Pale Moon 32.2.1

26.2.0 (2016-04-05)
This is a major update and bugfix release.
Changes:
• Implemented the URL API that's needed for a number of websites.
• Changed internal keystroke handling within the spec to better align with generally expected behavior.
This should fix the infamous "backspace" issue on Facebook.
Web developers please note: calling preventDefault() in a "keydown" event handler will now prevent most keypress events from firing.
• Linux: gstreamer 1.0 support has been implemented and enabled by default (hats off to Travis!)
From this version forward you will need to have gstreamer 1.0 libraries for video playback (0.10 is no longer supported).
• Re-styled about:sessionrestore to use more available screen real estate for tab info.
• Added an option to use the mousewheel for horizontal scrolling (mouse action value 4).
(e.g. setting mousewheel.with_shift.action to 4 makes Shift+wheel scroll horizontally)
• Bumped max icon size for search engine icons to 32 KB to cater to more common use of HiDPI icons.
• Fixed some hard-coded branding strings in Sync still reading "Firefox", and similarly changed sync information URLs to point to our relevant pages.
• Removed default profile bookmarks pointing to Firefox/Mozilla since the information there no longer applies to us.
• Updated UA overrides and XSS configuration to deal with some problematic sites (e.g.: Google, Embedly)
• Fixed several issues with the default theme causing problems with behavior due to styling (thanks, Antonius32) (Issue #384 and friends)
• Fixed some miscellaneous issues in the internal jemalloc implementation.
• Added a configure option to use the full jemalloc lib (jemalloc v3) if the builder so wishes (used for Linux, sys mallocs are not happy there either, so for our generic binaries we switched to this lib now)
• Worked around a crash caused by the XSS filter on some fora by bailing on too short and empty strings.
• Fixed layout of reflowed comboboxes without enough space.
• Fixed a crash related to flexboxes overflowing themselves. (Issue #396)
• Added a simple implementation for Weak Messagelisteners. (Issue #399)
• Fixed a crash for losing our cache entry while finishing up compression.
(re-apply after unintentional back-out switching to Goanna)
• Linux: Worked around driver bugs with Intel drivers that falsely report what they can support in max texture size.
• Portable only: Removed compression of the browser components library after some reports that in certain configurations and environments it was causing issues with the browser.
Security fixes:
• Updated the graphite font library to 1.3.7+ to solve CVE-2016-2796 and no less than 14 of its friends.
• Updated NSS to 3.19.4.2-PM to address several vulnerabilities (UAF, heap overflow).
• Updated libvorbis to a much more recent version to fix multiple issues.
• Crash fix and DiD fixes by holding strong references to objects in suspect places in the HTML parser. (CVE-2016-1961) (ZDI-CAN-3574)
• Fixed several out-of-bounds issues in the VP8 decoder.
• Fixed a potentially exploitable crash in XML/XSLT handling.
• Applied some Kung Fu to HTML animations and transitions to prevent memory hazards.
• Fixed applicable Mozilla code vulnerabilities CVE-2016-1965, CVE-2016-1960 (ZDI-CAN-3545), CVE-2016-1966, and CVE-2016-1963.

26.1.1 (2016-02-24)
This is a bugfix release to improve stability and extension compatibility.
Changes/fixes:
• Fixed a few oversights in the Firefox extension compatibility changes in 26.1.0 that should improve compatibility with a number of Firefox extensions.
• Changed memory handling to (hopefully) address the memory inflation issues some people have experienced with 26.1.0.
• Updated YouTube compatibility, which should once again allow users to choose between Flash and HTML5 players on YouTube.

_http://relmirror.pale....installer.exe

_http://relmirror.pale....installer.exe

_http://relmirror.pale....2.0.win32.exe

_http://relmirror.pale....2.0.win64.exe

26.2.1 (2016-04-08)
This is a small update to fix a problem with keyboard navigation of the user interface.

_http://relmirror.pale....installer.exe

_http://relmirror.pale....installer.exe

_http://relmirror.pale....2.1.win32.exe

_http://relmirror.pale....2.1.win64.exe

Changes/fixes:
• Added detection for dark system themes on Windows 10 and re-worked Windows 10 specific theming to better integrate into the OS and provide more clarity.
• HTML5 media controls have been reworked to a horizontal volume control on all media, including HTML5 audio that was previously without an element-control for volume.
• Default HTML5 media volume preference added as media.default_volume -- fractional, default 1.0 (=100%).
• String.prototype.match() and .replace() are now fully spec compliant.
• NSPR and NSS now correctly no longer enforce IA32 architecture compatibility, getting the advantage of SSE2 like the rest of the code.
• Worked around crashes in the XSS filter when navigating back in history due to document fragments.
• Instated a hard minimum of 10,000 places entries regardless of free disk space and total memory to prevent undesired expiration of history. That is around 16MB for an average entry size, which should be sane enough even on low-memory machines.
• Fixed a typo in networking code introduced in 26.2.2 that would cause issues on some sites due to adding extra forward slashes to the URL.
Security fixes:
• Fixed a number of memory safety hazards and potentially exploitable crashes.
• Fixed CVE-2016-2821 Use-after-free in the mozilla::dom::Element class
• Fixed netaddr deserialization for AF_UNSPEC and AF_LOCAL.
• Fixed a memory overrun error in the VP8 encoder. DiD
• Fixed non-threadsafe re-use of pixman images to prevent potential race conditions. DiD
• Fixed CVE-2016-2825 Partial Same Origin Policy violation

_http://relmirror.pale....installer.exe

_http://relmirror.pale....installer.exe

_http://relmirror.pale....3.0.win32.exe

_http://relmirror.pale....3.0.win64.exe

26.3.1 (2016-06-25)
Changes/fixes:
• Fixed an issue with new tab button theming on dark toolbars.
• Reverted the useragent identification of Firefox compatibility mode to 38.9 to avoid WOFF2 font issues for sites that don't use proper font deployment as recommended by the W3C.
• Added a site-specific override for Google fonts to make sure it always works even if not using Firefox compatibility mode.
(workaround pending for a proper solution on Google's side)
• Adjusted the "dark color" detection routine to switch text to white at higher relative contrast levels.
This will more closely match Windows 10's "flip point" for different accent colors and is within the recommended range determined by the WCAG.

_http://relmirror.pale....installer.exe

_http://relmirror.pale....installer.exe

_http://relmirror.pale....3.1.win32.exe

_http://relmirror.pale....3.1.win64.exe

26.3.2 (2016-06-27) - Windows only
This release only has pertinent changes for Windows. Other operating systems do not need this update.
Changes/fixes:
• Fixed a rare issue where the browser would not initialize properly (missing bookmarks and menu entries) if certain Windows registry values were missing (Windows 8 only).
• Fixed an issue on Windows 10 where the classic menu bar would become unreadable (white on white).
• Portable only: Switched to non-compressed binaries to prevent issues with antivirus packages, to prevent issues with browser run-time operation, and to simplify code signing..

_http://relmirror.pale....installer.exe

_http://relmirror.pale....installer.exe

_http://relmirror.pale....3.2.win32.exe

_http://relmirror.pale....3.2.win64.exe

Changes/fixes:
• Fixed an additional issue found that could cause menu text on Windows 10 to be white-on-white (and therefore unreadable).
• Fixed an issue with news feeds not showing up when embedded in web pages.
• Removed recently-added parsing of the child-src content security policy directive, after some web compatibility issues with it came to light, as well as it becoming clear that the CSP spec will see it removed in favor of the previous directive for embedded content. This should fix some intermittent issues people have reported on e.g. the main google.com page and phpMyAdmin installations.
Webmasters please note: If you wish to use CSP to control embedded content, please use frame-src.

_http://relmirror.pale....installer.exe

_http://relmirror.pale....installer.exe

_http://relmirror.pale....3.3.win32.exe

_http://relmirror.pale....3.3.win64.exe

Changes/fixes:
• Removed Google Search as a bundled search provider. If desired, you can manually install it (or other search engines) after the update by following the steps in the Manage Search Engines topic.
• Fixed the URL API to allow "stringification" of the object per specification. This should make a number of websites happy.
• Added the ES6 string .includes() function in addition to the pre-existing .contains() function for checking if a string contains another string. The .contains() function is retained for compatibility with web and extension scripts that adhere to the ES6 pre-release specification up to and including RC3.
• Fixed the calculation of standalone SVG embeds width and height, which should solve some reported issues with html5 graphs being displayed incorrectly.
• Linux: improved memory allocation.
• Updated the graphite font library to 1.3.9.
• Added a blocking rule for F-Secure's 64-bit deepguard library to prevent crashes.
• Updated the SQLite library to 3.13.0.
• Download= properties of links are now honored from the context menu "Save" option.
• Fixed a crash in the XSS filter.
• Fixed a crash in the DOM error module.
• Worked around a crash on Linux
• Linux: Improved optimization and GCC6 compatibility (Note: compiling with GCC 6 is still not recommended and it may or may not work, depending on your environment)
Security fixes:
• (CVE-2016-5251)Potential URL spoofing in the address bar.
• (CVE-2016-0718) Context-dependent crash in expat 2.1.0.
• (CVE-2016-5266) Outgoing dataTransfer items are not properly filtered.
• Fixed potentially exploitable crash in the array splice implementation.
• Fixed potentially exploitable crash caused by badly formatted ICO files.
• (CVE-2016-5254) Heap-use-after-free in nsXULPopupManager::KeyDown

_http://relmirror.pale....installer.exe

_http://relmirror.pale....installer.exe

_http://relmirror.pale....4.0.win32.exe

_http://relmirror.pale....4.0.win64.exe

This is a bugfix and security update, and adding some explicit parallel processing (more of that to come in the future).
Linux version will be updated shortly -- keep an eye on the Pale Moon for Linux board for news!
Fixes/Changes:
• Implemented a breaking CSP (content security policy) spec change; when a page with CSP is loaded over http, Pale Moon now interprets CSP directives to also include https versions of the hosts listed in CSP if a scheme (http/https) isn't explicitly listed. This breaks with CSP 1.0 which is more restrictive and doesn't allow this cross-protocol access, but is in line with CSP 2 where this is allowed.
• Fixed an issue with the XML parser where it would sometimes end up in an unknown state and throw an error (e.g. when specific networking errors would occur).
• Improved the performance of canvas poisoning by explicitly parallelizing it.
Security fixes:
• Fixed a potentially exploitable crash related to text writing direction. (CVE-2016-5280)
• Made checking for invalid PNG files more strict. Pale Moon will now reject more PNG files that have corrupted/invalid data that could otherwise lead to potential security issues.
• Changed the way paletted image frames are allocated so the space is cleared before it's used. DiD
• Fixed a crash in nsNodeUtils::CloneAndAdopt() due to a typo. DiD
• Fixed several memory safety errors.

_http://relmirror.pale....installer.exe

_http://relmirror.pale....installer.exe

_http://relmirror.pale....5.0.win32.exe

_http://relmirror.pale....5.0.win64.exe

27.1.0 (2017-02-09)
This is a major update with lots of development and bugfixes. It also introduces the so-called "PMkit" modules, our effort to restore compatibility with Jetpack/SDK extensions and making it possible for extension developers to convert their SDK extensions with little effort to a Pale Moon compatible format. For more details please check the PMkit documentation on the developer wiki.
Changes/Fixes:
• Reworked the media back-end completely (thanks Travis!) to use FFmpeg (including support for FFmpeg v3 and MP3 playback) and our own MP4 parser, and no longer relying on gstreamer on Linux, as well as adding some improvements on Windows for media parsing and playing.
• On Linux, Apple .mov files of the correct type will also be played through FFmpeg now, for those rare occasions where they are still in use, considering there is no Quicktime plug-in available on that operating system.
• Restored the classic about:config styling.
• Added a fallback to US-ASCII if the autoconfig UTF-8 conversion fails.
• Improved cross-compartment wrapper handling when managing a large number of tabs (fixes a performance regression with v27).
• Changed the way audio and video synchronization is calculated to account for (slow) device latency, preventing things from getting out of sync on e.g. BlueTooth-connected speakers.
• Changed the way scripts are handled when they are stopped from the "unresponsive script" dialog, to prevent browser lockup. We will now stop all scripts in the affected compartment in one go.
• Fixed several errors in the devtools.
• Fixed a nasty crash caused by cross-origin referrers.
• Fixed the installer to allow 64-bit versions of the browser to be installed on Vista again.
• Added HTML5-spec clipboard handling for content (cut© only -- paste is not allowed for security reasons).
• Made multiple changes to the toolkit jetpack modules to cater to PMkit extensions.
This should make running SDK-based modules as PMkit extensions fairly simple for extension developers. See the introductory text to these release notes.
• Fixed a css layout issue: make max-width affect contributions to intrinsic min-width.
• Implemented several updates to the permissions manager. Among others, Improved the permissions manager (about:permissions) with a more complete set of permissions for pages.
• Removed otherwise unused Metro browser platform/widget code.
• Removed support for non-standard/deprecated let blocks and expressions.
• Made the use of let as a keyword versionless and ES6 compliant.
• Made the privacy category in preferences a tabbed setup to better fit the current options.
• Fixed a regression preventing certain MP4 video files from playing.
• Fixed a regression where seeking in media files would halt playback/jump to the end of the stream.
• Fixed a crash caused by certain downloadable fonts with DirectWrite in use.
• Improved downloads-button indicator legibility on some combinations of Windows versions and system theme colors.
• Changed the Facebook user-agent override to be our native one, based on reports from users that it is (finally) working acceptably.
• Fixed site-specific useragents being ignored if a global override is defined.
Security/privacy changes:
• Changed CORS handling to allow data: sources, assuming they are same-origin. This should fix the infamous "Facebook endless reload" issue and may make some other sites that assume this particular (unspecified) CORS behavior happy with Pale Moon.
• Reinstated the network.stricttransportsecurity.enabled preference so people who choose privacy over HSTS can do so again.
• Added, In HSTS "off" state, prevention of HSTS site status from being written to disk.
• Updated the IDN blacklist with more extended unicode characters that "look very similar to" normal ASCII characters, to prevent spoofing of well-known domains. If blacklisted characters are found, the IDN domain name will be displayed in its punycode form. (CVE-2017-5383 and similar)
• Fixed an exploitable crash when using MP4 video. (CVE-2017-5396)
• Fixed an exploitable crash in XSL parsing. (CVE-2017-5376)
• Fixed a potential security issue when exporting certificates with specially-crafted credentials. (CVE-2017-5381)
• Fixed a potential use-after-free situation in frame selection. (CVE-2017-5380) DiD
• Fixed a leak of window details through the Ion compiler in certain situations.
• Fixed the potential for an exploitable crash involving Javascript GC. DiD
• Fixed a potential overflow situation in (non-released) WebRTC code. DiD
• Fixed a potentially unsafe situation in websockets. DiD
• Fixed several memory and other safety hazards (BMO bugs 1318766, 1325877, 1328834 DiD, 1288561 DiD, 1322420 DiD, 1293327 DiD, 1322315, 1325344, 1285960).

_http://relmirror.pale....installer.exe

_http://relmirror.pale....installer.exe

_http://relmirror.pale....1.0.win32.exe

_http://relmirror.pale....1.0.win64.exe

27.2.1 (2017-03-24)
This is a small update to fix some stability and usability issues.
Changes/fixes:
• Fixed an issue with planar alpha handling (transparency) when drawing JXR images.
• Fixed a crash related to a change JavaScript array handling introduced in 27.2.0.
This became apparent with the pentadactyl extension, but could happen in other situations as well.
• Fixed a crash when opening ridiculously large images with HQ scaling enabled (default).
Pale Moon will now only apply HQ scaling for images within reasonable limits (64 Mpix or smaller). Images larger than that may not display properly when zooming in, or may not display at all, even scaled down (e.g. >256 Mpix large) and show a "broken image" placeholder instead; please use dedicated image viewer applications for those kinds of images; it is outside the scope of a web browser to handle such large images.
• Changed the way URL hashes are handled, and will no longer %-decode anchor hash identifiers by default.
Note that this is against RFC 3986, which states that any part of the URL scheme that isn't data should be decoded.
This is required for web compatibility because several sites use hash links to pass actual data to web applications (Please don't do this! Hashes ar part of the URL address, should only consist of "safe" characters, and aren't suited to pass arbitrary data) and the most common browsers no longer follow the RFC in that respect.
If you want RFC compliance, switch dom.url.getters_decode_hash to true
• Restored 2 RSA Camellia cipher suites that were missing: TLS_RSA_WITH_CAMELLIA_128_CBC_SHA and TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
• Fixed an issue with custom toolbars getting deleted during upgrade from 27.0/27.1 to 27.2

27.2.0 (2017-03-18)
This is a major update to the browser with a focus on back-end improvements and security.
Changes/Fixes:
• Updated the ICU lib to 58.2 to fix a number of issues.
• Added proper control for the user for offline storage for web applications.
• Added a check to prevent auto-filled URLs from copying the auto-filled selection to clipboard/primary.
• Added the feature to pass a URL to open in a private window from the command-line.
• Improved the display of the downloads indicator on the button in bright-text situations.
• DOM storage now honors the "3rd party cookie" setting in that it will not allow 3rd party data to be stored if 3rd party cookies are disallowed.
• Allowed toolbar button badges to be properly styled.
• Updated the hunspell spellchecking library to 1.6.0 to fix a number of issues.
• Fixed desktop notifications being off-screen if fired in rapid succession.
• Added Element.insertAdjacentElement and Element.insertAdjacentText DOM functions.
• Added support for JPEG-XR images.
This makes Pale Moon have the broadest support for image formats of all web browsers.
(enabled by default; you can disable this with media.jxr.enabled).
• Completely removed the use of GStreamer on Linux.
• Added support for element.innerText.
• Custom toolbars should now properly remember their state.
• Fixed some more playback issues with MP4/MSE videos.
Please be aware that we are still working on further improving MSE video handling.
• Changed media processing to reduce dangerous processing asynchronicity.
This should also make media elements and playback more responsive.
• Fixed a useragent string regression always displaying the minor Goanna version as .0
• Updated NSPR to 4.13.1.
• Updated NSS to 3.28.3-RTM.
• Fixed unrestricted icon sizes in PMkit buttons.
• Fixed unresponsive buttons on support page when not building the updater.
• Fixed the use of "View image" and "Save image as" on extremely large images.
• Changed the way "View Image" and "Save image as" work on canvas elements.
• Made checking for dangerously large resolution PNG images smarter.
It will now accept larger "strip"-aspect ratio images while reducing unsupported large image resolutions.
This will e.g. fix Gmail's "emoji" window that uses a ridiculously long but very narrow single image to store all the emoticon pictures.
• Converted several hard-coded URLs to preferences.
• Updated the google.com override so it would not cripple services based on UA sniffing.
• Added Inner and Outer Window ID administration.
• Fixed the add-on discovery pane detection.
• Added support for canvas ellipse.
• Improved drawing of certain MathML elements at problematic zoom levels.
• No longer building gamepad support.
• Updated Harfbuzz font shaper to 1.4.3 to fix a number of issues.
• Fixed a number of crashes (layout, plugins, uncommon navigation, bad URLs).
• Aligned SVG specular filters with the spec.
Security/privacy changes:
• Added support for 256-bit AES-GCM encryption.
• Added support for ChaCha20-Poly1305 encryption.
• Removed support for Camellia-GCM since nobody seems interested in it.
(Camellia in 128/256-bit CBC block mode is still fully supported).
• Added support for SHA-224, SHA-256, SHA-384 and SHA-512 to Crypto utils.
• Improved status handling of secure sites to be less sensitive to "insecure" items that are local.
• Fixed print preview hijacking. (CVE-2017-5421)
• Fixed a potentially exploitable crash in OnStartRequest. (CVE-2017-5416)
• Fixed potential cross-origin content-stealing through a timing attack. (CVE-2017-5407) DiD
• Fixed a denial-of-service problem with view-source. (CVE-2017-5422)
• Fixed crash in directional controls. (CVE-2017-5413)
• Fixed a perceived problem with chrome manifests. (CVE-2017-5427)
• Fixed the use of an uninitialized value. (CVE-2017-5405)
• Fixed a buffer overflow. (CVE-2017-5412)
• Fixed a UAF situation. (CVE-2017-5403)
• Fixed a potential spoofing issue with the address bar. (CVE-2017-5417)
• Fixed a potential issue in libvpx. (CVE-2017-5402) DiD
• Fixed a potential issue with HTTP auth. (CVE-2017-5418)
• Fixed several memory safety hazards and potentially exploitable crashes. DiD
DiD This means that the fix is "Defense-in-Depth": It is a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code when surrounding code changes, exposing the problem.

27.1.2 (2017-03-03)
This is a small update adding a workaround for potential deadlocks happening in media elements.

27.1.1 (2017-02-21)
This is a stability and bugfix update to the browser.
Changes/Fixes:
• Implemented a fix in media handling to prevent crashes with concurrent videos and/or rapidly starting/stopping video playback in the browser.
• Fixed the way the Adobe Flash plugin is detected to prevent confusion with other plugins that identify themselves as "Flash" (e.g. VLC).
• Windows: Solved stability issues caused by the release build process, resulting in unexpected behavior (e.g. hangups).