I-Firefox Community Forum

Hi, During some tests I found that FF 115.19.0esr can still execute arbitrary JS similarly to CVE-2024-4367. I’ve checked the versions and > 115.11esr should be patched. Any payload with ‘/JS’ taken from https://github.com/luigigubello/PayloadsAllThePDFs/tree/main will do. Since this is probably important – FontMatrix is *not* working (no JS), original PoC (https://codeanlabs.com/wp-content/uploads/2024/05/poc_generalized_CVE-2024-4367.pdf) is also *not* working. I also wasn’t able to call an external script and so far haven’t found any path to exploit it beyond an alertbox. However, it still bothers me a lot and I’d like to know whether it’s the correct, expected behavior with FF+pdf.js, is it a vulnerability, or maybe my browser was somehow corrupted or is using some other mechanism that’s not within your control (my settings? about:config?).

Steps to re-create: 1. Open file in notepad 2. Add ‘/OpenAction 99 0 R’ after ‘lang’ in ‘1 0 obj section’ 3. After ‘endobj’ add ‘99 0 obj <</Type /Action /S /JavaScript /JS (app.alert\(1\);)>>’ 4. Result – alertbox popping twice

Hello,

So, I got the "Restart to keep using Firefox message" while working to make sure that certain HIPPA protected data. I cannot close out of the browser because I am in an incognito window.

Is there a way to pause the message or can I only prevent it by disabling automatic updates?

P.S. So I work in the very sensitive part of Data Engineering e911 that deals with medical patient reports that given ONLY to the doctor at the hospital when the fire department drops you off at a Hospital. Because of extremely sensitive nature some of the specific report fields, I am not longer legally allowed (by HIPPA as old as the law is) to use browsers like chrome. So, I have to use browser like Firefox that are still in compliance. I want Firefox to update, but I want to choose when it updates (on the first weekend when there is a national fire or storm disaster happening... which technically will be this first Saturday since the update on the 15th).

Hi there, I just got a new work laptop and tried to sync my firefox browsers so I could keep my passwords and bookmarks from my old laptop. Unfortunately I forgot my password, so I had to reset it on my new device. I logged in again on my old laptop but it's still not syncing or updating the bookmarks on the new laptop. Is there any way to move my bookmarks and passwords over to my new laptop? Thanks!

Hello to all,

I wanted to use DoH (dnsforge.de) under “maximum protection”, but with one exception: I would like Ecosia.org to be able to place ads for me, because I am convinced of Ecosia and want to support this project. Tested this with Cloudflare as well, setting up an exception here does not work either.

Now the exception set in Firefox has no effect. It should not be due to the DNS provider, because Ecosia.org is not blocked and has even been whitelisted.

What is the expected behavior of the “maximum protection” setting?

Kind regards

Is there a way to adjust the timing of notification banners being display in the lower right of my screen... I notice that notification for "X (Twitter)" only last a few seconds, which is fine... but YouTube notifications will not disappear unless I select "Dismiss". I looked at Notification setting but don't see anything that seems to address that. Thank You

Hi Win10 PC fully up to date. Changed my printer from a Xerox to an HP laser. In the control panel, set the HP as the default printer. MS Office prints on the HP without prompting. Firefox (134.0.2) always defaults to the Xerox. The HP is available in the drop down box. Restarting the PC or reloading Firefox makes no difference, Firefox always defaults to the (non existent) Xerox. MS Edge defaults to the HP. Any ideas? Regards - Andrew

is there already an AI assistant that can have full access to everything (be able to open programs, make phone calls, write complex computer code, find a recipe for cornbread, help me with metallurgical research, basically i want a professor in a can. i want my virtual assistant to continue to amass knowledge on a subject after we have had a discussion

Several of my financial accounts give me this error with Firefox. I had to go to Edge to get my tax documents. I'd much rather have a way to get to my sites without leaving Firefox.

HSTS required

Other websites may require HTTP Strict Transport Security (HSTS) and will not allow access with an insecure connection.

An errant setting on my backup program wrecked havoc on my FF profile. I have a backup from two weeks ago which I can go back to, but I'm trying to figure out how to get my browsing history from the past two weeks over to the restored profile.

Some options I thought about: and for clarity, the newer but bad profile is still loadable, I've mainly lost all my extension settings and stored data

• Is there any tool that would sync the entries from the newer/bad profile to the older/good profile?
• If I restore the older/good profile, would FF Sync just add back in the newer entries -- which presumably it has saved in it's system over the past two weeks?
• I believe the places.sqlite" file from the newer/bad profile is still intact. Should I just copy that to the older/bad profile?