firefox 91.13.0 までのリリース内容まとめ

https://www.mozilla.org/en-US/firefox/91.0.1/releasenotes/

Fixed an issue causing buttons on the tab bar to be resized when loading certain websites
- https://bugzilla.mozilla.org/show_bug.cgi?id=1704404
Fixed an issue which caused tabs from private windows to be visible in non-private windows when viewing switch-to-tab results in the address bar panel
- https://bugzilla.mozilla.org/show_bug.cgi?id=1720369
CVE-2021-29991: Header Splitting possible with HTTP/3 Responses
- https://bugzilla.mozilla.org/show_bug.cgi?id=1724896

https://www.mozilla.org/en-US/firefox/91.0.2/releasenotes/

High Contrast Mode is no longer enabled by default when "Increase Contrast" is checked in macOS settings
- https://bugzilla.mozilla.org/show_bug.cgi?id=1726606
Firefox no longer clears authentication data when purging trackers, to avoid repeatedly prompting for a password
- https://bugzilla.mozilla.org/show_bug.cgi?id=1721084

https://www.mozilla.org/en-US/firefox/91.1.0/releasenotes/

CVE-2021-38492: Navigating to mk: URL scheme could load Internet Explorer
- https://bugzilla.mozilla.org/show_bug.cgi?id=1721107
CVE-2021-38495: Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1

https://www.mozilla.org/en-US/firefox/91.2.0/releasenotes/

CVE-2021-38496: Use-after-free in MessageTask
- https://bugzilla.mozilla.org/show_bug.cgi?id=1725335
CVE-2021-38497: Validation message could have been overlaid on another origin
- https://bugzilla.mozilla.org/show_bug.cgi?id=1726621
CVE-2021-38498: Use-after-free of nsLanguageAtomService object
- https://bugzilla.mozilla.org/show_bug.cgi?id=1729642
CVE-2021-32810: Data race in crossbeam-deque
- https://bugzilla.mozilla.org/show_bug.cgi?id=1729813
CVE-2021-38500: Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15, and Firefox ESR 91.2
- https://bugzilla.mozilla.org/show_bug.cgi?id=1728321
- https://bugzilla.mozilla.org/show_bug.cgi?id=1725854
CVE-2021-38501: Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2

https://www.mozilla.org/en-US/firefox/91.3.0/releasenotes/

CVE-2021-38503: iframe sandbox rules did not apply to XSLT stylesheets
- https://bugzilla.mozilla.org/show_bug.cgi?id=1729517
CVE-2021-38504: Use-after-free in file picker dialog
- https://bugzilla.mozilla.org/show_bug.cgi?id=1730156
CVE-2021-38505: Windows 10 Cloud Clipboard may have recorded sensitive user data
- https://bugzilla.mozilla.org/show_bug.cgi?id=1730194
CVE-2021-38506: Firefox could be coaxed into going into fullscreen mode without notification or warning
- https://bugzilla.mozilla.org/show_bug.cgi?id=1730750
CVE-2021-38507: Opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports
- https://bugzilla.mozilla.org/show_bug.cgi?id=1730935
CVE-2021-43535: Use-after-free in HTTP2 Session object
- https://bugzilla.mozilla.org/show_bug.cgi?id=1667102
CVE-2021-38508: Permission Prompt could be overlaid, resulting in user confusion and potential spoofing
- https://bugzilla.mozilla.org/show_bug.cgi?id=1366818
CVE-2021-38509: Javascript alert box could have been spoofed onto an arbitrary domain
- https://bugzilla.mozilla.org/show_bug.cgi?id=1718571
CVE-2021-38510: Download Protections were bypassed by .inetloc files on Mac OS
- https://bugzilla.mozilla.org/show_bug.cgi?id=1731779
CVE-2021-43534: Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3

https://www.mozilla.org/en-US/firefox/91.4.0/releasenotes/

Firefox PDF viewer now supports filling more forms (XFA-based forms, used by multiple governments and banks)
- https://support.mozilla.org/kb/view-pdf-files-firefox-or-choose-another-viewer#w_fill-out-forms-in-pdf-viewer
CVE-2021-43536: URL leakage when navigating while executing asynchronous function
- https://bugzilla.mozilla.org/show_bug.cgi?id=1730120
CVE-2021-43537: Heap buffer overflow when using structured clone
- https://bugzilla.mozilla.org/show_bug.cgi?id=1738237
CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both
- https://bugzilla.mozilla.org/show_bug.cgi?id=1739091
CVE-2021-43539: GC rooting failure when calling wasm instance methods
- https://bugzilla.mozilla.org/show_bug.cgi?id=1739683
CVE-2021-43541: External protocol handler parameters were unescaped
- https://bugzilla.mozilla.org/show_bug.cgi?id=1696685
CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler
- https://bugzilla.mozilla.org/show_bug.cgi?id=1723281
CVE-2021-43543: Bypass of CSP sandbox directive when embedding
- https://bugzilla.mozilla.org/show_bug.cgi?id=1738418
CVE-2021-43545: Denial of Service when using the Location API in a loop
- https://bugzilla.mozilla.org/show_bug.cgi?id=1720926
CVE-2021-43546: Cursor spoofing could overlay user interface when native cursor is zoomed
- https://bugzilla.mozilla.org/show_bug.cgi?id=1737751
CVE-2021-4129: Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4

https://www.mozilla.org/en-US/firefox/91.4.1/releasenotes/

Fixed frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING error messages when trying to connect to various microsoft.com domains
- https://bugzilla.mozilla.org/1745600

https://www.mozilla.org/en-US/firefox/91.5.0/releasenotes/

CVE-2022-22746: Calling into reportValidity could have lead to fullscreen window spoof
- https://bugzilla.mozilla.org/show_bug.cgi?id=1735071
CVE-2022-22743: Browser window spoof using fullscreen mode
- https://bugzilla.mozilla.org/show_bug.cgi?id=1739220
CVE-2022-22742: Out-of-bounds memory access when inserting text in edit mode
- https://bugzilla.mozilla.org/show_bug.cgi?id=1739923
CVE-2022-22741: Browser window spoof using fullscreen mode
- https://bugzilla.mozilla.org/show_bug.cgi?id=1740389
CVE-2022-22740: Use-after-free of ChannelEventQueue::mOwner
- https://bugzilla.mozilla.org/show_bug.cgi?id=1742334
CVE-2022-22738: Heap-buffer-overflow in blendGaussianBlur
- https://bugzilla.mozilla.org/show_bug.cgi?id=1742382
CVE-2022-22737: Race condition when playing audio files
- https://bugzilla.mozilla.org/show_bug.cgi?id=1745874
CVE-2021-4140: Iframe sandbox bypass with XSLT
- https://bugzilla.mozilla.org/show_bug.cgi?id=1746720
CVE-2022-22748: Spoofed origin on external protocol launch dialog
- https://bugzilla.mozilla.org/show_bug.cgi?id=1705211
CVE-2022-22745: Leaking cross-origin URLs through securitypolicyviolation event
- https://bugzilla.mozilla.org/show_bug.cgi?id=1735856
CVE-2022-22744: The 'Copy as curl' feature in DevTools did not fully escape website-controlled data, potentially leading to command injection
- https://bugzilla.mozilla.org/show_bug.cgi?id=1737252
CVE-2022-22747: Crash when handling empty pkcs7 sequence
- https://bugzilla.mozilla.org/show_bug.cgi?id=1735028
CVE-2022-22739: Missing throttling on external protocol launch dialog
- https://bugzilla.mozilla.org/show_bug.cgi?id=1744158
CVE-2022-22751: Memory safety bugs fixed in Firefox 96 and Firefox ESR 91.5

https://www.mozilla.org/en-US/firefox/91.5.1/releasenotes/

Fixed an issue that allowed unexpected data to be submitted in some of our search telemetry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1752317

https://www.mozilla.org/en-US/firefox/91.6.0/releasenotes/

CVE-2022-22753: Privilege Escalation to SYSTEM on Windows via Maintenance Service
- https://bugzilla.mozilla.org/show_bug.cgi?id=1732435
CVE-2022-22754: Extensions could have bypassed permission confirmation during update
- https://bugzilla.mozilla.org/show_bug.cgi?id=1750565
CVE-2022-22756: Drag and dropping an image could have resulted in the dropped object being an executable
- https://bugzilla.mozilla.org/show_bug.cgi?id=1317873
CVE-2022-22759: Sandboxed iframes could have executed script if the parent appended elements
- https://bugzilla.mozilla.org/show_bug.cgi?id=1739957
CVE-2022-22760: Cross-Origin responses could be distinguished between script and non-script content-types
- https://bugzilla.mozilla.org/show_bug.cgi?id=1740985
- https://bugzilla.mozilla.org/show_bug.cgi?id=1748503
CVE-2022-22761: frame-ancestors Content Security Policy directive was not enforced for framed extension pages
- https://bugzilla.mozilla.org/show_bug.cgi?id=1745566
CVE-2022-22763: Script Execution during invalid object state
- https://bugzilla.mozilla.org/show_bug.cgi?id=1740534
CVE-2022-22764: Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6

https://www.mozilla.org/en-US/firefox/91.6.1/releasenotes/

CVE-2022-26485: Use-after-free in XSLT parameter processing
- https://bugzilla.mozilla.org/show_bug.cgi?id=1758062
CVE-2022-26486: Use-after-free in WebGPU IPC Framework
- https://bugzilla.mozilla.org/show_bug.cgi?id=1758070

https://www.mozilla.org/en-US/firefox/91.7.0/releasenotes/

CVE-2022-26383: Browser window spoof using fullscreen mode
- https://bugzilla.mozilla.org/show_bug.cgi?id=1742421
CVE-2022-26384: iframe allow-scripts sandbox bypass
- https://bugzilla.mozilla.org/show_bug.cgi?id=1744352
CVE-2022-26387: Time-of-check time-of-use bug when verifying add-on signatures
- https://bugzilla.mozilla.org/show_bug.cgi?id=1752979
CVE-2022-26381: Use-after-free in text reflows
- https://bugzilla.mozilla.org/show_bug.cgi?id=1736243
CVE-2022-26386: Temporary files downloaded to /tmp and accessible by other local users
- https://bugzilla.mozilla.org/show_bug.cgi?id=1752396

https://www.mozilla.org/en-US/firefox/91.7.1/releasenotes/

Yandex and Mail.ru have been removed as optional search providers in the drop-down search menu in Firefox.

https://www.mozilla.org/en-US/firefox/91.8.0/releasenotes/

CVE-2022-1097: Use-after-free in NSSToken objects
- https://bugzilla.mozilla.org/show_bug.cgi?id=1745667
CVE-2022-28281: Out of bounds write due to unexpected WebAuthN Extensions
- https://bugzilla.mozilla.org/show_bug.cgi?id=1755621
CVE-2022-1196: Use-after-free after VR Process destruction
- https://bugzilla.mozilla.org/show_bug.cgi?id=1750679
CVE-2022-28282: Use-after-free in DocumentL10n::TranslateDocument
- https://bugzilla.mozilla.org/show_bug.cgi?id=1751609
CVE-2022-28285: Incorrect AliasSet used in JIT Codegen
- https://bugzilla.mozilla.org/show_bug.cgi?id=1756957
CVE-2022-28286: iframe contents could be rendered outside the border
- https://bugzilla.mozilla.org/show_bug.cgi?id=1735265
CVE-2022-24713: Denial of Service via complex regular expressions
- https://bugzilla.mozilla.org/show_bug.cgi?id=1758509
CVE-2022-28289: Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8

https://www.mozilla.org/en-US/firefox/91.9.0/releasenotes/

CVE-2022-29914: Fullscreen notification bypass using popups
- https://bugzilla.mozilla.org/show_bug.cgi?id=1746448
CVE-2022-29909: Bypassing permission prompt in nested browsing contexts
- https://bugzilla.mozilla.org/show_bug.cgi?id=1755081
CVE-2022-29916: Leaking browser history with CSS variables
- https://bugzilla.mozilla.org/show_bug.cgi?id=1760674
CVE-2022-29911: iframe Sandbox bypass
- https://bugzilla.mozilla.org/show_bug.cgi?id=1761981
CVE-2022-29912: Reader mode bypassed SameSite cookies
- https://bugzilla.mozilla.org/show_bug.cgi?id=1692655
CVE-2022-29917: Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9
- https://bugzilla.mozilla.org/show_bug.cgi?id=1753298

https://www.mozilla.org/en-US/firefox/91.9.1/releasenotes/

CVE-2022-1802: Prototype pollution in Top-Level Await implementation
- https://bugzilla.mozilla.org/show_bug.cgi?id=1770137
CVE-2022-1529: Untrusted input used in JavaScript object indexing, leading to prototype pollution
- https://bugzilla.mozilla.org/show_bug.cgi?id=1770048

https://www.mozilla.org/en-US/firefox/91.10.0/releasenotes/

CVE-2022-31736: Cross-Origin resource's length leaked
- https://bugzilla.mozilla.org/show_bug.cgi?id=1735923
CVE-2022-31737: Heap buffer overflow in WebGL
- https://bugzilla.mozilla.org/show_bug.cgi?id=1743767
CVE-2022-31738: Browser window spoof using fullscreen mode
- https://bugzilla.mozilla.org/show_bug.cgi?id=1756388
CVE-2022-31739: Attacker-influenced path traversal when saving downloaded files
- https://bugzilla.mozilla.org/show_bug.cgi?id=1765049
CVE-2022-31740: Register allocation problem in WASM on arm64
- https://bugzilla.mozilla.org/show_bug.cgi?id=1766806
CVE-2022-31741: Uninitialized variable leads to invalid memory read
- https://bugzilla.mozilla.org/show_bug.cgi?id=1767590
CVE-2022-31742: Querying a WebAuthn token with a large number of allowCredential entries may have leaked cross-origin information
- https://bugzilla.mozilla.org/show_bug.cgi?id=1730434
CVE-2022-31747: Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10

https://www.mozilla.org/en-US/firefox/91.11.0/releasenotes/

CVE-2022-34479: A popup window could be resized in a way to overlay the address bar with web content
- https://bugzilla.mozilla.org/show_bug.cgi?id=1745595
CVE-2022-34470: Use-after-free in nsSHistory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1765951
CVE-2022-34468: CSP sandbox header without allow-scripts can be bypassed via retargeted javascript: URI
- https://bugzilla.mozilla.org/show_bug.cgi?id=1768537
CVE-2022-34481: Potential integer overflow in ReplaceElementsAt
- https://bugzilla.mozilla.org/show_bug.cgi?id=1497246
CVE-2022-31744: CSP bypass enabling stylesheet injection
- https://bugzilla.mozilla.org/show_bug.cgi?id=1757604
CVE-2022-34472: Unavailable PAC file resulted in OCSP requests being blocked
- https://bugzilla.mozilla.org/show_bug.cgi?id=1770123
CVE-2022-34478: Microsoft protocols can be attacked if a user accepts a prompt
- https://bugzilla.mozilla.org/show_bug.cgi?id=1773717
CVE-2022-2200: Undesired attributes could be set as part of prototype pollution
- https://bugzilla.mozilla.org/show_bug.cgi?id=1771381
CVE-2022-34484: Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
- https://bugzilla.mozilla.org/show_bug.cgi?id=1763634
- https://bugzilla.mozilla.org/show_bug.cgi?id=1772651

https://www.mozilla.org/en-US/firefox/91.12.0/releasenotes/

CVE-2022-36319: Mouse Position spoofing with CSS transforms
- https://bugzilla.mozilla.org/show_bug.cgi?id=1737722
CVE-2022-36318: Directory indexes for bundled resources reflected URL parameters
- https://bugzilla.mozilla.org/show_bug.cgi?id=1771774

https://www.mozilla.org/en-US/firefox/91.13.0/releasenotes/

CVE-2022-38472: Address bar spoofing via XSLT error handling
- https://bugzilla.mozilla.org/show_bug.cgi?id=1769155
CVE-2022-38473: Cross-origin XSLT Documents would have inherited the parent's permissions
- https://bugzilla.mozilla.org/show_bug.cgi?id=1771685
CVE-2022-38478: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and Firefox ESR 91.13
- https://bugzilla.mozilla.org/show_bug.cgi?id=1770630
- https://bugzilla.mozilla.org/show_bug.cgi?id=1776658

ほとんどがバグ修正で、それ以外のものでもwebviewerに関係しそうなものはなさそう？

webdino / amethyst

firefox 91.13.0 までのリリース内容まとめ #49