Backport Android-specific security fixes from Firefox 110 to ESR 102.8-based Tor Browser

No Android (Fenix)-specific issues this time. These are the bugs not explicitly backported to esr 102 to look at:

CVEs

  • https://www.mozilla.org/en-US/security/advisories/mfsa2023-05/#CVE-2023-25740
    • fixed in 653bd04f in esr102
  • https://www.mozilla.org/en-US/security/advisories/mfsa2023-05/#CVE-2023-25731
    • crash caused when messing about in the network panel
    • fixed in gecko-dev@49d07f4caf296481949809845a23087eff1033a8 (patch applies cleanly to esr102)
  • https://www.mozilla.org/en-US/security/advisories/mfsa2023-05/#CVE-2023-25733
    • would just cause a crash from null ptr dereference if it were to fail, moz devs claim it can't
    • fixed in gecko-dev@53e40632bf8c5da5c161bfe587edfb7cc92e01cc (patch applies cleanly to esr102)
  • https://www.mozilla.org/en-US/security/advisories/mfsa2023-05/#CVE-2023-25736
    • fixed in gecko-dev@877d24f93e5349714ede57e3f6313ca26cc78f01 (patch applies cleanly to esr102)
  • https://www.mozilla.org/en-US/security/advisories/mfsa2023-05/#CVE-2023-25741
    • fix to bug added 109

Memory Bugs

  • https://bugzilla.mozilla.org/show_bug.cgi?id=1813284
    • esr102 unaffecteed
  • https://bugzilla.mozilla.org/show_bug.cgi?id=1688592
    • fixed in gecko-dev@2fc2ccf960c2f7c419262ac7215715c5235948db (does not apply cleanly to esr102)
  • https://bugzilla.mozilla.org/show_bug.cgi?id=1797186
    • fixed in 8a9112f4 in esr102
  • https://bugzilla.mozilla.org/show_bug.cgi?id=1806521
    • esr102 unaffected and it's webrtc which we don't have
  • https://bugzilla.mozilla.org/show_bug.cgi?id=1804998
    • not a sec bug, invalid pointer never read
    • fixed in gecko-dev@bb4e9a8ba5692d0fd1ac4c6bab52673421eb104a (applies cleanly to esr102)
Edited Feb 14, 2023 by morgan
Assignee Loading
Time tracking Loading