4 ms·

> This affects all Firefox users (<126) I suppose/hope this is version number and not a dig at the market share

yyhhsj0521 2y ago
126 was released just on 2024-5-14. So the majority of FF users especially those who get FF from a more stable package manager repo.
- azeemba 2y ago
  The poster was joking that it looks like there are less than 126 Firefox users
  - kevinvalk 2y ago
    Hahaha, I (OP) am actually a Firefox user myself! So this was I guess just poor writing on my part :(
- gpm 2y ago
  I'd guess reasonably confidently that the majority of firefox users, are on window or mac, got firefox from the web, have auto updates enabled, and are already on 126 (they've had a week to update at this point). With the exception of LTS releases, if you haven't got firefox 126 yet because you're on a "stable" package manager, I'd encourage you to promptly download firefox from mozilla.org (which will come with auto-updates) and uninstall your package managers insecure version. Given the state of the web and software security web browsers aren't something you should be delaying updating by a week.
  - gruez 2y ago
    >With the exception of LTS releases, if you haven't got firefox 126 yet because you're on a "stable" package manager, I'd encourage you to promptly download firefox from mozilla.org (which will come with auto-updates) and uninstall your package managers insecure version. Which distros have this problem? AFAIK debian-based distros (eg. debian, ubuntu) package firefox ESR which is kept up to date with security patches.
    - gpm 2y ago
      At one point I realized Arch's firefox was greater than a week out of date and I promptly did exactly that. I don't know if it was a regular occurrence or something weird with that release though.
    - hifromwork 2y ago
      Nixos have this problem a bit. I didn't rebuild my system in a while and my Firefox is really old at this point. Well, time to update my system.
- philsnow 2y ago
  Given the abundance of desktop electron apps, it seems maybe irresponsible to publish this blog post (with an advertisement for Codean in the middle (which itself was at least tastefully done)) only 6 days after the fix was released and the CVE was published. Yes, a fix landed in Firefox, but the vuln is in pdf.js, and now I’m giving the ol side-eye to the four or five electron apps I have running.
- TacticalCoder 2y ago
  https://security-tracker.debian.org/tracker/CVE-2024-4367 https://security-tracker.debian.org/tracker/CVE-2024-4367 It's already fixed in Debian stable (firefox-esr version 115). It's fixed by default in FF 126+. But, as I understand it, older versions like the one in Debian stable, can be (and are already) patched.

126 was released just on 2024-5-14. So the majority of FF users especially those who get FF from a more stable package manager repo.

azeemba 2y ago
The poster was joking that it looks like there are less than 126 Firefox users
- kevinvalk 2y ago
  Hahaha, I (OP) am actually a Firefox user myself! So this was I guess just poor writing on my part :(
gpm 2y ago
I'd guess reasonably confidently that the majority of firefox users, are on window or mac, got firefox from the web, have auto updates enabled, and are already on 126 (they've had a week to update at this point). With the exception of LTS releases, if you haven't got firefox 126 yet because you're on a "stable" package manager, I'd encourage you to promptly download firefox from mozilla.org (which will come with auto-updates) and uninstall your package managers insecure version. Given the state of the web and software security web browsers aren't something you should be delaying updating by a week.
- gruez 2y ago
  >With the exception of LTS releases, if you haven't got firefox 126 yet because you're on a "stable" package manager, I'd encourage you to promptly download firefox from mozilla.org (which will come with auto-updates) and uninstall your package managers insecure version. Which distros have this problem? AFAIK debian-based distros (eg. debian, ubuntu) package firefox ESR which is kept up to date with security patches.
  - gpm 2y ago
    At one point I realized Arch's firefox was greater than a week out of date and I promptly did exactly that. I don't know if it was a regular occurrence or something weird with that release though.
  - hifromwork 2y ago
    Nixos have this problem a bit. I didn't rebuild my system in a while and my Firefox is really old at this point. Well, time to update my system.
philsnow 2y ago
Given the abundance of desktop electron apps, it seems maybe irresponsible to publish this blog post (with an advertisement for Codean in the middle (which itself was at least tastefully done)) only 6 days after the fix was released and the CVE was published. Yes, a fix landed in Firefox, but the vuln is in pdf.js, and now I’m giving the ol side-eye to the four or five electron apps I have running.
TacticalCoder 2y ago
https://security-tracker.debian.org/tracker/CVE-2024-4367 https://security-tracker.debian.org/tracker/CVE-2024-4367 It's already fixed in Debian stable (firefox-esr version 115). It's fixed by default in FF 126+. But, as I understand it, older versions like the one in Debian stable, can be (and are already) patched.