Skip to content

@wolfbeast wolfbeast released this Mar 25, 2020 · 21 commits to master since this release

This is a small bugfix update addressing 2 more important issues in 28.9.0:

  • Fixed an issue with browser migration and initialization code causing various browser run-time problems.
  • Fixed an issue with cache behavior where some users would have trouble having their windows and tabs restored in "soft refresh" mode (see v28.9.0 release notes).
    To solve this, we reverted to the previous (pull from cache) mode for now while we investigate the cause.

Built with the Unified XUL Platform - March 24, 2020 release.

Assets 2

@wolfbeast wolfbeast released this Mar 24, 2020 · 21 commits to master since this release

This is a small update to address a problem with user-agent overrides not working as-intended for some people.


Built with the Unified XUL Platform @ RELBASE_20200324

Assets 2

@wolfbeast wolfbeast released this Mar 24, 2020 · 21 commits to master since this release

This is a major development update.

New features:

  • Implemented asynchronous iterators (await iterator.next() and for await loops) (ES2018)
  • Implemented promise-based media playback.
  • Implemented non-standard legacy CSSStyleSheet rules functions.
  • Implemented the html5 <dialog> element. To switch this on, flip dom.dialog_element.enabled to true.
  • Implemented the optional hiding of pinned tabs in CtrlTab/AllTab panes. (controlled through the preferences browser.ctrlTab.hidePinnedTabs and browser.allTabs.hidePinnedTabs)
  • Added 1.25x playback speed to html media elements.
  • Added a hidden pref (browser.places.smartBookmarks.max) to control the sizes of default smart bookmarks categories.

Changes/fixes:

  • Aligned document.open() with the overhauled specification.
  • Aligned the way DOM styles are computed with mainstream browser behavior.
  • Removed the (unused) DOM promise implementation.
  • Enabled seeking to next frame in media files.
  • Enabled dynamic UA updates for emergency use.
  • Implemented rule processing stub for font-variation-settings.
  • Increased the maximum XML nesting depth to 2048 levels for extreme corner cases and to conservatively align with other browsers.
  • Improved the privacy of geolocation lookup calls, with thanks to a generous service donation from ip-api.com
  • Improved reporting of the operating system in site-specific user-agent overrides.
  • Improved table drawing performance again after the rewrite for sticky positioning making it slower.
  • Updated CSP processing to allow custom scheme wildcards to be specified without a port.
  • Aligned the behavior of outlines with other browsers when dealing with CSS-repositioned elements.
  • Changed the way hardware acceleration is controlled from the application.
  • Changed the default monospace font for main languages from Courier New to Consolas.
    This provides a more balanced font for fixed-width text that is slightly more condensed and more in line with the naturally compacter variable-width fonts used everywhere else.
  • Changed the browser's behavior when restoring tabs from previous sessions. To prevent stale pages, it will now by default perform a "soft refresh" of the page instead of drawing it purely from cache without checking if the page needs updating. If you prefer the old behavior, set browser.sessionstore.cache_behavior to 0 in about:config.
  • Updated NSPR to 4.24 and NSS to ~3.48.1-RTM, removing the previous custom patch level with NSS being able to support custom rounds for DBM now.
    For extensive release notes with all NSS changes, see NSS_Releases
  • Implemented an NSS performance optimization for Master Password use with limited effect.
  • Fixed some potential crashing scenarios with WebGL on Linux.
  • Completely removed showModalDialog.
  • Disabled some logging in production builds.
  • Removed various gadgeteering/redundant/dead DOM APIs (casting/presentation, FlyWeb)
  • Removed support for a number of critical libraries being system-supplied.
  • Removed "Copy raw data" button from the troubleshooting information page, since it's never used by us in that format, and users mistakenly keep using it instead of copying text.
  • Removed a bunch of Android and iOS support code.
  • Fixed an issue with form elements sometimes being incorrectly disabled.
  • Fixed several crashes.
  • Fixed an issue with Captive Portal detection sometimes firing even when disabled by the user.
  • Performed various tree-wide code cleanups.
  • Backed out a large code cleanup patch for causing subtle issues in website operation (e.g. WordPress). This will have to be revisited later; the reintroduced code is not in use in practice.
  • Cleaned up the application updater code.

Security-related fixes:

  • Fixed a potential pointer issue issue in cubeb. DiD
  • Disabled allowing remote jar: URIs by default for security reasons. If you need this functionality for your non-standard environment, you can enable it with the preference network.jar.block-remote-files, but please consider moving away from this method of providing web-based applications.
  • Removed a potentially dangerous and otherwise ineffective optimization from the JavaScript engine.
  • Fixed unwanted behavior where created/focused pop-up windows could potentially cover the DOM fullscreen notification, hiding it from users. (CVE-2020-6810)
  • Fixed an issue where copying data as a curl request from developer tools would not properly escape parameters. (CVE-2020-6811)
  • Updated our sctp library code with several upstream fixes.
  • Unified XUL Platform Mozilla Security Patch Summary: 4 fixed, 3 already mitigated, 1 rejected, 11 not applicable.
Assets 2

@wolfbeast wolfbeast released this Jul 23, 2018 · 126 commits to master since this release

This will be the final maintenance release of Pale Moon 27 on the "Tycho" platform. Do not expect any further updates.

This is a security and usability update.

Changes/fixes:

  • Updated the useragent for addons.mozilla.org to work around their "Only with Firefox" discrimination preventing users from downloading themes, old versions of extensions, and other files with Pale Moon.
  • Restricted web access to the moz-icon:// scheme that could potentially be abused to infringe the user's privacy.
  • Prevented various location-based threats. DiD
  • Fixed a potential vulnerability with plugins being redirected to different origins (CVE-2018-12364).
  • Improved the security check for launching executable files (by association) on Windows from the browser. For users who have (most likely accidentally) granted a system-wide waiver for opening these kinds of files without being prompted, this permission has been reset.
  • Fixed an issue with invalid qcms transforms (CVE-2018-12366).
  • Fixed a buffer overflow using the computed size of canvas elements (CVE-2018-12359).
  • Fixed a use-after-free when using focus() (CVE-2018-12360).
  • Added some sanity checks on nsMozIconURI. DiD
  • Fixed an issue in the case the preferences file in the profile would not be writable (e.g. temporary permission issues due to backup, virus scanning or similar external processes).

DiD This means that the fix is "Defense-in-Depth": It is a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code, e.g. when surrounding code changes, exposing the problem, or when new attack vectors are discovered.

Assets 2

@wolfbeast wolfbeast released this Jun 12, 2018 · 138 commits to master since this release

This is a security update.

Changes/fixes:

  • (CVE-2017-0381) Ported a patch from libopus upstream. Note, contrary to that report, the libopus maintainers state they don't believe remote code execution was possible, so this was not a critical patch.
  • Fixed an issue with task counting in JS GC.
  • Fixed a use-after-free in DOMProxyHandler::EnsureExpandoObject (thanks to Berk Cem Göksel for reporting).
  • Portable only: Included the previously omitted registry helper. This may in some cases help with file/type associations.
Assets 2

@wolfbeast wolfbeast released this Jun 12, 2018 · 146 commits to master since this release

This is a security and stability update.

Changes/fixes:

  • We changed the language strings for softblocked items so people will cry less when we do our job.
  • (CVE-2018-5174) Prevent potential SmartScreen bypass on Windows 10.
  • (CVE-2018-5173) Fixed an issue in the Downloads panel improperly rendering some Unicode characters, allowing for the file name to be spoofed. This could be used to obscure the file extension of potentially executable files from user view in the panel.
  • (CVE-2018-5177) Fixed a vulnerability in the XSLT component leading to a buffer overflow and crash if it occurs.
  • (CVE-2018-5159) Fixed an integer overflow vulnerability in the Skia library resulting in possible out-of-bounds writes.
  • (CVE-2018-5154) Fixed a use-after-free vulnerability while enumerating attributes during SVG animations with clip paths.
  • (CVE-2018-5178) Fixed a buffer overflow during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the use of a malicious or vulnerable extension in order to occur.
  • Fixed several stability issues (crashes) and memory safety hazards.
Assets 2

@wolfbeast wolfbeast released this May 7, 2018 · 159 commits to master since this release

This is a maintenance release.

Changes/fixes:

  • Removed the unused/incomplete places protocol handler.
  • Worked around an issue with MSE media without a Track ID. This should help with the playability of some live streams.
  • Ported across jemalloc improvements from UXP.
  • Ported across cairo mutex improvements from UXP.
  • Added support for FFmpeg 4.0/libavcodec 58.
  • Added a fix for Windows 10's "isAlpha()" not being what one would expect in v1803.
Assets 2

@wolfbeast wolfbeast released this Apr 17, 2018 · 171 commits to master since this release

This is the last major development update for the v27 milestone (codenamed "Tycho").
After this, we will be focusing our efforts for new features entirely on UXP and the new v28 milestone building on it. We will continue to support v27.9 with security and stability updates for a while, but no major new features will be added from this point forward.

Changes/fixes:

  • Fixed a number of spec compliance issues in our media subsystem.
  • Added a trailing slash to referrers when policy is set to fix some web compatibility issues.
  • Fixed the property order in Object.getOwnPropertyNames(string) and others for web compatibility.
  • Updated RegExp(RegExp object, flags) to the ES6 standard specification.
  • Changed the embedded font from the no longer free EmojiOne to the open-licensed Twemoji (with additional fixes). This also further extends unicode support to Unicode 10 emoji(s). Please note that as a result, color emoji(s) will look different than before.
  • Adjusted some things in our memory allocator code to provide, among other things, better allocation alignment on Windows.
  • Made the attempt to migrate people from the old sync server domain name to the current one more aggressive. We will be retiring the old pmsync.palemoon.net Sync server address shortly to remove the need for us to maintain a security certificate for it; this preference migration should automatically put everyone on the correct server address when upgrading.
  • Made reading of the sessionstore synchronous, to speed up startup and prevent the homepage from being loaded when restoring a session.
  • Added a fix to switch to the correct window/tab when a web notification is clicked.
  • Changed the placeholder text to not include "Search" when all search functions from the address bar are disabled.
  • Enabled the use of Skia for canvas on Linux and OSX.
  • Worked around a potential cause for some non-standard bitmapped fonts ending up with incorrect line heights (I'm looking at you, Noto fonts!).
  • Added a workaround for incorrectly-encoded JPEG-XR images with planar alpha. Ultimately, the jxrlib reference implementation should be fixed to encode according to spec.
  • Aligned XCTO:nosniff allowed script MIME types with the updated spec.
  • Improved the logic for storing vector images in the surface cache.
  • Fixed character set handling for XMLHttpRequests.
Assets 2

@wolfbeast wolfbeast released this Mar 28, 2018 · 237 commits to master since this release

This is a small update to solve a pervasive crash in responsive web layouts.

Assets 2

@wolfbeast wolfbeast released this Mar 22, 2018 · 237 commits to master since this release

This is a security update.

Changes/fixes:

  • Privacy fix: prevented update checks for the default theme.
  • Added a user-agent override for Dropbox to improve compatibility with their service.
  • Fixed an issue with mouseover handling related to (CVE-2018-5103). DiD
  • Disabled the Mac OSX Nano allocator. DiD
  • Fixed (CVE-2018-5129) OOB Write.
  • Updated the lz4 library to 1.8.0 to solve potential issues. DiD
  • Fixed (CVE-2018-5137) Path traversal on chrome:// URLs
  • Fixed several memory safety an synchronicity hazards.

DiD This means that the fix is "Defense-in-Depth": It is a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code, e.g. when surrounding code changes, exposing the problem, or when new attack vectors are discovered.

Assets 2
You can’t perform that action at this time.