1885855 - (CVE-2024-3863) Treat xrm-ms files as executable (so we warn about them)

Status: VERIFIED FIXED

(Toolkit :: Downloads API, defect, P3)

Comment 1

[Marco Bonardo [:mak]]

Attachment: Bug 1885855. r=dimi

Comment 2

[Marco Bonardo [:mak]]

Daniel, I assume dependencies of a bug inherit its sec level, so this would also be sec-moderate. Though as I don't want to bend rules, I'm asking for confirmation.

Comment 3

[Daniel Veditz [:dveditz]]

Sometimes. we have to balance the fact that this is a separate bug in its own right with not wanting to double-count issues and getting teams in trouble for "having too many security bugs". In this case, sec-moderate seem good.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/094054d6c7d0
r=dimi

Comment 5

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/094054d6c7d0

Comment 6

[Donal Meehan [:dmeehan]]

:mak does this impact ESR115 wondering if we need an uplift there also?

Comment 7

[Marco Bonardo [:mak]]

Yes, I'll start asking for uplifts.

Comment 8

[Marco Bonardo [:mak]]

Attachment: Bug 1885855. r=dimi

Original Revision: https://phabricator.services.mozilla.com/D205067

Comment 9

[Phabricator Automation]

Uplift Approval Request

• Explanation of risk level: Adding file extension to a list
• User impact if declined: sec-moderate risk on opening the file
• Is Android affected?: no
• Code covered by automated testing: yes
• Needs manual QE test: yes
• String changes made/needed: No
• Fix verified in Nightly: no
• Risk associated with taking this patch: Low
• Steps to reproduce for manual QE testing: Try downloading a file with one of these extensions. If you can't find one easily, rename one in a local file explorer and drag to the tabstrip. Expected behaviour is that once downloaded there's a prompt when trying to open it, rather than it immediately opening

Comment 10

[Marco Bonardo [:mak]]

Attachment: Bug 1885855. r=dimi

Original Revision: https://phabricator.services.mozilla.com/D205067

Comment 11

[Phabricator Automation]

Uplift Approval Request

• User impact if declined: sec-moderate risk on opening the file
• Is Android affected?: no
• Code covered by automated testing: yes
• Explanation of risk level: Adding file extension to a list
• Risk associated with taking this patch: Low
• Fix verified in Nightly: no
• Steps to reproduce for manual QE testing: yes
• Needs manual QE test: yes
• String changes made/needed: No

Comment 12

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/da2f5a764b81

Comment 13

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/bc97b19fc356

Comment 14

[Ciprian Georgiu, Desktop QA]

I've reproduced this issue on Win 11 x64 with an affected Nightly build, 2024-03-18. Thank you, Marco for providing the test file.

The issue is verified as fixed on Win 11 x64 using the latest builds, Nightly 126.0a1, Beta 125.0b4 and Esr 115.10.0.

Comment 15

[Daniel Veditz [:dveditz]]

Attachment: advisory.txt