Hello everyone!
We are happy to announce that Tor Browser 8.0.4 is ready for testing. Bundles can be found at
https://people.torproject.org/~boklm/builds/8.0.4-build2/
This new Tor Browser version contains updates to Tor (0.3.4.9), OpenSSL (1.0.2q) and other bundle components. Most importantly, however, it is based on Firefox 60.4.0esr containing fixes to Firefox security bugs.
We backported a number of patches from our alpha series where they got some baking time. The most important ones are
1) a defense against protocol handler enumeration which should enhance our fingerprinting resistance,
2) enabling Stylo for macOS users by bypassing a reproducibility issue caused by Rust compilation and
3) setting back the sandboxing level on 5 Windows (the default), after working around some Tor Launcher interference causing a broken Tor Browser experience.
Additionally, we ship an updated donation banner for our year-end donation campaign.
The full changelog since 8.0.3 is:
Tor Browser 8.0.4 -- December 11 2018 * All platforms * Update Firefox to 60.4.0esr * Update Tor to 0.3.4.9 * Update OpenSSL to 1.0.2q * Update Torbutton to 2.0.9 * Bug 28540: Use new text for 2018 donation banner * Bug 28515: Use en-US for english Torbutton strings * Translations update * Update HTTPS Everywhere to 2018.10.31 * Update NoScript to 10.2.0 * Bug 1623: Block protocol handler enumeration (backport of fix for #680300) * Bug 25794: Disable pointer events * Bug 28608: Disable background HTTP response throttling * Bug 28185: Add smallerRichard to Tor Browser * Windows * Bug 26381: about:tor page does not load on first start on Windows * Bug 28657: Remove broken FTE bridge from Tor Browser * OS X * Bug 26263: App icon positioned incorrectly in macOS DMG installer window * Bug 26475: Fix Stylo related reproducibilitiy issue * Linux * Bug 26475: Fix Stylo related reproducibilitiy issue * Bug 28657: Remove broken FTE bridge from Tor Browser * Build System * All Platforms * Bug 27218: Generate multiple Tor Browser bundles in parallel
Georg