Backport Android-specific security fixes from Firefox 110 to ESR 102.8-based Tor Browser
No Android (Fenix)-specific issues this time. These are the bugs not explicitly backported to esr 102 to look at:
CVEs
-
https://www.mozilla.org/en-US/security/advisories/mfsa2023-05/#CVE-2023-25740
- fixed in 653bd04f in esr102
-
https://www.mozilla.org/en-US/security/advisories/mfsa2023-05/#CVE-2023-25731
- crash caused when messing about in the network panel
- fixed in gecko-dev@49d07f4caf296481949809845a23087eff1033a8 (patch applies cleanly to esr102)
-
https://www.mozilla.org/en-US/security/advisories/mfsa2023-05/#CVE-2023-25733
- would just cause a crash from null ptr dereference if it were to fail, moz devs claim it can't
- fixed in gecko-dev@53e40632bf8c5da5c161bfe587edfb7cc92e01cc (patch applies cleanly to esr102)
-
https://www.mozilla.org/en-US/security/advisories/mfsa2023-05/#CVE-2023-25736
- fixed in gecko-dev@877d24f93e5349714ede57e3f6313ca26cc78f01 (patch applies cleanly to esr102)
-
https://www.mozilla.org/en-US/security/advisories/mfsa2023-05/#CVE-2023-25741
- fix to bug added 109
Memory Bugs
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1813284
- esr102 unaffecteed
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1688592
- fixed in gecko-dev@2fc2ccf960c2f7c419262ac7215715c5235948db (does not apply cleanly to esr102)
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1797186
- fixed in 8a9112f4 in esr102
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1806521
- esr102 unaffected and it's webrtc which we don't have
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1804998
- not a sec bug, invalid pointer never read
- fixed in gecko-dev@bb4e9a8ba5692d0fd1ac4c6bab52673421eb104a (applies cleanly to esr102)
Edited by morgan