Vulnerability in Fennec
Vulnerability in Fennec
any info on this?
edit: I just saw there's already a post
https://lemmy.sdf.org/post/24219041
It's probably related to this: https://gitlab.com/relan/fennecbuild/-/merge_requests/63
F-droid Fennec had build problems lately due to google removing big dependencies from its android package repo or whatever, so it's well out of date for now. The latest version there has at least that one well-known security problem that was in the news a few weeks ago. I don't know why you're getting notified about it now, I have it installed and didn't see that. But if you're risk-averse then you probably shouldn't currently be using it to visit websites that might be malicious.
Recent comments over there suggest that progress is being made at last.
I use mull from f-droid, and f-droid started showing that when upgrading Today to version 1.21.1. No idea why until this f-droid app upgrade.
I guess the mull issue is the same. Both fennec and mull are at the same version on f-droid, 129.0.2, and both show in their anti-features that the app contains a known security vulnerability, indicating firefox has fixed several security vulnerabilities since 130.
Is it right to hope that once fennec can get distributed on f-droid, then mull will follow? I'm not planning to move away from mull.
Thanks !
I use mull from f-droid, and f-droid started showing that when upgrading Today to version 1.21.1. No idea why until this f-droid app upgrade.
I guess the mull issue is the same. Both fennec and mull are at the same version on f-droid, 129.0.2, and both show in their anti-features that the app contains a known security vulnerability, indicating firefox has fixed several security vulnerabilities since 130.
divestOS repo is on 131.0.3 for mull
Mull too
You can install Mull via the divestos f-droid repo: https://divestos.org/pages/our_apps#repos Here's a discussion on this on a German IT security forum: https://www.kuketz-forum.de/t/sicherheitswarnung-fennec-und-mull-bei-f-droid/10025
Wasn't Fennec a couple of major revisions behind due to build issues, and one of said major revisions was a zero-day fix, so yeah, Fennec would be vulnerable.
(I dumped it about two weeks ago once I noticed that it was behind the security patch curve.)
Next time make a post 2 weeks ago. Best to voice concern over things you notice. The person who discovered the XZ backdoor did that and it caught a disaster.
Fennec being a delayed build has been a thing for years at this point: it's a pain in the ass to get built and in f-droid. I mean, just google 'fennec f-droid out of date' and you'll see people talking about this going back to 2020.
I didn't exactly find a stunning shocking unknown thing: Fennec is slow on builds, it got outdated, there was a zero-day in older Firefox versions, and so bam: there's a security issue in Fennec.
Might be worth adding the Firefox security RSS feed for anyone using Firefox or a derivative browser so that you've got the best information about issues like this.
Don't use the unpatched version. I'd uninstall it personally. I fixed mine (Mull) by switching to the Divest repo.