Their project commit log shows that a developer had done the work required to update their codebase on Monday, but it still took them until Friday to push out the update. The Tor Project caters to people who need strong security and privacy, and it’s good to see them keeping up with the latest developments.Ĭliqz was slower, and took three days to release the first update, and then didn’t release the second update until I prompted them about it a week later for this article. The Tor Browser was quick to release an update for both issues. Pale Moon is a true project fork from Firefox and no longer shares the vulnerable components that were affected by the recent security issues. Both the current and EST versions of Firefox were vulnerable to the zero-day security issues. The most popular browsers unsurprisingly has the most resources to track upstream releases more closely.Ĭliqz and Waterfox ship the latest version of Firefox, and the Tor Browser ships the slightly older Extended Support Release ( ESR) version. The above table is sorted by the estimated number of active users for each web browser.
The below table shows how many hours it took after Mozilla Firefox had released an update before downstream projects released an update to address the problem:ĭownstream project hours to release after Firefox upstream release I’ll use the same Firefox derivatives I’ve featured before: Tor Browser, Cliqz, Waterfox, and Pale Moon. Mozilla released Firefox 67.0.3 and 67.0.4 two days apart to address each of these issues. The two security vulnerabilities in question, CVE-2019-11707 (MFSA-2019-18) and CVE-2019-11708 (MFSA-2019-19), were both zero-day critical security vulnerabilities that were known to be actively exploited on the web. This provided an excellent stress test and case study for how quickly Firefox derived web browsers ship security updates. Mozilla released two security updates to their open-source Firefox web browser just two days apart.
0 kommentar(er)
