Tor Browser 7.5a4 is now available from the Tor Browser Project page and also from our distribution directory.
This release features important security updates to Firefox.
A lot of Tor Browser components have been updated in this release. Apart from the usual Firefox update (to 52.3.0esr) we include a new Tor alpha release (0.3.1.5-alpha) + an updated OpenSSL (1.0.2l), HTTPS-Everywhere (5.2.21) and NoScript (5.0.8.1). We also update sandboxed-tor-browser (to 0.0.12).
The major new features in this alpha release are selfrando support for 32bit Linux systems, Snowflake support for macOS, and a patch that fixes a lot of our problems with the external helper app dialog. In particular, downloading files via the pdf viewer should work again. As we do in the stable series, we also avoid scary warnings popping up when entering passwords on .onion sites without a TLS certificate. We are also testing a better Tor Browser hardening on Windows by using a newer compiler for our Windows builds. If you encounter any issues that could be caused by the new compiler, we want to know about it!
The full changelog since Tor Browser 7.5a2 (for Linux since Tor Browser 7.5a3) is:
- All Platforms
- Update Firefox to 52.3.0esr
- Update Tor to 0.3.1.5-alpha
- Update OpenSSL to 1.0.2l
- Update Torbutton to 1.9.8
- Bug 22610: Avoid crashes when canceling external helper app related downloads
- Bug 22472: Fix FTP downloads when external helper app dialog is shown
- Bug 22471: Downloading pdf files via the PDF viewer download button is broken
- Bug 22618: Downloading pdf file via file:/// is stalling
- Bug 22542: Resize slider window to work without scrollbars
- Bug 21999: Fix display of language prompt in non-en-US locales
- Bug 18913: Don't let about:tor have chrome privileges
- Bug 22535: Search on about:tor discards search query
- Bug 21948: Going back to about:tor page gives "Address isn't valid" error
- Code clean-up
- Translations update
- Update Tor Launcher to 0.2.12.3
- Bug 22592: Default bridge settings are not removed
- Translations update
- Update HTTPS-Everywhere to 5.2.21
- Update NoScript to 5.0.8.1
- Bug 22362: Remove workaround for XSS related browser freezing
- Bug 22067: NoScript Click-to-Play bypass with embedded videos and audio
- Update sandboxed-tor-browser to 0.0.12
- Bug 22610: Avoid crashes when canceling external helper app related downloads
- Bug 22472: Fix FTP downloads when external helper app dialog is shown
- Bug 22471: Downloading pdf files via the PDF viewer download button is broken
- Bug 22618: Downloading pdf file via file:/// is stalling
- Bug 21321: Exempt .onions from HTTP related security warnings
- Bug 21830: Copying large text from web console leaks to /tmp
- Bug 22073: Disable GetAddons option on addons page
- Bug 22884: Fix broken about:tor page on higher security levels
- Bug 22829: Remove default obfs4 bridge riemann.
- Windows
- Bug 21617: Fix single RWX page on Windows (included in 52.3.0esr)
- OS X
- Linux
- Bug 22832: Don't include monthly timestamp in libwebrtc build output
- Bug 20848: Deploy Selfrando in 32bit Linux builds
- Build system