https://blog.torproject.org/new-release-tor-browser-13013/
"This is an unscheduled emergency release with important security updates to Firefox for Desktop platforms. Android is unaffected."
https://www.mozilla.org/en-US/security/advisories/mfsa2024-16/#CVE-2024-29944
Mozilla Foundation Security Advisory 2024-16
Security Vulnerabilities fixed in Firefox ESR 115.9.1Announced
March 22, 2024https://www.mozilla.org/en-US/security/advisories/mfsa2024-16/#CVE-2024-29944
CVE-2024-29944: Privileged JavaScript Execution via Event Handlers
Impact critical
Description
An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, it does not affect mobile versions of Firefox.
Tails 6.0 is affected. Please update Tails 6.0 to the current version when they release it.
(Score: 2) by mcgrew on Sunday March 24 2024, @01:39PM (3 children)
And here I thought that TOR was primarily to brevent man in the middle attacks at public WiFi hotspots! You would think people were trying to hide their file sharing from the MAFIAA!
BTW, I'm having trouble getting magnet links working in Mint...
The "patriotic" Defense Secretary Hegseth carries an American flag in his jacket's snot rag pocket.
(Score: 3, Interesting) by requerdanos on Sunday March 24 2024, @04:45PM (2 children)
The number and variety of people who do their general purpose everyday computing on android (and iThing-type) devices never ceases to amaze me. I'd be lost without a real computer. And I don't even TOR.
BTW today I noticed that there was a new version of Firefox-ESR in Debian stable, presumably related to the same issue.
(Score: 2) by janrinok on Sunday March 24 2024, @05:52PM
I've just upgraded too.
(Score: 1, Informative) by Anonymous Coward on Wednesday March 27 2024, @02:02AM
Background to that issue: https://www.bleepingcomputer.com/news/security/mozilla-fixes-two-firefox-zero-day-bugs-exploited-at-pwn2own/ [bleepingcomputer.com]
tldr; related to Pwn2Own hacking contest.
(Score: 1, Informative) by Anonymous Coward on Sunday March 24 2024, @08:22PM (1 child)
Tor allows JavaScript?? Ugh! Doesn't sound very secure
(Score: 1, Informative) by Anonymous Coward on Monday March 25 2024, @02:20PM
It comes with NoScript by default.
While I am no fan of javascript and the overreliance on it, it is a necessary evil in order to interact with today's web.
(Score: 1) by slingblade on Wednesday March 27 2024, @10:27PM
Tails Linux 6.1 is out, please upgrade.