- MFSA 2013-102 Use-after-free in HTML document templates.
- MFSA 2013-101 Memory corruption in workers.
- MFSA 2013-100 Miscellaneous use-after-free issues found through ASAN fuzzing.
- MFSA 2013-99 Security bypass of PDF.js checks using iframes.
- MFSA 2013-98 Use-after-free when updating offline cache.
- MFSA 2013-97 Writing to cycle collected object during image decoding.
- MFSA 2013-95 Access violation with XSLT and uninitialized data.
- MFSA 2013-94 Spoofing addressbar though SELECT element.
- MFSA 2013-93 Miscellaneous memory safety hazards.
- Security + cleanup fix: No longer store empty event handlers.
- User interface: Fix for the classic downloads window having a blank title with no running downloads.
- User interface: Fix of the drop-down menu "double entry" in the all-tabs list as-a-menu setup.
- Extensions are now set to automatically update by default. Because many users fail to do the occasional check to see if there are updates available to their extensions, the default is to automatically check and install available updates to extensions from this version forward to give the best possible browsing experience. If you prefer to check manually, make sure to change the setting accordingly in your add-on manager.
It should be noted that extensions specifically marked as not compatible with Pale Moon/Firefox 24.* will not be installed, and you may still see version numbers lower than the versions marked as "latest" on addons.mozilla.org - this is correct, as it means the extension was updated for compatibility with changes in later Firefox versions (Mozilla is making a lot of UI changes that require extension updates).
- Two SSL ciphers that are considered weak are disabled by default (RSA-RC4-128-MD5 and RSA-RC4-128-SHA). If you are having trouble reaching certain encrypted sites that exclusively use these encryption methods, you should ask the site owners to update their SSL configuration to allow stronger encryption. As a workaround, you can enable the ciphers by installing the Pale Moon Commander add-on and changing the available ciphers there, or by setting security.ssl3.rsa_rc4_128_md5 and security.ssl3.rsa_rc4_128_sha to true in about:config
- When there is a web feed available on a website, Pale Moon will now display a feed indicator on the right side of the address bar to indicate that feeds are available. You can click this icon to subscribe to feeds.
If you don't want this indicator, set browser.urlbar.rss to false in about:config
- This feed indicator/button was present in older versions of Firefox but was removed because "some metrics indicated it was the least clicked element" in the UI. The conclusion was drawn that the icon, even if it also served as a visual indicator (without clicks), should be removed.* A web feed toolbar button was later introduced because of unhappy feedback by the Firefox users who actually appreciated this indicator, but in a way that's a lot less elegant. Pale Moon therefore restores this indicator/button in the address bar in this version.
- If you want to control the web feed element through CSS, use the selector #ub-feed-button
*Note that this approach has a number of flaws, the most obvious being that "if you remove the least used element, another element will become least used and eligible for removal" which would result in an interface with a single button in the end -- Another issue is that clicks aren't a good indicator for a visual element, nor the fact that the frequency of use would be an indicator of "how desirable it is to have". How often do you use your life insurance?