Bonum Certa Men Certa

Firefox ESR 91 Creating Massive Headache for Debian 11 (GNU/Linux)

Guest post by Ryan, reprinted with permission from the original

D

ebian and Mozilla go way back, with endless troubles created by an incompetent upstream for Firefox, which is getting worse by the hour.



Debian tries to produce a stable OS that doesn’t change very much (although you can use backports and Flatpaks to strategically update packages), and this is very important for people who are happy with the way their computer works and don’t want to be on a bug treadmill, like Fedora.



However, you may have noticed that Firefox 78 ESR hasn’t been supported upstream now for over a week and has missed the latest round of security updates from Mozilla, and that Firefox 91.3 ESR is still stuck in the pipes, being packaged only in Experimental and Debian Unstable.



When I went to look at the reasons why, it appears that there are new problems related to Rust, build failures on various supported CPU architectures, and it also demands a newer version of Mesa3d than Debian 11 has, even though the entire OS is barely over a month old (and will be supported for five years).



Mozilla decided to migrate away from GLX and make EGL mandatory, _and_ blacklist the version of Mesa (20.3.5) which ships with Debian 11, demanding at least Mesa 21.



Mesa 21 would otherwise be fine as a Backport package, but now Debian has to choose between backporting a critical component of the OS directly into “Stable” updates (the OpenGL/Vulkan stack and Direct Rendering Interface drivers and libdrm), as well as newer Nvidia proprietary drivers in non-Free for the people who haven’t disembarked that clown car yet in favor of Intel and AMD cards that are truly supported on GNU/Linux, or forcing Firefox ESR 91 to use GLX again by overriding a default preference, which kicks the can down the road 1 year and creates the same problem again later, at which time Mozilla may have removed the GLX code anyway.



And reverting to GLX makes it impossible for users to enable Wayland and WebRender Compositing without knowing that they also need to set Firefox back to EGL and bring in a Backported Mesa package when one arrives.



In the mean time, there are 6 CVEs that are unpatched in Firefox 78.15, and one of those CVE numbers contains bugs (the details of which are still hidden by Mozilla) corresponding to four memory safety issues (which are often crash with potential arbitrary code execution). So really, at least 10 unpatched security issues, and maybe more (because not all patched issues get a CVE even though they may have security implications).



However Debian solves this problem will set more bad precedents and probably the least incorrect way to solve for it, assuming it’s even worth anything to keep Mozilla’s lawyers happy and use the official “branding”, which Mozilla is pissing down the drain these days anyway, is to bring in newer Mesa builds, which undermines the “feature freeze” that keeps Debian Stable running so well.



It’s definitely well past time to “IceWeasel” Firefox again and do whatever they need to do to keep it running securely without compromising the rest of the operating system.

Recent Techrights' Posts

The Free Software Foundation (FSF) Has Un-cancelled the Best People, Just in Time for the Big 4-0
Mr. Oliva should have been there all along (since 2019)
Most "Modern" Technology Makes You Slower and Dumber
Because proprietary software makes you worse off
"What Comes After Free Software?" Wrongly Insinuates We've Reached the Goal (Prison is Not the Goal)
The oil tycoons use similar tactics against environmentalists, giving them fake "wins"
Making More Work Space
I learned the hard way that less is more in circumstances where more means distraction
MAHA is a Lie, Public Officials Never Valued Citizens' Health (They Still Value Private Businesses, Their Sponsors)
Reject demagogues
New Techrights Turns 2
Today starts the third year of the SSG-based Techrights
What Scares Them the Most is Independent News Sites That They Cannot Control and Censor
Wikileaks was a good example of this
If You Don't Control Your Online Platform, Then Someone Else is Controlling You
be (or become) independent
The Solicitors Regulation Authority (SRA) Has a Policy on Racism and Sexism
In then future we'll show the misogyny and racial slurs
Links 22/09/2025: Murdochs Might Join Fentanylware (TikTok) 'Investors' (Masters), United Kingdom Recognises Palestinian Statehood
Links for the day
 
The Complaint About Brett Wilson LLP - Part II - UK SLAPPs for Americans, SLAPPs for Profit
Brett Wilson LLP has a track record of this kind
Mayday: Optus emergency calling crisis
Reprinted with permission from Daniel Pocock
Links 23/09/2025: Massive Data Breach, Slop Versus Productivity, and Vista 11 Update Breaks Things Again
Links for the day
Code of Censorship
Extortion is peace
Free Software Foundation (FSF) Has a New Press Kit for the Weekend After Next Weekend (40th Anniversary)
miles better than social [sic] media [sic] quips, moderated by narcissists and oil tycoons.
Microsoft Had Two Waves of Mass Layoffs This Month (That We Know of) and It'll Get Worse for Microsoft Soon
Will the axe fall again by month's end?
Gemini Links 23/09/2025: Happy Equinox, Photronic Arts, and Perception Cognition
Links for the day
Lessons We've Learned After 17 Years of American Hosting
GAFAM is "all-in" with the "Trump agenda"
Back to Normal Now, We Plan to Do More In-Depth Series (or Multi-part Stories)
Articles (or series thereof) that contain philosophy are important to us
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, September 22, 2025
IRC logs for Monday, September 22, 2025
Microsoft Media is Panicking Amid Mass Layoffs Every Month, H-1B Fees, and "Seattle’s Tech Scene in Trouble"
In "late stage Microsoft", copyleft becomes proprietary
The Next Wave of IBM/Red Hat Layoffs Being Discussed Already
Red Hat is sort of disappearing the way Tivoli did
Oracle Started This Year With Slop. Then It Stopped.
Passing fads are like this
Distros That Run on PCs Made 20 Years Ago and Don't Use Systemd
Betas for now
The Complaint About Brett Wilson LLP - Part I - Abusing British Women on Behalf of American Men Who Abuse American Women
Transparency is important to us, so we've decided to make this series
Slopwatch: Google News and the Evident Slopfarm Infestation
This is what people get about Linux when they query Google for Linux
Gemini Links 22/09/2025: Esperanto Music History and Apps For Android
Links for the day
Links 22/09/2025: More American 'Censorship' (Retaliation for Journalism), Cheeto "Might Be Losing His Race Against Time"
Links for the day
The Blob Slop
Give me more words, give me some text
The 50-Pound Note Experiment and the "War on Cash"
Britain is actually seeing a rebound in cash payments, and it's not a temporary phenomenon
Slopwatch: Blaming the Victims for Microsoft's Failures and Plagiarising Phoronix
That's what Google has been reduced to: slop and slopfarms
Links 22/09/2025: Breaches, Windows TCO, and Arrests
Links for the day
Gemini Links 22/09/2025: Rabbit Hole and DeGoogling Fairphone
Links for the day
Links 22/09/2025: Russian War Planes Invade NATO Airspace While Dihydroxyacetone Man Escalates Attack on Free Speech Because of Critics
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, September 21, 2025
IRC logs for Sunday, September 21, 2025
Links 21/09/2025: "Hey Hi" (Hype) Under Fire, Fakes Identified; Tesla Burns Family
Links for the day
Google's Software is Malware and Malware in Mobile Devices
Originally posted by Rob Musial
Links 20/09/2025: Hegemony Coming to a Close, Luigi Mangione Ruled Not Terrorist
Links for the day
Gemini Links 21/09/2025: "Charlie Kirk Was a Hateful Piece of Shit" and Slop Code Attempted by Microsofter
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Saturday, September 20, 2025
IRC logs for Saturday, September 20, 2025