New Release: Tor Browser 11.5.5 (Android, Windows, macOS, Linux)

[system]

by richard | October 25, 2022

Tor Browser 11.5.5 is now available from the Tor Browser download page and also from our distribution directory.

Tor Browser 11.5.5 backports the following security updates from Firefox ESR 102.4 to to Firefox ESR 91.13 on Windows, macOS and Linux:

• CVE-2022-40674: libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c
• CVE-2022-42927: Same-origin policy violation could have leaked cross-origin URLs
• CVE-2022-42928: Memory Corruption in JS Engine
• CVE-2022-42929: Denial of Service via window.print
• CVE-2022-42932: Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4

Tor Browser 11.5.5 updates GeckoView on Android to 102.4.0esr and includes important security updates. There were no Android-specific security updates to backport from the Firefox 106 release.

The full changelog since Tor Browser 11.5.4 is:

• All Platforms
  • Update Translations
  • Bug tor-browser-build#40649: Update meek default bridge
  • Bug tor-browser-build#40654: Enable uTLS and use the full bridge line for snowflake
• Windows + macOS + Linux
  • Update Manual
  • Bug tor-browser#40465: Onion Authentication fails when connecting to a subdomain
  • Bug tor-browser#41355: Amends to YEC 2022 Takeover Desktop Stable 11.5.5
  • Bug tor-browser#41359: Backport ESR 102.4 security fixes to 91.13-based Tor Browser
  • Bug tor-browser#41364: Continued amends to YEC 2022 Takeover Desktop Stable 11.5.5
• Android
  • Bug tor-browser-build#40650: Rebase geckoview-102.3.0esr-11.5-1 to ESR 102.4
  • Bug tor-browser#41360: Backport Android-specific Firefox 106 to ESR 102.4-based Tor Browser
  • Bug tor-browser#41365: Amends to YEC 2022 Takeover on Android
• Build
  • Windows + macOS + Linux
    • Update Go to 1.18.7
    • Bug tor-browser-build#40464: go 1.18 fails to build on macOS

---

This is a companion discussion topic for the original entry at https://blog.torproject.org/new-release-tor-browser-1155/

[championquizzer]

Important Update

We’ve discovered an issue preventing Snowflake from connecting in Tor Browser 11.5.5, which was released today for Desktop and Android. If you use Snowflake, we recommend postponing updating Tor Browser until 11.5.6’s release in the next couple of days.

If you’ve already updated to Tor Browser 11.5.5, you can still use Snowflake by following these instructions to add a working Snowflake bridge line to Tor Browser manually:

• In Tor Browser for desktop, go to ≡ (hamburger menu) → Settings → Connection → Bridges, then click the Add a Bridge Manually… button.
• In Tor Browser for Android, go to (settings) → Config Bridge. Toggle Use a Bridge to “on” and tap Provide a Bridge I know.

Then paste in the following bridge line:

snowflake 192.0.2.3:80 2B280B23E1107BB62ABFC40DDCC8824814F80A72 fingerprint=2B280B23E1107BB62ABFC40DDCC8824814F80A72 url=https://snowflake-broker.torproject.net.global.prod.fastly.net/ front=cdn.sstatic.net ice=stun:stun.l.google.com:19302,stun:stun.altar.com.pl:3478,stun:stun.antisip.com:3478,stun:stun.bluesip.net:3478,stun:stun.dus.net:3478,stun:stun.epygi.com:3478,stun:stun.sonetel.com:3478,stun:stun.sonetel.net:3478,stun:stun.stunprotocol.org:3478,stun:stun.uls.co.za:3478,stun:stun.voipgate.com:3478,stun:stun.voys.nl:3478 utls-imitate=hellorandomizedalpn

After you upgrade to the next release, you can remove the custom bridge line and go back to the built-in snowflake bridge.