Firefox Zero-day (CVE-2024-9680)

[ThatBigDerp]

Recently Firefox patched the CVE-2024-9680 zero-day in the following versions:

• Firefox 131.0.2
• Firefox ESR 128.3.1
• Firefox ESR 115.16.1

Currently Mercury is based on Firefox 192.0.02 which means it's vulnerable. My suggestion is due to low update activity to switch to Firefox's ESR release due to their slower, but more stable release cycle also reducing the need for you to update Mercury, if not at least update the browser to the latest Firefox version with the vulnerabilities patched, because according to Mozilla the vulnerability is already being exploited.

[gz83]

We will update as quickly as possible, but the disclosed vulnerabilities do not immediately put your device at risk.

[ridwanpr]

It's been 1 month

[i-georgiev28]

Update: It's been confirmed it is being exploited in the wild.

[B83C]

So...

[sbrwlf]

Oct 11, 'as quick as possible'. December 9...

[garfieldairlines]

Hello, after three months the urge to get the latest version is slowly rising.

[ajaxnotmeta]

im still waiting, for now i temporarily use Firefox mainline

[sbrwlf]

Latest update to my system purged this from existence as it should

[garfieldairlines]

FYI Arch repos are now just a redirect to plain firefox due to this

[sbrwlf]

^ This is the way 👌