பயர்பாக்ஸ் Community Forum

Hi, During some tests I found that FF 115.19.0esr can still execute arbitrary JS similarly to CVE-2024-4367. I’ve checked the versions and > 115.11esr should be patched. Any payload with ‘/JS’ taken from https://github.com/luigigubello/PayloadsAllThePDFs/tree/main will do. Since this is probably important – FontMatrix is *not* working (no JS), original PoC (https://codeanlabs.com/wp-content/uploads/2024/05/poc_generalized_CVE-2024-4367.pdf) is also *not* working. I also wasn’t able to call an external script and so far haven’t found any path to exploit it beyond an alertbox. However, it still bothers me a lot and I’d like to know whether it’s the correct, expected behavior with FF+pdf.js, is it a vulnerability, or maybe my browser was somehow corrupted or is using some other mechanism that’s not within your control (my settings? about:config?).

Steps to re-create: 1. Open file in notepad 2. Add ‘/OpenAction 99 0 R’ after ‘lang’ in ‘1 0 obj section’ 3. After ‘endobj’ add ‘99 0 obj <</Type /Action /S /JavaScript /JS (app.alert\(1\);)>>’ 4. Result – alertbox popping twice

For some reason the first item when I open my browser is google. I do not use google-I can search my browser's history and see I do not use google. How do I get it removed? There is no reason for it to pop-up in my browser at all but there is absolutely no reason for it to be the top item whenever I open my browser. Why is it even there? I always use DuckDuckGo to search.

Please help me remove google from my browser. I have attached a screenshot with my browser showing google as the first item when I open it. This is getting so frustrating when I try to avoid google like the plague...the plague it is.

Thank you very much.

I have a 2023 MacBook Pro and a Synology NAS. Fairly recently, when I have tried to access the web site for the NAS using Firefox, I have received the following error message: "Unable to connect. An error occurred during a connection to [the IP address].” I am able to access the web site using the Safari and Bing browsers, and I also am able to access the web site using Firefox on an iPad. I already have contacted Apple and Synology support personnel, and have been that the issue is not with either Apple or Synology products. Please let me of any potential solutions to this problem that Mozilla may have.

In previous versions of Firefox (up to version 133), it was possible to automatically trigger printing of a PDF file by loading it into an iframe from a sandboxed iframe and call print. However, starting with version 134, this no longer works.

Is there any other way to automatically trigger the print dialog for a PDF file in Firefox, similar to how it can be done in Chrome/Edge (e.g., by opening the PDF in a new window and directly triggering the print dialog without additional button clicks)?

My software is old. Windows 7. I know it is not supported any longer. Just started having problems loading email. Getting messages saying my Browser is not supported. Have I missed updates for FireFox?

Hello! I am developing a web server, from which users can download large files. These files take a few seconds to generate, and cannot be generated ahead-of-time; only when a user requests them. The server therefore responds to such requests by first sending the HTTP response headers (without "Content-Length"), which can be written immediately, then generating the file, and sending the generated file as the response body.

In Chromium, this leads to the "Save As..." dialog appearing instantly, so the file can be generated & downloaded in the background while the user picks a location.

In Firefox (v132, linux x64), the "Save As..." dialog waits for the file to be generated before appearing, which is not user-friendly. During deeper testing, I discovered that Firefox appears to wait for my server to send at least 1 byte of data from the file (in the response body, after sending the HTTP response headers), before the "Save As..." dialog appears.

I have searched the Firefox settings and documentation but did not find anything that would explain this behavior. Is this a bug?

Hello,

We are running Roaming Profiles from our Active Directory architecture. It seems that a lot of files happen to have too long path&filename for example :

\\Serverinfo\Username\AppData\Roaming\Mozilla\Firefox\Profiles\FirefoxUserProfile\storage\default\moz-extension+++f9efba58-d1ae-40d1-993c-f56654dc34c0^userContextId=4294967295\idb\{d1ae6e36-40f7-4f62-88b9...

Do you have any idea to configure Mozilla so we keep it able to handle these filename length ?

We cant use wildcard in exclusions so we cant exclude whats in a subfolder of each profile. It's not supported by ActiveDirectory GPO.

Hope it was understandable please let me know if you need further details.

Regards, Yannick GANTOU

I am trying to log into the indian evisa (indianvisaonline.gov.in) website to print off an ETA (Electronic Travel Authorisation) and when logging into the site I am getting a warning saying potential security risk ahead

Warning: Potential Security Risk Ahead

Firefox detected a potential security threat and did not continue to indianvisaonline.gov.in. If you visit this site, attackers could try to steal information like your passwords, emails, or credit card details.

What can you do about it?

The issue is most likely with the web site, and there is nothing you can do to resolve it.

If you are on a corporate network or using antivirus software, you can reach out to the support teams for assistance. You can also notify the web site’s administrator about the problem.

I do not know what to do for the best