Firefox: Security Advisory 2020-03

[CiotBSD]

solene@, a team member of OpenBSD informs, about the "Mozilla Foundation Security Advisory 2020-03", on Mastodon:

Dear #openbsd users, due to Firefox being too complicated to package thanks to Rust and cbindgen (too much work for no volunteer), 6.6-stable won't receive any www/mozilla-firefox update so OpenBSD 6.6 Firefox will stay vulnerable to https://www.mozilla.org/en-US/securi...s/mfsa2020-03/ (exploited in the wild!!)

On the other hand, firefox-esr is still updated so I highly recommend switching to firefox-esr if you are running 6.6-stable.

if you run OpenBSD 6.5, you are late and you should upgrade to 6.6.

Then, please switch to Firefox-ESR, or another browser web!

[CiotBSD]

Published on "OpenBSD Journal":

https://www.undeadly.org/cgi?action=...20200109141600

[victorvas]

Originally Posted by CiotBSD

... please switch to Firefox-ESR, or another browser web!

What is the best Firefox alternative besides Chromium?

[ibara]

Iridium, if that's your thing.
Any of the lightweight Webkit-based browsers are good too.

[CiotBSD]

Tonigh, always on Mastodon, solene informs:

Update #openbsd 6.6 firefox package can be downloaded at https://perso.pw/f/firefox-72.0.1.tgz if you want to test it

download it and pkg_add -Dunsigned /path/to/firefox-72.0.1.tgz

Dont forget: on stable, it runs without unveil, just only pledge!

----

I confirm: it runs!

$ doas pkg_add -D unsigned Downloads/firefox-72.0.1.tgz                                                                                                                                      
firefox-69.0.2p0->72.0.1: ok
Running tags: ok
Read shared items: ok
New and changed readme(s):
	/usr/local/share/doc/pkg-readmes/firefox

[CiotBSD]

Today, on "OpenBSD Journal", the official maintener comments his decision/intention.

In fact, solene on Mastodon claims help to test her patched version.

In order for his work to be accepted and published for stable, it's necessary to download her day version , to test the correct functioning and especially to give her a feedback. Only at thoses conditions, we're on stable this patched version !!!

If yesterday, you installed, in first delete the package and do again the install, as:

$ doas pkg_delete firefox
$ cd ~/Downloads
$ ftp https://perso.pw/firefox-72.0.1.tgz
$ doas pkg_add -D unsigned firefox-72.0.1.tgz

sha256 is 63913e85f41017506d66907e07369d4818cc048e5bd46327b9 28a1a43e5a1acc

Thanks for your help!