boot13Chrome 52.0.2743.116 fixes ten security bugs. The change log lists fifty-nine changes in total, but none of them are particularly noteworthy.
Category Archives: Patches and updates
Java 8 Update 101
Oracle released Java 8 Update 101 a couple of weeks ago, and I somehow managed to miss it. The Oracle Critical Patch Update Advisory for July 2016 includes the details, and I’m still subscribed to the Oracle Security Alerts RSS feed, so I can only assume that I failed to notice it. Mea culpa.
The new version includes fixes for at least thirteen security vulnerabilities, as well as several other bug fixes.
Anyone with Java enabled in their web browser should update Java as soon as possible. Hopefully most of you noticed the update and installed it before I did.
Joomla 3.6.1 update problems
The latest version of Joomla is causing problems for web servers running older versions of PHP. Affected Joomla sites are still accessible, but users and administrators are unable to log in.
An announcement on the Joomla web site, and another in the Joomla documentation, provide details and workarounds for problems caused by the update, but web servers running PHP 5.3 won’t find them particularly helpful. If you administer a web server running PHP 5.3, the solution is to either wait for Joomla 3.6.2, or make some changes to a single Joomla file, as outlined in this fix on Github.
In case you’re wondering why any diligent web server administrator would still be running a version of PHP that is known to be insecure, what’s actually going on in most cases is that the admin is running a custom build of PHP that has had all relevant security fixes applied. For example, these custom builds of PHP are provided for Ubuntu LTS (Long Term Support) releases to allow for maximum security and stability.
Update 2016Aug05: That was fast. Joomla 3.6.2 is now available, and it fixes the PHP 5.3 compatibility issue.
Firefox 48
There’s a lot to talk about with the release of Firefox 48. Of course, this being Mozilla, nothing is straightforward.
Process separation
One of the most important new features in Firefox 48 is process separation (aka Electrolysis, aka e10s), whereby Firefox is split into separate processes, instead of running as a single process. The idea is to improve stability, responsiveness, and security. According to Mozilla: “Users should experience a Firefox that is less susceptible to freezing and is generally more responsive to input, while retaining the experience and features that users love.”
Here’s what the release notes have to say about it: “Process separation (e10s) is enabled for some of you. Like it? Let us know and we’ll roll it out to more.” What does this even mean? How do I know if process separation is enabled in my copy? What’s the difference between Firefox 48 with process separation enabled and with it disabled? How can I provide feedback on something if I don’t even know for sure I’m seeing it? If it’s not enabled in my copy, how will Mozilla ‘roll it out’ to me?
A separate Mozilla blog post answers some of these questions. Process separation will be enabled gradually in a series of Firefox releases, starting with 48 and continuing with 49. You can determine whether e10s is enabled in your copy of Firefox by entering “about:support” into the URL bar, and looking at the ‘Multiprocess Windows’ line.
A post on Asa Dotzler’s blog provides a few more answers, including this: “The groups that will have to wait a bit for E10S account for about half of our release users and include Windows XP users, users with screen readers, RTL users, and the largest group, extension users.” In case you were wondering, Asa Dotzler is the Participation Director for Firefox OS, Mozilla Corp.
Improved download security
With version 48, Firefox has beefed up security related to downloads. Actually, it’s more accurate to say that Google added features to its Safe Browsing service, which Firefox uses. Those new features include checking for ‘Potentially Unwanted Software’ and ‘Uncommon Downloads’. The changes are described in another Mozilla post. Unfortunately, this post is poorly worded, making the new features sound as if they watch what a downloaded software installer is doing. In fact, Firefox just checks downloads against a list of known bad or ‘uncommon’ installers (provided by Google) and warns the user if one is encountered. The new features can be disabled in Firefox’s options.
New restrictions for add-ons
Firefox add-ons that have not been approved by Mozilla will no longer work with Firefox 48. Add-ons are a major source of instability and security issues in Firefox, and while this change will be inconvenient for people who use add-ons that have not been verified and signed by Mozilla, it’s definitely a step in the right direction.
Security vulnerabilities fixed
At least twenty-three security issues were fixed in Firefox 48. That means this is an important update; if you use Firefox, you should upgrade to version 48 as soon as possible. If the new features in Firefox 48 are a problem for you, then it’s time to look at alternatives like Opera and Chrome.
Other notable changes
The address (URL) bar now expands to the width of the screen when you’re typing in it. More matches are shown when you enter text in the address bar, and any that are already bookmarked will show an icon.
Improvements to bookmarks and history: Firefox 48 merges “your Reading Lists into Bookmarks and your Synced tabs into the History Panel. This change means your reading list items will now be available across devices alongside your bookmarks, giving you easier access to your content no matter what device you’re using, which is a major upgrade for those of you using Firefox across devices.”
Related links
Opera 39 released
A new version of the Opera web browser makes improvements to the video pop-out feature, adds a news reader, and adds customizable block lists to the integrated ad blocker.
The context menu that appears when right-clicking selected page text now includes more useful options. Opera’s memory footprint has been improved with version 39.
The Opera 39 announcement doesn’t include a link to the change log, so I had to go hunting for it on the Opera web site. Eventually I found it on the Opera desktop blog. Note that while many of the entries in the change log refer to unreleased, developer or beta versions, all of the changes described apply to the newly-released version, 39.0.2256.42.
Meanwhile, other Opera web resources have disappeared (Unified change logs for Opera), and others include no mention of Opera 39 (Opera for Windows change log). That’s just sloppy.
Windows 10 Insider Preview Build 14393
According to the announcement, Windows 10 Insider Preview Build 14393 consists of bug fixes and reliability improvements. Which is a good thing, because according to several sources, build 14393 is what Microsoft will use for the Windows 10 anniversary update.
The anniversary update will become available on August 2, and will be available for free for anyone already running Windows 10 or on the Insider Preview program. If you want it for free and you’re not yet running Windows 10, you have until tomorrow (July 29) to upgrade your Windows 7 or 8.1 computer.
Ars Technica: Windows 10 Anniversary Update is ready to go and free for just a few more days
The Verge: Windows 10 Anniversary Update: the 10 best new features
Chrome 52.0.2743.82
Fixes for at least forty-eight security issues highlight the release of Chrome 52.0.2743.82.
According to the full change log (warning: may kill your browser), almost 10,000 changes were made for this version. That’s a few too many for any kind of summary, so we’ll just have to hope that Google provides a list of notable changes, as hinted at in the announcement.
Mozilla getting sneakier about updates to Firefox
According to the release notes, Firefox 47.0.1 was released on June 28. I only found out about it yesterday (half a month later), when I happened to run the FileHippo Update Checker.
After seeing the new Firefox version reported by FileHippo, I looked at Firefox’s ‘About Firefox’ dialog, and it offered to upgrade to version 47.0.1. I went ahead, and I’m now running 47.0.1.
Why is Mozilla no longer announcing new versions of Firefox? If their goal is to make updates invisible to users, why didn’t my version of Firefox update to the new version automatically?
For what it’s worth, Firefox 47.0.1 appears to fix one obscure crashing problem.
More Windows 10 Insider Preview Builds
The rapid pace of Windows 10 Preview builds being delivered to my test PC continues. I guess that’s what Microsoft meant when it described this release channel as ‘Fast’.
In the last week or so, my test PC has been updated four times, to Windows 10 preview builds 14383, 14385, 14388, and 14390.
Given that each of these new builds is effectively a new install of Windows 10, they are surprisingly non-intrusive. The downloads are of course large, so there’s a bandwidth consideration. But the downloads happen in the background, and the installs and subsequent restarts happen during off hours (at night). Often I don’t notice the change until I start copying files and notice that Explorer’s copy dialog has once again reverted to its default, simple view.
Note: the Windows 10 version number is no longer visible on the desktop. Microsoft says “the desktop watermark is now gone. This is because we’re beginning to check in final code in preparation for releasing the Windows 10 Anniversary Update”. I’m not sure I follow the logic there, but at least it’s somewhat consistent. The watermark stops appearing when a release is imminent.
Build 14383
Bug fixes and performance improvements.
Build 14385
Bug fixes and performance improvements.
Build 14388
Bug fixes; reliability and performance improvements.
Build 14390
Bug fixes.
Patch Tuesday for July 2016
It’s a relatively light month for Microsoft patches: only eleven this time. The updates address security issues in the usual suspects, namely Windows, Internet Explorer, Edge, Office, and the Flash code that’s embedded in IE 10, IE 11, and Edge. Six of the updates are flagged as Critical. A total of fifty vulnerabilities are addressed.
Adobe joins in the fun again this month, with updates for Flash and Reader/Acrobat. The Flash update fixes a whopping fifty-two vulnerabilities, while the Reader update fixes thirty vulnerabilities. Update: an announcement for the Flash update appeared on July 14th, despite being dated July 12th.
Update 2016Jul17: Ars Technica points out that one of the Microsoft updates addresses a critical security hole in a Windows printer driver installation mechanism that dates back to Windows 95. The vulnerability was not actually closed by the update; instead, a warning was added to the driver installation process.