Pale Moon 26.5.0 released!

Pale Moon releases and site news
(read-only)
User avatar
Moonchild
Pale Moon guru
Pale Moon guru
Posts: 35402
Joined: 2011-08-28, 17:27
Location: Motala, SE
Contact:

Pale Moon 26.5.0 released!

Unread post by Moonchild » 2016-09-28, 13:08

This is a bugfix and security update, and adding some explicit parallel processing (more of that to come in the future).

Linux version will be updated shortly -- keep an eye on the Pale Moon for Linux board for news!

Fixes/Changes:
  • Implemented a breaking CSP (content security policy) spec change; when a page with CSP is loaded over http, Pale Moon now interprets CSP directives to also include https versions of the hosts listed in CSP if a scheme (http/https) isn't explicitly listed. This breaks with CSP 1.0 which is more restrictive and doesn't allow this cross-protocol access, but is in line with CSP 2 where this is allowed.
  • Fixed an issue with the XML parser where it would sometimes end up in an unknown state and throw an error (e.g. when specific networking errors would occur).
  • Improved the performance of canvas poisoning by explicitly parallelizing it.
Security fixes:
  • Fixed a potentially exploitable crash related to text writing direction. (CVE-2016-5280)
  • Made checking for invalid PNG files more strict. Pale Moon will now reject more PNG files that have corrupted/invalid data that could otherwise lead to potential security issues.
  • Changed the way paletted image frames are allocated so the space is cleared before it's used. DiD
  • Fixed a crash in nsNodeUtils::CloneAndAdopt() due to a typo. DiD
  • Fixed several memory safety errors.
"Sometimes, the best way to get what you want is to be a good person." -- Louis Rossmann
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite

Locked