모질라(Mozilla)에서 개발하는 웹브라우저 '불여우' 파이어폭스(Firefox)의 새로운 기능 추가나 버그 수정 또는 보안 취약점 문제를 해결한 파이어폭스 60.0 버전이 윈도, 맥OS, 리눅스에서 업데이트를 통해 각각 배포되었습니다.
--
이번 업데이트에는 다음과 같은 26건의 보안 취약점에 대한 보안 패치가 포함되어 있습니다.
■ Critical 등급 (2)
- CVE-2018-5151: Memory safety bugs fixed in Firefox 60
- CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8
■ High 등급 (6)
- CVE-2018-5154: Use-after-free with SVG animations and clip paths
- CVE-2018-5155: Use-after-free with SVG animations and text paths
- CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files
- CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer
- CVE-2018-5159: Integer overflow and out-of-bounds write in Skia
- CVE-2018-5160: Uninitialized memory use by WebRTC encoder
■ Moderate 등급 (14)
- CVE-2018-5152: WebExtensions information leak through webRequest API
- CVE-2018-5153: Out-of-bounds read in mixed content websocket messages
- CVE-2018-5163: Replacing cached data in JavaScript Start-up Bytecode Cache
- CVE-2018-5164: CSP not applied to all multipart content sent with multipart/x-mixed-replace
- CVE-2018-5166: WebExtension host permission bypass through filterReponseData
- CVE-2018-5167: Improper linkification of chrome: and javascript: content in web console and JavaScript debugger
- CVE-2018-5168: Lightweight themes can be installed without user interaction
- CVE-2018-5169: Dragging and dropping link text onto home button can set home page to include chrome pages
- CVE-2018-5172: Pasted script from clipboard can run in the Live Bookmarks page or PDF viewer
- CVE-2018-5173: File name spoofing of Downloads panel with Unicode characters
- CVE-2018-5174: Windows Defender SmartScreen UI runs with less secure behavior for downloaded files in Windows 10 April 2018 Update
- CVE-2018-5175: Universal CSP bypass on sites using strict-dynamic in their policies
- CVE-2018-5176: JSON Viewer script injection
- CVE-2018-5177: Buffer overflow in XSLT during number formatting
■ Low 등급 (4)
- CVE-2018-5165: Checkbox for enabling Flash protected mode is inverted in 32-bit Firefox
- CVE-2018-5180: heap-use-after-free in mozilla::WebGLContext::DrawElementsInstanced
- CVE-2018-5181: Local file can be displayed in noopener tab through drag and drop of hyperlink
- CVE-2018-5182: Local file can be displayed from hyperlink dragged and dropped on addressbar
--
그 외에 다음과 같은 새로운 기능이 추가되거나 변경되었습니다.
■ NEW
- Added a policy engine that allows customized Firefox deployments in enterprise environments, using Windows Group Policy or a cross-platform JSON file
- Enhancements to New Tab / Firefox Home
- Redesigned Cookies and Site Storage section in Preferences for greater clarity and control of first- and third-party cookies
- Applied Quantum CSS to render browser UI
- Added support for Web Authentication API, which allows USB tokens for website authentication
- Enhanced camera privacy indicators: Firefox now turns off your camera and the camera's light when you disable video recording, and turns the camera and light on when you resume recording
- Added an option for Linux users to show or hide page titles in a bar at the top of the browser. You’ll find the Title Bar option in the Customize panel available from the main browser menu.
- Improved WebRTC audio performance and playback for Linux users
- On-by-default support for the latest draft TLS 1.3
- Locale added: Occitan (oc)
■ CHANGED
- Changed the Windows shortcut for entering Reader View to F9, for better compatibility with keyboard layouts that use AltGr
- Bookmarks no longer support multiple keywords for the same URL unless the request has different POST data
- TLS certificates issued by Symantec before June 1st, 2016 are no longer trusted by Firefox
- Updated the Skia graphics library to milestone 66
자세한 업데이트 내역은 아래 링크의 정보를 참고하기 바랍니다.
--
네이버 파파고의 한국어 번역본은 아래와 같습니다. (현재 PC에서만 이용이 가능합니다.)
--
[영향을 받는 소프트웨어 및 업데이트 버전]
□ 파이어폭스 59.0.3 및 이하 버전 → 파이어폭스 60.0 버전으로 업데이트
※ https://www.mozilla.org/en-US/firefox/60.0/releasenotes/
※ https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/
--
그러므로 파이어폭스 사용자는 자동 업데이트('메뉴 열기 → 도움말 → Firefox 정보') 기능을 통해 최신버전으로 업데이트하기 바랍니다.
리눅스에서는 패키지 업데이트를 통해 최신버전으로 업데이트하기 바랍니다.
데비안 / 우분투 기준 : $ sudo apt-get update && sudo apt-get dist-upgrade
출처: http://la-nube.tistory.com/411 [la Nube | 라 누베]
