- tor-announce - lists.torproject.org

New Release: Tor Browser 11.5.8 (Android, Windows, macOS, Linux)
by Richard Pospesel 22 Nov '22

22 Nov '22

Tor Browser 11.5.8 is now available from the Tor Browser download page and also from our distribution directory. - https://dist.torproject.org/torbrowser/11.5.8/ This release will not be published on Google Play due to their target API level requirements. Assuming we do not run into any major problems, Tor Browser 11.5.9 will be an Android-only release that fixes this issue. Tor Browser 11.5.8 backports the following security updates from Firefox ESR 102.5 to Firefox ESR 91.13 on Windows, macOS and Linux: CVE-2022-43680: In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. CVE-2022-45403: Service Workers might have learned size of cross-origin media files CVE-2022-45404: Fullscreen notification bypass CVE-2022-45405: Use-after-free in InputStream implementation CVE-2022-45406: Use-after-free of a JavaScript Realm CVE-2022-45408: Fullscreen notification bypass via windowName CVE-2022-45409: Use-after-free in Garbage Collection CVE-2022-45410: ServiceWorker-intercepted requests bypassed SameSite cookie policy CVE-2022-45411: Cross-Site Tracing was possible via non-standard override headers CVE-2022-45412: Symlinks may resolve to partially uninitialized buffers CVE-2022-45416: Keystroke Side-Channel Leakage CVE-2022-45420: Iframe contents could be rendered outside the iframe CVE-2022-45421: Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5 Tor Browser 11.5.8 updates GeckoView on Android to Firefox ESR 102.5 and includes important security updates. Tor Browser 11.5.8 backports the following security updates from Firefox 107 to Firefox ESR 102.5 on Android: CVE-2022-45413: SameSite=Strict cookies could have been sent cross-site via intent URLs The full changelog since Tor Browser 11.5.7 is: All Platforms Update Translations Update OpenSSL to 1.1.1s Update NoScript to 11.4.12 Update tor to 0.4.7.11 Update zlib to 1.2.13 Bug tor-browser-build#40622: Update obfs4proxy to 0.0.14 in Tor Browser Windows + macOS + Linux Bug tor-browser#31064: Letterboxing is enabled in priviledged contexts too Bug tor-browser#32411: Consider adding about:tor and others to the list of pages that do not need letterboxing Bug tor-browser#41413: Backup intl.locale.requested in 11.5.x Bug tor-browser#41434: Letterboxing bypass through secondary tab (popup/popunder...) Bug tor-browser#41456: Backport ESR 102.5 security fixes to 91.13-based Tor Browser Bug tor-browser#41460: Migrate new identity and security level preferences in 11.5.8 Bug tor-browser#41463: Backport fix for CVE-2022-43680 Android Update GeckoView to 102.5.0esr Bug tor-browser#41461: Backport Android-specific 107-rr security fixes to 102.5-esr based Geckoview Build All Platforms Update Go to 1.18.8 Bug tor-browser-build#40658: Create an anticensorship team keyring Bug tor-browser-build#40690: Revert fix for zlib build break

1 0

Tor stable release 0.4.7.11
by David Goulet 10 Nov '22

10 Nov '22

Greetings, We just released the latest stable tor 0.4.7.11. As usual, we strongly recommend you upgrade. Announcement: https://forum.torproject.net/t/stable-release-0-4-7-11/5501 ChangeLog: Changes in version 0.4.7.11 - 2022-11-10 This version contains several major fixes aimed at helping defend against network denial of service. It is also extending drastically the MetricsPort for relays to help us gather more internal data to investigate performance and attacks. We strongly recommend to upgrade to this version especially for Exit relays in order to help the network defend against this ongoing DDoS. o Directory authority changes (dizum, Faravahar): - Change dizum IP address. Closes ticket 40687. - Remove Faravahar until its operator, Sina, set it back up online outside of Team Cymru network. Closes ticket 40688. o Major bugfixes (geoip data): - IPFire informed us on August 12th that databases generated after (including) August 10th did not have proper ARIN network allocations. We are updating the database to use the one generated on August 9th, 2022. Fixes bug 40658; bugfix on 0.4.5.13. o Major bugfixes (onion service): - Set a much higher circuit build timeout for opened client rendezvous circuit. Before this, tor would time them out very quickly leading to unnecessary retries meaning more load on the network. Fixes bug 40694; bugfix on 0.3.5.1-alpha. o Major bugfixes (OSX): - Fix coarse-time computation on Apple platforms (like Mac M1) where the Mach absolute time ticks do not correspond directly to nanoseconds. Previously, we computed our shift value wrong, which led us to give incorrect timing results. Fixes bug 40684; bugfix on 0.3.3.1-alpha. o Major bugfixes (relay): - Improve security of our DNS cache by randomly clipping the TTL value. TROVE-2021-009. Fixes bug 40674; bugfix on 0.3.5.1-alpha. o Minor feature (Mac and iOS build): - Change how combine_libs works on Darwin like platforms to make sure we don't include any `__.SYMDEF` and `__.SYMDEF SORTED` symbols on the archive before we repack and run ${RANLIB} on the archive. This fixes a build issue with recent Xcode versions on Mac Silicon and iOS. Closes ticket 40683. o Minor feature (metrics): - Add various congestion control counters to the MetricsPort. Closes ticket 40708. o Minor feature (performance): - Bump the maximum amount of CPU that can be used from 16 to 128. Note that NumCPUs torrc option overrides this hardcoded maximum. Fixes bug 40703; bugfix on 0.3.5.1-alpha. o Minor feature (relay): - Make an hardcoded value for the maximum of per CPU tasks into a consensus parameter. - Two new consensus parameters are added to control the wait time in queue of the onionskins. One of them is the torrc MaxOnionQueueDelay options which supersedes the consensus parameter. Closes ticket 40704. o Minor feature (relay, DoS): - Apply circuit creation anti-DoS defenses if the outbound circuit max cell queue size is reached too many times. This introduces two new consensus parameters to control the queue size limit and number of times allowed to go over that limit. Closes ticket 40680. o Minor feature (relay, metrics): - Add DoS defenses counter to MetricsPort. - Add congestion control RTT reset counter to MetricsPort. - Add counters to the MetricsPort how many connections, per type, are currently opened and how many were created. - Add relay flags from the consensus to the MetricsPort. - Add total number of opened circuits to MetricsPort. - Add total number of streams seen by an Exit to the MetricsPort. - Add traffic stats as in number of read/written bytes in total. - Related to ticket 40194. o Minor features (fallbackdir): - Regenerate fallback directories generated on November 10, 2022. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2022/11/10. o Minor bugfixes (authorities, sandbox): - Allow to write file my-consensus-<flavor-name> to disk when sandbox is activated. Fixes bug 40663; bugfix on 0.3.5.1-alpha. o Minor bugfixes (dirauth): - Directory authorities stop voting a consensus "Measured" weight for relays with the Authority flag. Now these relays will be considered unmeasured, which should reserve their bandwidth for their dir auth role and minimize distractions from other roles. In place of the "Measured" weight, they now include a "MeasuredButAuthority" weight (not used by anything) so the bandwidth authority's opinion on this relay can be recorded for posterity. Lastly, remove the AuthDirDontVoteOnDirAuthBandwidth torrc option which never worked right. Fixes bugs 40698 and 40700; bugfix on 0.4.7.2-alpha. o Minor bugfixes (onion service client): - A collapsing onion service circuit should be seen as an "unreachable" error so it can be retried. Fixes bug 40692; bugfix on 0.3.5.1-alpha. o Minor bugfixes (onion service): - Make the service retry a rendezvous if the circuit is being repurposed for measurements. Fixes bug 40696; bugfix on 0.3.5.1-alpha. o Minor bugfixes (relay overload statistics): - Count total create cells vs dropped create cells properly, when assessing if our fraction of dropped cells is too high. We only count non-client circuits in the denominator, but we would include client circuits in the numerator, leading to surprising log lines claiming that we had dropped more than 100% of incoming create cells. Fixes bug 40673; bugfix on 0.4.7.1-alpha. o Code simplification and refactoring (bridges): - Remove unused code related to ExtPort connection ID. Fixes bug 40648; bugfix on 0.3.5.1-alpha. Cheers! David -- hZneJUk5igeV4rJ7+XERfxw3J5MVx71fwVx6lK72yUk=

1 0

New Release: Tor Browser 11.5.7 (Windows, macOS, Linux)
by Richard Pospesel 03 Nov '22

03 Nov '22

Tor Browser 11.5.7 is now available from the Tor Browser download page and also from our distribution directory. This is a minor release for desktop platforms intended to facilitate the single-locale to multi-locale bundle upgrade coming with the 12.0 series later this month. The full changelog since Tor Browser 11.5.6 is: Windows + macOS + Linux Bug tor-browser#41413: Backup intl.locale.requested in 11.5.x

1 0

New Alpha Release: Tor Browser 12.0a4 (Android, Windows, macOS, Linux)
by Richard Pospesel 31 Oct '22

31 Oct '22

Tor Browser 12.0a4 is now available from the Tor Browser download page and also from our distribution directory. Tor Browser 12.0a4 updates Firefox on Android, Windows, macOS, and Linux to 102.4.0esr. This version includes important security updates to Firefox and GeckoView. There were no Android-specific security updates to backport from the Firefox 106 release. What's new? Tor Browser 12.0a4 includes a number of changes that require testing and feedback: Multi-locale bundles (Desktop) This is the first multi-locale release of Tor Browser Alpha for desktop. All supported languages are now included in a single bundle, and can be changed without requiring additional downloads via the Language menu in General settings. What to test: Tor Browser Alpha should default to your system language on first launch if it matches a language we support. Alpha testers are also encouraged to test changing language within about:preferences#general, and to report any new bugs with localization in general. tor-launcher migration (Desktop) Parts of the code that power tor-launcher – which starts tor within Tor Browser – have been refactored. Although this work doesn't include any changes to the user experience, those who run non-standard Tor Browser setups are encouraged to test 12.0a4 on their systems. What to test: Alpha testers who run non-standard Tor Browser setups (including, but not limited to, those who use system tor in conjunction with Tor Browser) should test starting and connecting to Tor, and report any unexpected error messages they encounter. All of the previously supported environment variables should still behave the same way as in the stable series. Onion Auth fixes (Desktop) 12.0a4 includes two fixes to Onion Service client authorization: 1. A fix to the auth window itself, which was broken in Alpha due to a regression caused by the esr102 transition: tor-browser#41344 2. Another fix to a longstanding issue with Onion Auth failing on subdomains, which has also been backported to 11.5.5: tor-browser#40465 What to test: Accessing client authorized Onion Services on both top-level and subdomains. Always prioritize .onion sites (Android) Android users can now enable automatic Onion-Location redirects by switching "Prioritize .onion sites" within Privacy and Security settings. What to test: Enable "Prioritize .onion sites" within settings, visit a website that supports Onion-Location, and verify that you were redirected to the website's .onion address. Unified Español locale (Desktop and Android) Previous versions of Tor Browser Alpha were available in both "es" and "es-AR" (Español Argentina) locales. In Tor Browser 12.0a4 these have been unified into a single Spanish locale instead. What to test: Alpha testers who use the "es-AR" locale should be automatically switched to "es-ES" after updating. The full changelog since Tor Browser 12.0a3 is: All Plaforms Update Translations Bug tor-browser#24686: In Tor Browser context, should network.http.tailing.enabled be set to false? Bug tor-browser#27127: Audit and enable HTTP/2 push Bug tor-browser#40057: ensure that CSS4 system colors are not a fingerprinting vector Bug tor-browser#40058: ensure no locale leaks from new Intl APIs Bug tor-browser#40251: Clear obsolete prefs after torbutton!27 Bug tor-browser#40406: Remove Presentation API related prefs Bug tor-browser#40465: Onion Authentication fails when connecting to a subdomain Bug tor-browser#40491: Don't auto-pick a v2 address when it's in Onion-Location header Bug tor-browser#40494: Update Startpage and Blockchair onion search providers Bug tor-browser-build#40629: Bump snowflake version to 9ce1de4eee4e Bug tor-browser-build#40633: Remove Team Cymru hard-coded bridges Bug tor-browser-build#40646: Don't build Español AR anymore Bug tor-browser-build#40649: Update meek default bridge Bug tor-browser-build#40654: Enable uTLS and use the full bridge line for snowflake Bug tor-browser-build#40665: Snowflake bridge parameters are too long (535 bytes) in 11.5.5 Bug tor-browser#41098: Compare Tor Browser's and GeckoView's profiles Bug tor-browser#41154: Review Mozilla 1765167: Deprecate Cu.import Bug tor-browser#41164: Add some #define for the base-browser section Bug tor-browser#41306: Typo "will not able" in "Tor unexpectedly exited" dialog Bug tor-browser#41317: Tor Browser leaks banned ports in network.security.ports.banned Bug tor-browser#41326: Update preference for remoteRecipes Bug tor-browser#41345: fonts: windows whitelist contains supplemental fonts Bug tor-browser#41398: Disable Web MIDI API Windows + macOS + Linux Update Firefox to 102.4.0esr Bug tor-browser#17400: Decide how to use the multi-lingual Tor Browser in the alpha/release series Bug tor-browser-build#40638: Visit our website link after build-to-build upgrade in Nightly channel points to old v2 onion Bug tor-browser-build#40648: Do not customize update.locale in multi-lingual builds Bug tor-browser#40853: use Subprocess.jsm to launch tor Bug tor-browser#40933: Migrate remaining tor-launcher functionality to tor-browser Bug tor-browser#41117: Review Mozilla 1512851: Add Share Menu to File Menu on macOS Bug tor-browser#41323: Tor-ify notification bar gradient colors (branding) Bug tor-browser#41337: Add a title to the new identity confirmation Bug tor-browser#41342: Update the New Identity dialog to the proton modal style Bug tor-browser#41344: Authenticated Onion Services do not prompt for auth key in 12.0 alpha series Bug tor-browser#41352: Update or drop the show manual logic in torbutton Bug tor-browser#41369: Consider a different list-order for locales in language menu Bug tor-browser#41374: Missing a few torconnect strings in the DTD Bug tor-browser#41377: Hide Search for more languages... from Language selector in multi-locale build Bug tor-browser#41385: Bootstrap failure is logged but not raised up to about:torconnect Bug tor-browser#41386: The new tor-launcher has a problem when another Tor is running Bug tor-browser#41387: New identity and new circuit ended up inside history Bug tor-browser#41400: Missing onionAuthViewKeys causes "Onion Services Keys" dialog to be empty. Bug tor-browser#41401: Missing some mozilla icons because we still loading them from "chrome://browser/skin" rather than "chrome://global/skin/icons" Bug tor-browser#41404: Fix blockchair-onion search extension Windows Bug tor-browser#41149: Review Mozilla 1762576: Firefox is not allowing Symantec DLP to inject DLL into the browser for Data Loss Prevention software Bug tor-browser#41278: Create Tor Browser styled pdf logo similar to the vanilla Firefox one macOS Bug tor-browser#41294: Bookmarks manager broken in 12.0a2 on MacOS Bug tor-browser#41348: cherry-pick macOS OSSpinLock replacements Bug tor-browser#41370: Find a way to ship custom default bookmarks without changing language-packs on macOS Bug tor-browser#41372: "Japanese" language menu item is localised in multi-locale testbuild (on mac OS) Bug tor-browser#41379: The new tor-launcher is broken also on macOS Linux Bug tor-browser#40359: Tor Browser Launcher has Wrong Icon Android Update GeckoView to 102.4.0esr Bug tor-browser-build#40631: Stop bundling HTTPS Everywhere on Android Bug tor-browser#41360: Backport Android-specific Firefox 106 to ESR 102.4-based Tor Browser Bug tor-browser#41394: Implement a setting to always prefer onion sites Build All Platforms Update Go to 1.19.2 Bug tor-browser-build#23656: Use .mozconfig files in tor-browser repo for rbm builds Bug tor-browser-build#28754: make testbuild-android-armv7 stalls during sha256sum step Bug tor-browser-build#40397: Create a new build target to package tor daemon, pluggable transports and dependencies Bug tor-browser-build#40619: Make sure translations are taken from gitlab.tpo and not git.tpo Bug torbrowser-build#40627: Add boklm to torbutton.gpg Bug tor-browser-build#40634: Update the project/browser path in tools/changelog-format-blog-post and other files Bug tor-browser-build#40636: Remove https-everywhere from projects/browser/config Bug tor-browser-build#40639: Remove tor-launcher references Bug tor-browser-build#40643: Update Richard's key in torbutton.gpg Bug tor-browser-build#40655: Published tor-expert-bundle tar.gz files should not include their tor-browser-build build id Bug tor-browser-build#40656: Improve get_last_build_version in tools/signing/nightly/sign-nightly Bug tor-browser-build#40658: Create an anticensorship team keyring Bug tor-browser-build#40660: Update changelog-format-blog-post script to point gitlab rather than gitolite Bug tor-browser-build#40662: Make base-browser nightly build from tag Bug tor-browser-build#40671: Update langpacks URL Bug tor-browser#41308: Use the same branch for Desktop and GeckoView Bug tor-browser#41340: Opt in to some of the NIGHTLY_BUILD features Bug tor-browser#41343: Add -without-wam-sandboxed-libraries to mozconfig-linux-x86_64-dev for local builds Bug tor-browser-build#40585: Prune the manual more Bug tor-browser-build#40663: Do not ship bookmarks in tor-browser-build anymore Bug tor-browser-build#40669: Remove HTTPS-Everywhere keyring Bug tor-browser#41357: Enable browser toolbox debugging by default for dev builds macOS Bug tor-browser-build#40158: Add support for macOS AArch64 Bug tor-browser-build#40464: go 1.18 fails to build on macOS Linux Bug tor-browser-build#40659: Error building goservice for linux in nightly build Android Bug tor-browser-build#40640: Extract Gradle in the toolchain setup

1 0

New Release: Tor Browser 11.5.5 (Android, Windows, macOS, Linux)
by Richard Pospesel 27 Oct '22

27 Oct '22

Tor Browser 11.5.6 is now available from the Tor Browser download page and also from our distribution directory. This is an emergency release resolving an issue with Tor Browser 11.5.5's integration of the Snowflake pluggable transport. Users of 11.5.5 will be unable to connect to the Tor Network via the built-in Snowflake bridge until they update to 11.5.6. If you applied the following workaround to add a working Snowflake bridge manually, you may revert back to using the "Built-in" Snowflake bridge option after updating to 11.5.6. The full changelog since Tor Browser 11.5.5 is: All Plaforms Bug tor-browser-build#40665: Shorten snowflake bridge line

1 0

New Release: Tor Browser 11.5.5 (Android, Windows, macOS, Linux)
by Richard Pospesel 25 Oct '22

25 Oct '22

Tor Browser 11.5.5 is now available from the Tor Browser download page and also from our distribution directory. Tor Browser 11.5.5 backports the following security updates from Firefox ESR 102.4 to to Firefox ESR 91.13 on Windows, macOS and Linux: CVE-2022-40674: libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c CVE-2022-42927: Same-origin policy violation could have leaked cross-origin URLs CVE-2022-42928: Memory Corruption in JS Engine CVE-2022-42929: Denial of Service via window.print CVE-2022-42932: Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4 Tor Browser 11.5.5 updates GeckoView on Android to 102.4.0esr and includes important security updates. There were no Android-specific security updates to backport from the Firefox 106 release. The full changelog since Tor Browser 11.5.4 is: All Platforms Update Translations Bug tor-browser-build#40649: Update meek default bridge Bug tor-browser-build#40654: Enable uTLS and use the full bridge line for snowflake Windows + macOS + Linux Update Manual Bug tor-browser#40465: Onion Authentication fails when connecting to a subdomain Bug tor-browser#41355: Amends to YEC 2022 Takeover Desktop Stable 11.5.5 Bug tor-browser#41359: Backport ESR 102.4 security fixes to 91.13-based Tor Browser Bug tor-browser#41364: Continued amends to YEC 2022 Takeover Desktop Stable 11.5.5 Android Bug tor-browser-build#40650: Rebase geckoview-102.3.0esr-11.5-1 to ESR 102.4 Bug tor-browser#41360: Backport Android-specific Firefox 106 to ESR 102.4-based Tor Browser Bug tor-browser#41365: Amends to YEC 2022 Takeover on Android Build Windows + macOS + Linux Update Go to 1.18.7 Bug tor-browser-build#40464: go 1.18 fails to build on macOS

1 0

New Release: Tor Browser 11.5.4 (Android, Windows, macOS, Linux)
by Richard Pospesel 12 Oct '22

12 Oct '22

Tor Browser 11.5.4 is now available from the Tor Browser download page and also from our distribution directory. Our Android release follows our alpha branch to the ESR 102 release train. Please see the 12.0a2 blog post for details. Tor Browser 11.5.4 backports the following security updates from Firefox ESR 102.3 to to Firefox ESR 91.13 on Windows, macOS and Linux: CVE-2022-40959 CVE-2022-40960 CVE-2022-40958 CVE-2022-40956 CVE-2022-40962 Tor Browser 11.5.4 updates GeckoView on Android to 102.3.0esr. We also backport the following Android-specific security updates from Firefox 104 and 105: CVE-2022-36317 CVE-2022-38474 CVE-2022-40961 The full changelog since Tor Browser 11.5.3 is: All Platforms Bug tor-browser-build#40629: Bump snowflake version to 9ce1de4eee4e Bug tor-browser-build#40633: Remove Team Cymru hard-coded bridges Bug tor-browser#41326: Update preference for remoteRecipes Windows + macOS + Linux Bug tor-browser-build#40624: Change placeholder bridge addresses to make snowflake and meek work with ReachableAddresses/FascistFirewall Bug tor-browser#41303: YEC 2022 Takeover for Desktop Stable Bug tor-browser#41310: Backport ESR 102.3 security fixes to 91.13-based Tor Browser Bug tor-browser#41323: Tor-ify notification bar gradient colors (branding) Bug tor-browser#41338: The arrow on the search bar should be flipped for RTL languages Windows + macOS Bug tor-browser#41307: font whitelist typos Android Updated GeckoView to 102.3.0esr Bug tor-browser#41089: Add tor-browser build scripts + Makefile to tor-browser Bug tor-browser#41094: Enable HTTPS-Only Mode by default in Tor Browser Android Bug tor-browser#41159: Remove HTTPS-Everywhere extension from esr102-based Tor Browser Android Bug tor-browser#41166: Backport fix for CVE-2022-36317: Long URL would hang Firefox for Android (Bug 1759951) Bug tor-browser#41167: Backport fix for CVE-2022-38474: Recording notification not shown when microphone was recording on Android (Bug 1719511) Bug tor-browser#41302: YEC 2022 Takeover for Android Stable Bug tor-browser#41312: Backport Firefox 105 Android security fixes to 102.3-based Tor Browser Bug tor-browser#41314: Add YEC 2022 strings to torbutton and fenix Build System Android Update Go to 1.18.7

1 0

Tor Browser 12.0a3 is released (Android, Windows, macOS, Linux)
by Richard Pospesel 29 Sep '22

29 Sep '22

Tor Browser 12.0a3 is now available from the Tor Browser download page and also from our distribution directory. Tor Browser 12.0a3 updates Firefox on Android, Windows, macOS, and Linux to 102.3.0esr. We use this opportunity to update various other components of Tor Browser as well : NoScript 11.4.11 This version includes important security updates to Firefox. We also backport the following Android-specific security updates from Firefox 105: CVE-2022-40961 Additionally, the HTTPS-Everywhere extension has been removed and its functionality replaced with HTTP-Only mode on Android. The full changelog since Tor Browser 12.0a2 is: All Platforms Update Firefox to 102.3.0esr Update NoScript to 11.4.11 Update Translations Bug tor-browser-build#40624: Change placeholder bridge addresses to make snowflake and meek work with ReachableAddresses/FascistFirewall Bug tor-browser#41125: Review Mozilla 1732792: retry polling requests without proxy Windows + macOS + Linux Bug tor-browser#41116: Review Mozilla 1226042: add support for the new 'system-ui' generic font family Bug tor-browesr#41283: Toolbar buttons missing their label attribute Bug tor-browser#41284: Stray security-level- fluent ids Bug tor-browser#41287: New identity button inactive if added after customization Bug tor-browser#41292: moreFromMozilla pane in about:preferences in 12.0a2 Bug tor-browser#41307: font whitelist typos Linux Bug tor-browser-build#40626: Define the replacements for generic families on Linux Bug tor-browser#41163: Fixing loading of bundled fonts on linux Android Bug tor-browser#41159: Remove HTTPS-Everywhere extension from esr102-based Tor Browser Android Bug tor-browser#41312: Backport Firefox 105 Android security fixes to 102.3-based Tor Browser Build System All Platforms Bug tor-browser-build#40587: Migrate tor-browser-build configs from gitolite to gitlab repos Bug tor-browser#41321: Delete various master branches after automated build/testing scripts are updated Linux Bug tor-browser-build#40621: Update namecoin patches for linted TorButton Android Bug tor-browser#41304: Add Android-specific targets to makefiles

1 0

Tor Browser 12.0a2 released
by Richard Pospesel 10 Sep '22

10 Sep '22

Tor Browser 12.0a2 is now available from the Tor Browser download page and also from our distribution directory. This marks our first alpha on the Firefox ESR 102 series, and our first Android released based on the Firefox ESR (Extended Support Release) series. In the past, our Tor Browser for Android releases have been based on the Firefox Rapid Release schedule. Going forward, Tor Browser for Android will be based on the latest Firefox ESR (same as our Windows, macOS and Linux releases) and we will be back-porting Android-specific security updates from the Rapid Release branches. This updated release schedule should allow us to improve the general stability of Tor Browser for Android and be more confident in our releases going forward. Tor Browser 12.0a2 updates Firefox on Android, Windows, macOS, and Linux to 102.2.0esr. We use this opportunity to update various other components of Tor Browser as well : Tor 0.4.7.10 Tor Launcher 0.2.39 (Desktop only) NoScript 11.4.10 Go 1.18.5 (Android only) This version includes important security updates to Firefox. We also backport the following Android-specific security updates: CVE-2022-36317 CVE-2022-38474 Notably, we have also enabled HTTPS-Only mode for Tor Browser for Android (this feature is already enabled for Desktop). This feature, when enabled, overrides HTTPS-Everywhere functionality. For now this can be reverted in the 'Settings > Privacy and security' pane( see: https://gitlab.torproject.org/tpo/applications/fenix/-/merge_requests/151 ). The full changelog since Tor Browser 12.0a1 is: All Platforms Update Firefox to 102.2.0esr Update Tor to 0.4.7.10 Update NoScript to 11.4.10 Update Translations Bug tor-browser#40242: Tor Browser has two default bridges that share a fingerprint, and Tor ignores one Windows + macOS + Linux Update Tor-Launcher to 0.2.39 Update Manual Bug tor-browser-build#40580: Add support for uk (ukranian) locale Bug tor-browser-buid#40595: Migrate to 102 on desktop Bug tor-browser#41075: The Tor Browser is showing caution sign but your document said it won't Bug tor-browser#41089: Add tor-browser build scripts + Makefile to tor-browser macOS Bug tor-browser#41108: Remove privileged macOS installation from 102 Android Bug fenix#40225: Bundled extensions don't get updated with Android Tor Browser updates (they stay stuck at the first installed version) Bug tor-browser#41094: Enable HTTPS-Only Mode by default in Tor Browser Android Bug tor-browser#41156: User-installed addons are broken on Android Bug tor-browser#41166: Backport fix for CVE-2022-36317: Long URL would hang Firefox for Android (Bug 1759951) Bug tor-browser#41167: Backport fix for CVE-2022-38474: Recording notification not shown when microphone was recording on Android (Bug 1719511) Build System All Platforms Bug tor-browser-build#40407: Bump binutils version to pick up security improvements for Windows users Bug tor-browser-build#40591: Rust 1.60 not working to build 102 on Debian Jessie Bug tor-browser-build#40592: Consider re-using our LLVM/Clang to build Rust Bug tor-browser-build#40593: Update signing scripts to take into account new project names and layout Bug tor-browser-build#40607: Add alpha-specific release prep template Bug tor-browser-build#40610: src-*.tar.xz tarballs are missing in https://dist.torproject.org/torbrowser/12.0a1/ Bug tor-browser-build#40612: Migrate Release Prep template to Release Prep - Stable Windows + macOS + Linux Bug tor-browser#41099: Update+comment the update channels in update_responses.config.yaml Windows Bug tor-browser-buid#29318: Use Clang for everything on Windows Bug tor-browser-build#29321: Use mingw-w64/clang toolchain to build tor Bug tor-browser-build#29322: Use mingw-w64/clang toolchain to build OpenSSL Bug tor-browser-build#40409: Upgrade NSIS to 3.08 macOS Bug tor-browser-build#40605: Reworked the macOS toolchain creation Bug tor-browser-build#40620: Update macosx-sdk to 11.0 Linux Bug tor-browser-build#31321: Add cc -> gcc link to projects/gcc Android Update Go to 1.18.5 Bug tor-browser-build#40574: Improve tools/signing/android-signing Bug tor-browser-build#40582: Prepared TBA to use Mozilla 102 components Bug tor-browser-build#40604: Bug 40604: Fix binutils build on android

1 0

Tor Browser 11.5.2 released
by Richard Pospesel 29 Aug '22

29 Aug '22

Tor Browser 11.5.2 is now available from the Tor Browser download page and also from our distribution directory. Tor Browser 11.5.2 updates Firefox on Windows, macOS, and Linux to 91.13.0esr. This version includes important security updates to Firefox: https://www.mozilla.org/en-US/security/advisories/mfsa2022-35/ We use the opportunity as well to update various other components of Tor Browser: Tor 0.4.7.10 NoScript 11.4.9 The full changelog since Tor Browser 11.5.1 is: All Platforms Update Tor to 0.4.7.10 Update NoScript to 11.4.9 Windows + macOS + Linux Update Firefox to 91.13.0esr Bug tor-browser#27719: Treat unsafe renegotiation as broken Bug tor-browser#40242: Tor Browser has two default bridges that share a fingerprint, and Tor ignores one Bug tor-browser#41067: Cherry-pick fixes for HTTPS-Only mode Bug tor-browser#41070: Google vanished from default search options from 11.0.10 onwards Bug tor-browser#41075: The Tor Browser is showing caution sign but your document said it won't Bug tor-browser#41089: Add tor-browser build scripts + Makefile to tor-browser Bug tor-browser#41095: "Learn more" link in onboarding slideshow still points to 11.0 release post Build System Windows + macOS + Linux Update Go to 1.17.3 Android Update Go to 1.18.5

1 0