently replacing 38.1.0, presumably patching the exploit.

The 31.x.x version if still supported (and if someone is acutally maintaining it) should also have any important patches applied to it.
The Mozilla website offers a choice of ESR 38 or 31 to download.

Be aware though that if you are using one of those builds with no updater (such as the Slackware releases) you may find that the "About Firefox" window will report the version as up to date when in fact it is not. Latest version of 31 does appear to be 31.8.0 though.

[darry1966]

Have downloaded latest and there was an option to download 31 as well I chose 38.1.1 so yeah there is a choice anyway thanks for the pdf settings tips regarding internal viewer.

[tallboy]

I am not aware of the advantages of using the ESR version of FF, can someone please elaborate on that?

I am using FF 39.0, and independent of version, I always set the prefs to ask for a pdf reader, as I always use Xpdf.
I also have the extension Disable Hello, Pocket & Reader+ 0.4.2 installed, would that be of any help?

In the list of pdf.js's below, are there any other values that should be toggled?

tallboy

BTW: I never accept automatic updates of any kind

[8Geee]

tallboy

Common sense tells me to set pdfjs.disableAutoFetch to TRUE.

edit:

You asked about other things including Pocket
Use the search term pocket in about config

Completely disable it. (M$ Wallet clone !)

Ditto Hello!

[Mike7]

This routine will cause D/L of the file, or open with... thus a bit dodgy IF D/L option taken.

Can you explain, please?

M.