Updates 11/9/21 - "Microsoft Tuesday", Pale Moon

PaleMoon v29.4.2 (2021-11-09)

https://www.palemoon.org/releasenotes.shtml

This is a security update.

Changes/fixes:

• Fixed a spec compliance issue with IDN that could potentially cause confusion of domain names.
• Fixed several intermittent thread sanity issues. DiD
• Fixed a potential UAF risk in certain situations in networking. DiD
• Fixed a potential crash risk (not exposed). DiD
• Fixed a potential spoofing risk using form validation. (CVE-2021-38508)
• Fixed a script sandbox escape issue through XSLT. (CVE-2021-38503)
• Unified XUL Platform Mozilla Security Patch Summary: 3 fixed, 1 already applied, 4 DiD, 7 not applicable.

Security notice: If you have enabled HTTP Alternative Services for Opportunistic Encryption, it is strongly recommended you disable this at this time through

Tools > Preferences -> Security -> Opportunistic Encryption -> Enable HTTP Alternative Services for Opportunistic Encryption.

This inherently weak transitional technology for http -> https has been compromised and can be abused (partial opt-in bypass). Note that our platform default for this setting (and any other OE) is disabled due to these kinds of inherent risks, as well as lack of transparency about the connection and server contacted. See CVE-2021-38507 for more details about this problem.

=====================

Remark:   One of my add-ons is NoSquint, which allows me to adjust the magnification/size of the content on each page.   I typically have it set to something between 130% to 160%, making the content much easier to read.    Today's update --- on multiple machines --- reduced the "manification" to only 40%... and moreover, I could no longer implement my preferred customizations again... I could write-in the numbers, but hitting OK wouldn't do/save anything

Re:  PaleMoon & NoSquint, it seems that some people have been experiencing this issue since August 17, with the release of PM 29.4.0, which removed "the optional FUEL component".   Because of unintended consequences, PM temporarily restored the FUEL component in versions 29.4.0.1, 29.4.0.2, and 29.4.1.   But it apparently was removed again in today's 29.4.2, generating the problem I encountered.

See Non-functional since Pale Moon 29.4.0? · Issue #16 · EbonJaeger/nosquint · GitHub

Impacted users can opt to "downgrade" to an earlier PaleMoon... e.g., 29.4.1... but in so doing, lose the benefits of today's (and future) updates.

PaleMoon v29.4.2.1 (2021-11-11)

This is a small update to address the folowing issue:

Autocomplete drop-downs would have uncorrect styling, causing issues with custom themes (e.g. unreadable) and not displaying as-intended.