Package: firefox-esr
Version: 52.7.3esr-1~deb9u1
Severity: normal
Dear Maintainer,
Today, I was trying to download various firware updates which came in .exe
format.
The file was at first downloaded (I chose "Save file" in the dialog box),
then, when the download finished, it was apparently gone (no partial file,
no finished file) and firefox warned me that "This file contains a virus
or malware", which is misleading, because the warning also appears for a
lot of "uncommon" downloads.
Nevertheless, I would really like to have a look at the file to decide for
myself, but alas, when I click on the warning, I am presented with two
choices:
[Open] [Remove file]
This is already a bit better than chromium, which allows me to either
"Discard" the file or not have it.
Nevertheless, the only option to have the file is to "Open" it, which, for
some reason, (tries to) run the .exe file using wine or mono, and then
leaves it around.
I think this is horrible, horrible design from a security
standpoint. Firefox should never force me to actually _run_ a potential
malware file just to be able to get a look at it, there should be an
option to just download the file noramlly as with other files, so I can
inspect it first.
(It turned out the "malware or virus" really was just a harmless firmware
update, but I can't always be so lucky).
In any case,
* What led up to the situation?
Trying to save an .exe that was likely incorrectly flagged as virus or malware.
* What exactly did you do (or not do) that was effective (or
ineffective)?
I pressed "Open", because that was the only option presented to me that
wouldnt delete the file.
* What was the outcome of this action?
Firefox executed a potential virus or malware, despite the user definitely
not wanting that, and not chosing that, but chosing "Save file". Unfortunately,
with potential malware, the "Save" choice
becomes a "run" or "delete" choice.
* What outcome did you expect instead?
Firefox should give me the option to have the file, or maybe delete it. There
shouldn't be a forced decision between running (or opening) and removing
it. There simply should be an option to save it, as was originally requested.
-- Package-specific info:
-- System Information:
Debian Release: 9.4
APT prefers stable
APT policy: (990, 'stable'), (500, 'stable-updates'), (500, 'unstable'),
(500, 'testing'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 4.14.35-041435-generic (SMP w/8 CPU cores)
Locale: LANG=C, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=C (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/bash
Init: systemd (via /run/systemd/system)
Versions of packages firefox-esr depends on:
ii debianutils 4.8.1.1
ii fontconfig 2.11.0-6.7+b1
ii libasound2 1.1.3-5
ii libatk1.0-0 2.22.0-1
ii libc6 2.24-11+deb9u3
ii libcairo-gobject2 1.14.8-1
ii libcairo2 1.14.8-1
ii libdbus-1-3 1.10.26-0+deb9u1
ii libdbus-glib-1-2 0.108-2
ii libevent-2.0-5 2.0.21-stable-3
ii libffi6 3.2.1-6
ii libfontconfig1 2.11.0-6.7+b1
ii libfreetype6 2.6.3-3.2
ii libgcc1 1:6.3.0-18+deb9u1
ii libgdk-pixbuf2.0-0 2.36.5-2+deb9u2
ii libglib2.0-0 2.50.3-2
ii libgtk-3-0 3.22.11-1
ii libgtk2.0-0 2.24.31-2
ii libhunspell-1.4-0 1.4.1-2+b2
ii libjsoncpp1 1.7.4-3
ii libpango-1.0-0 1.40.5-1
ii libsqlite3-0 3.16.2-5+deb9u1
ii libstartup-notification0 0.12-4+b2
ii libstdc++6 6.3.0-18+deb9u1
ii libvpx4 1.6.1-3+deb9u1
ii libx11-6 2:1.6.4-3
ii libx11-xcb1 2:1.6.4-3
ii libxcb-shm0 1.12-1
ii libxcb1 1.12-1
ii libxcomposite1 1:0.4.4-2
ii libxdamage1 1:1.1.4-2+b3
ii libxext6 2:1.3.3-1+b2
ii libxfixes3 1:5.0.3-1
ii libxrender1 1:0.9.10-1
ii libxt6 1:1.1.5-1
ii procps 2:3.3.12-3
ii zlib1g 1:1.2.8.dfsg-5
firefox-esr recommends no packages.
Versions of packages firefox-esr suggests:
ii fonts-lmodern 2.004.5-3
ii fonts-stix [otf-stix] 1.1.1-4
ii libcanberra0 0.30-3
ii libgssapi-krb5-2 1.15-1+deb9u1
ii mozplugger 1.14.5-2+b1
ii otf-stix 1.1.1-1
-- debconf-show failed
