Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
	I executed package updates and upgrades using apt

   * What exactly did you do (or not do) that was effective (or
     ineffective)?
	I tried loggin out and back in, rebooting the host, none helped.

   After running an apt upgrade on Debian 10 (Buster) running a Gnome Desktop, when Firefox is running, strange behavior takes place.
1. Unable to grab and move windows of other applications like gedit.
2. Unable to click or activate menu items of TorBrowser
3. Unable to close, click or access menu items of a multiple other application.

When Firefox-ESR is closed, all above issues go away.
When Firefox-ESR version  78.6.1esr-1~deb10u1 running, all kind of strange and unexpected behavior of the Gnome UI takes place.

Most obvious issue was the random glitch with sudden inability to move applications around the screen by grabbing top bar with the mouse.
Random loss of ability to close / quit applications using normal exit dialog, for example if chromuim or gedit confirming exit when more than one tab is opened or if a user wants to save changes if such where made before exit. Dialog is prompted but clicking produces no action and dialog window just stays on the screen.
Using a 'TAB' button on the keyboard followed by the 'enter' button on the keyboard closes an application as expected.

So this bug seems to have something to do with the mouse clicks interpretations in the gonme UI.

Multiple applications are affected ranging from wonky behavior of gnome terminal, to chromium and tor browser.
All related to managing application in UI with the mouse.

To stop all of this from happening I had to do the following: downgrade firefox-esr.

And here comes next unexpected and strange issue.

Last know version that worked with out messing up gnome ui on my host was a firefox-esr ver: 76.6.0esr-1~deb10u1

However (howeva!), when checking against debian repository servers, turns out this version is no longer available. ;( bummer.

Instead, an older version available - 78.5.0esr-1~deb10u1

It is what is is, so here we go, that's what i had to do:

1. Elevate your user privileges or use sudo.

2. Check (ask) via apt what options do I have by quavering the following:
	# apt policy firefox-esr

Examine the answer and look for the proper naming schema for firefox-esr versions.

firefox-esr:
  Installed: 78.6.1esr-1~deb10u1
  Candidate: 78.5.0esr-1~deb10u1
  Version table:
     78.6.1esr-1~deb10u1 500
        500 http://security.debian.org/debian-security buster/updates/main amd64 Packages
 *** 78.5.0esr-1~deb10u1 500
        500 http://deb.debian.org/debian buster/main amd64 Packages
        100 /var/lib/dpkg/status


In this output its clear I need version '78.5.0esr-1~deb10u1'

3. Okie-dokie, let's do it... instruct apt do pull down the older version, override the currently installed version - effectively downgrading the firefox-esr by issuing the following instruction to apt:

	# apt install firefox-esr=78.5.0esr-1~deb10u1

Confirm to apt that yes, that's what has to happened.
Once this done, I logged out my user session in gnome, logged back in... and for the past 12 hours everything is running as expected with no issues.

QUESTION (!) If some one from Debian security team can chime in and comment on the following:

When I submitted this ticket for a potential bug with the firefox-esr: 78.6.1esr-1~deb10u1 I used 'reportbug' package. Ok, details provided and right before I submitted it, 'reportbug' package collected basic info about my host and this has cut my attention.
In the report there is a section labeled '-- Extensions information'
With in that section it appears a reference to a file in my system:
	Location: /usr/lib/firefox-esr/browser/omni.ja

I have checked and yes, this file is present in my Debian instance and yes, with in this file there is amazon. bing, google all mentioned.

Question, what is that, why is it in there, and why hasn't anyone disclosed it to a user before integrating it to a code?

I do not want anything in my Debian instance having anything to do with dose platforms.

It would be very reassuring if some one independent of Mozilla, like Debian security team to comment and perhaps clarify the purpose of those 'extensions' I have never installed and yet according to this info, they are present AND enabled in my system somehow.

I have checked and Firefox normal GUI settings do not show anything remotely like that.


Aiy Dios Mio! Karramba!!!

Please, someone... what is this???

Damien

Hi Damien,

I have upgraded 78.6.0esr-1~deb10u1 to 78.6.1esr-1~deb10u1 in bullseye
and cannot replicate your issues.

1. Moving windows, while running 78.6.1esr-1~deb10u1 does work as expected.
2. Did not test
3. Works with thunderbird, keepassxc and gedit while running
78.6.1esr-1~deb10u1.

the severity should therefore be modified to normal in my opinion.

The file /usr/lib/firefox-esr/browser/omni.ja is available in older
versions as well. Unfortunately I do not know what it is for either...

Best regards,
Stefan Benter (not a maintainer)

More testing has been done over the weekend and here's the details.

First to address a response from Stefan Benter -

This issue manifested itself not on a Debian Bullseye, it manifests itself on a Debian:

Distributor ID:	Debian
Description:	Debian GNU/Linux 10 (buster)
Release:	10
Codename:	buster
Kernel: 	Linux 4.19.0-13-amd64 #1 SMP Debian 4.19.160-2 (2020-11-28) x86_64 GNU/Linux

This bug specifically manifest itself on systems running:

GNOME:     3.30.2
Graphics:  Device-1: Intel 3rd Gen Core processor Graphics driver: i915 v: kernel
           Display: wayland server: X.Org 1.20.4 driver: i915 resolution: 2560x1080~60Hz
           OpenGL: renderer: Mesa DRI Intel Ivybridge Mobile v: 4.2 Mesa 18.3.6

This bug only evident (in my testing) when the following condition exits:

System has installed package 'firefox-esr' version - 78.6.1esr-1~deb10u1 (from Debian repo) AND (!)
system has installed package 'tor-browser' version - 78.6.0esr - 10.0.7  (from Tor Project directly)

When both of those packages are present on the system, it causes some sort of a conflict with in the GNOME UI, specifically, how GNOME processes mouse clicks on the UI elements.

This condition arises due to the delay between a point in time when Mozilla releases a new version of firefox, and time-frame it takes for TorProject to code, test, and release an updated version of the TorBrowser based on the most recent version of the firefox by Mozilla.

As of today, Jan 17, 2021, once both packages have the same versions:
firefox-esr	78.6.1esr-1~deb10u1
and
torbrowser	78.6.1esr - 10.0.8

... the GNOME UI big in handling mouse 'left' clicks + 'right' clicks - NO LONGER exists.

On the systems (it has been verified) with the versions mismatch, GNOME is NOT properly handling mouse clicks.

That's the bug I have experienced.

This issue took place on a multiple different (hardware) machines.

Regarding the content of:
Location: /usr/lib/firefox-esr/browser/omni.ja

... the concern is not the presence of this file, the concern is of it's content, specifically references to the 'extensions'.

This is an excerpt from: Location: /usr/lib/firefox-esr/browser/omni.ja