"We found a vulnerability..."
"We found a vulnerability..."
Can I get more info on why these are showing up? I've never seen such a thing on F-Droid before.
The current version has a critical security vulnerability (https://www.mozilla.org/en-US/security/advisories/mfsa2024-51/) but to fix it the new version compiled against libclang version 27 but Google decided to remove it from Android so the building pipeline needs to be adjusted.
There's a long discussion: https://gitlab.com/relan/fennecbuild/-/merge_requests/63 , about building the newer version
In the meanwhile the app is a security hazard.
There was a critical vulnerability found on Firefox some days ago: CVE-2024-9680. Fennec and Mull are forks of Firefox. They both fixed this issue already in their source code, BUT there is a problem preventing F-Droid from building these updated, fixed versions.
In the case of Mull, you can download the updated version from the DivestOS F-Droid repository: https://divestos.org/fdroid/official/, but if you are currently using the F-Droid version you will need to uninstall it first, since they have different signatures.
Fennec and Mull 129.0.2 in F-Droid.org repository have 42 known security issues
Ref: https://forum.f-droid.org/t/fennec-vulnerability-recommended-to-uninstall/
The issue preventing updates should be resolved soon thanks to @linsui fixing it!
What is wrong with updating?
it was mentioned in a This Week In F-droid blog post around September. basically google fucked up an important development library, and any firefox forks (possibly some other apps too) could not be built anymore normally. of course google was unwilling to fix the issue, so linsui (and F-droid member) fixed the build process somehow, possibly temporarily.
you may ask how is this not a problem for the official release of the firefox app, and my answer is that they probably build this component for themselves, and fixed the problem in house (if they had it at all)
There should really be push notifications around installed apps with known vulns... Its tracked here: https://forum.f-droid.org/t/vulnerability-warnings-in-f-droid-app/20505
Could someone with a gitlab account open a feature request on the f droid repo?
I tried to open an account but it required email + cell phone (it picked up my VoIP number) and a credit card....
EDIT: I generated an RSS feed based off of Mozilla's known vuln list. If anyone knows of a better way to do this, please let me know!
Uninstalling my primary browser isn't really a practical solution, what am I supposed to use, Chrome? How about fixing the version they're shipping? Or should I be looking somewhere other than F-Droid for Android Firefox?
Theyre the distributor, the dont fix apps and its not their job to do so. Getting the same app from a different source wont change anything
huh? no one's asking them to fix firefox, we're asking that they just ship the latest version.
the warning states that several vulnerabilities have been fixed since firefox version 130, f-droid's latest version of the package is 129: that very much makes it sound like the problem is wholly caused by f-droid not making version 130 available.
Or should I be looking somewhere other than F-Droid for Android Firefox?
FFUpdater, on F-Droid, manages updates for Firefox and other browsers. I counted nine variations of Firefox or forks of Firefox. As well as eight variations of Chromium based browsers that aren't Chrome. So that's 17 options.
Iceraven is a Mozilla based standin.
Can install FFUpdater here:
https://f-droid.org/packages/de.marmaro.krt.ffupdater/
and then select it from there.
Are these two from the same maintainer? If not, considering that they both use Firefox Android as their base, does this mean there is a vulnerability in Firefox Android?
There was and it was fixed by the looks of it. Guessing these apps have not urgently pulled the fixes in and released an update, so F-droid is urging people not to use the apps until so
they pulled the fixes, but couldn't build because google fucked up the NDK. my other comment has more details
Yes, there was a remote code execution vulnerability in the CSS engine of firefox a little while ago. If you're on desktop version 131 or lower, update to 131.0.3 when possible. I don't know how the versioning works for the Android versions here...
What would people recommend in the short run as an alternative?
You can download an updated version of Mull with the security issue fixed, from the DivestOS F-Droid repository: https://divestos.org/fdroid/official/. If you currently have the F-Droid version of Mull installed you will need to uninstall it first.
You can get the updated mull from the divestos repo, the issue is fixed there
For more frequent mull updates you can use DivestOS Official repo
It doesn't say anything like that in Droid-ify. I don't remember any recent reports of vulnerabilities either.
Sounds like Droidify is missing F-Droid features. More info on the web.
Im not getting it on f droid
if you activated divestOS repos on droid-ify than you probably have the fixed update
We at least it got pulled
It us still there
Why is the F-Droid community on lemmy.ml??? (●´⌓`●)
Its a nice feature
Many apps need security patches from time to time and web browsers tend to need the most security updates outside of the OS.
As far as security goes please use a up to date browser. I would recommend using the official repo for each of those apps.
Competition.
i genuinely don't know what this is even supposed to mean
f-droid got paid by mozilla to add that warning, so that people switch to the normal version of firefox...... it's obvious....... /s
edit: dang not even the /s is enough :{