fd799ac59eAccepting request 838827 from home:Guillaume_G:branches:mozilla:Factory
Wolfgang Rosenauer
2020-10-01 09:04:20 +00:00
0250e894cb- require python3-curses as workaround to fix i586 build
Wolfgang Rosenauer
2020-09-29 10:48:52 +00:00
5afd51282e- Mozilla Firefox 81.0 * https://www.mozilla.org/en-US/firefox/81.0/releasenotes MFSA 2020-42 (bsc#1176756) * CVE-2020-15675 (bmo#1654211) Use-After-Free in WebGL * CVE-2020-15677 (bmo#1641487) Download origin spoofing via redirect * CVE-2020-15676 (bmo#1646140) XSS when pasting attacker-controlled data into a contenteditable element * CVE-2020-15678 (bmo#1660211) When recursing through layers while scrolling, an iterator may have become invalid, resulting in a potential use-after- free scenario * CVE-2020-15673 (bmo#1648493, bmo#1660800) Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3 * CVE-2020-15674 (bmo#1656063, bmo#1656064, bmo#1656067, bmo#1660293) Memory safety bugs fixed in Firefox 81 - requires NSPR 4.28 NSS 3.56 - removed obsolete patches * mozilla-system-nspr.patch * mozilla-bmo1661715.patch * mozilla-silence-no-return-type.patch - skip post-build-checks for 15.0 and 15.1 - add revert-795c8762b16b.patch to fix LTO builds with gcc (related to bmo#1644409) - Use %limit_build macro again for aarch64 and armv7, instead of
Wolfgang Rosenauer
2020-09-22 14:04:54 +00:00
49c4b18dfcAccepting request 835187 from home:Guillaume_G:branches:openSUSE:Factory:ARM
Wolfgang Rosenauer
2020-09-17 12:12:41 +00:00
9689fbd025MFSA 2020-36 (bsc#1175686)
Wolfgang Rosenauer
2020-08-25 19:21:33 +00:00
57739184dc- added mozilla-system-nspr.patch (bmo#1661096)
Wolfgang Rosenauer
2020-08-25 18:24:16 +00:00
f9c0480028- Mozilla Firefox 80.0 MFSA 2020- (bsc#1175686) * CVE-2020-15663 (bmo#1643199) Downgrade attack on the Mozilla Maintenance Service could have resulted in escalation of privilege * CVE-2020-15664 (bmo#1658214) Attacker-induced prompt for extension installation * CVE-2020-12401 (bmo#1631573) Timing-attack on ECDSA signature generation * CVE-2020-6829 (bmo#1631583) P-384 and P-521 vulnerable to an electro-magnetic side channel attack on signature generation * CVE-2020-12400 (bmo#1623116) P-384 and P-521 vulnerable to a side channel attack on modular inversion * CVE-2020-15665 (bmo#1651636) Address bar not reset when choosing to stay on a page after the beforeunload dialog is shown * CVE-2020-15666 (bmo#1450853) MediaError message property leaks cross-origin response status * CVE-2020-15667 (bmo#1653371) Heap overflow when processing an update file * CVE-2020-15668 (bmo#1651520) Data Race when reading certificate information * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626, bmo#1656957) Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2 - requires * NSPR 4.27
Wolfgang Rosenauer
2020-08-25 18:18:25 +00:00
9f9bb3e928Accepting request 828191 from home:marxin:branches:mozilla:Factory
Wolfgang Rosenauer
2020-08-20 13:10:52 +00:00
185b328f4f- use ccache for build - replace versioned RPM deps with requires_ge - parallelize locale build
Wolfgang Rosenauer
2020-08-13 22:06:03 +00:00
50acacf655Accepting request 824701 from home:guoyunhe:branches:mozilla:Factory2
Wolfgang Rosenauer
2020-08-10 09:14:34 +00:00
31ba8c3028(patch provided by Atri Bhattacharya <badshah400@gmail.com> - enable MOZ_USE_XINPUT2 for TW (again) (boo#1173320) (Plasma 5.19.3 is now in TW)
Wolfgang Rosenauer
2020-07-17 15:09:12 +00:00
47a7a10c4fAccepting request 821486 from home:badshah400:branches:mozilla:Factory
Wolfgang Rosenauer
2020-07-17 15:04:42 +00:00
63bc80aa5e- Mozilla Firefox 78.0.2 * Fixed an accessibility regression in reader mode (bmo#1650922) * Made the address bar more resilient to data corruption in the user profile (bmo#1649981) * Fixed a regression opening certain external applications (bmo#1650162) MFSA 2020-28 * CVE pending (bmo#1644076) X-Frame-Options bypass using object or embed tags - Google API key is not usable for geolocation service
Wolfgang Rosenauer
2020-07-13 13:15:06 +00:00
fba870626f- added desktop file actions - do not use XINPUT2 for the moment until Plasma 5.19.3 has landed (boo#1173993) - rework langpack integration (boo#1173991) * ship XPIs instead of directories * allow addon sideloading * mark signatures for langpacks non-mandatory * do not autodisable user profile scopes * Google API key is not usable for geolocation service
Wolfgang Rosenauer
2020-07-12 17:40:52 +00:00
b65efa1613- fix pipewire support for TW (boo#1172903)
Wolfgang Rosenauer
2020-07-06 22:08:51 +00:00
13e2ddea0f- Mozilla Firefox 78.0.1 * Fixed an issue which could cause installed search engines to not be visible when upgrading from a previous release. - enable MOZ_USE_XINPUT2 for TW (boo#1173320) * Protections Dashboard (about:protections) * WebRTC not interrupted by screensaver anymore * disabled TLS 1.0 and 1.1 by default MFSA 2020-24 (bsc#1173576) * CVE-2020-12415 (bmo#1586630) AppCache manifest poisoning due to url encoded character processing * CVE-2020-12416 (bmo#1639734) Use-after-free in WebRTC VideoBroadcaster * CVE-2020-12417 (bmo#1640737) Memory corruption due to missing sign-extension for ValueTags on ARM64 * CVE-2020-12418 (bmo#1641303) Information disclosure due to manipulated URL object * CVE-2020-12419 (bmo#1643874) Use-after-free in nsGlobalWindowInner * CVE-2020-12420 (bmo#1643437) Use-After-Free when trying to connect to a STUN server * CVE-2020-12402 (bmo#1631597) RSA Key Generation vulnerable to side-channel attack * CVE-2020-12421 (bmo#1308251) Add-On updates did not respect the same certificate trust rules as software updates * CVE-2020-12422 (bmo#1450353) Integer overflow in nsJPEGEncoder::emptyOutputBuffer * CVE-2020-12423 (bmo#1642400) DLL Hijacking due to searching %PATH% for a library
Wolfgang Rosenauer
2020-07-03 06:52:59 +00:00
d08406e896- Mozilla Firefox 78.0 * startup notifications now using Gtk instead of libnotify * PDF downloads now show an option to open the PDF directly in Firefox - requires * NSS >= 3.53.1 * nodejs >= 10.21 * Gtk+3 >= 3.14 - removed obsolete patch * mozilla-s390-bigendian.patch - Add mozilla-pipewire-0-3.patch for openSUSE >= 15.2 to build WebRTC with pipewire support to enable screen sharing under Wayland; also add BuildRequires: pkgconfig(libpipewire-0.3) appropriately (boo#1172903). - adding SLE12 compatibility in spec file - add patches for s390x * mozilla-bmo1602730.patch (bmo#1602730) * mozilla-bmo1626236.patch (bmo#1626236) * mozilla-bmo998749.patch (bmo#998749) * mozilla-s390x-skia-gradient.patch - update create-tar.sh - Use same _constraints for ppc64 (BE) as ppc64le to avoid oom build failure
Wolfgang Rosenauer
2020-06-30 11:39:58 +00:00
3d2e40a031Accepting request 813117 from home:Guillaume_G:branches:mozilla:Factory
Wolfgang Rosenauer
2020-06-10 07:35:21 +00:00
d5337670c2Accepting request 811243 from home:AndreasStieger:branches:mozilla:Factory
Wolfgang Rosenauer
2020-06-04 06:00:26 +00:00
5c3bb08acd- Mozilla Firefox 77.0 * view and manage web certificates more easily on the new about:certificate page * improvements in accessibility * significant improvements to JavaScript debugging MFSA 2020-20 (bsc#1172402) * CVE-2020-12399 (bmo#1631576) Timing attack on DSA signatures in NSS library (fixed with external NSS >= 3.52.1) * CVE-2020-12405 (bmo#1631618) Use-after-free in SharedWorkerService * CVE-2020-12406 (bmo#1639590) JavaScript type confusion with NativeTypes * CVE-2020-12407 (bmo#1637112) WebRender leaking GPU memory when using border-image CSS directive * CVE-2020-12408 (bmo#1623888) URL spoofing when using IP addresses * CVE-2020-12409 (bmo#1619305, bmo#1632717) Memory safety bugs fixed in Firefox 77 and Firefox ESR 68.9 * CVE-2020-12411 (bmo#1620972, bmo#1625333) Memory safety bugs fixed in Firefox 77 - requires * NSS >= 3.52.1 * rust-cbindgen >= 1.14.1 * clang >= 5 - added mozilla-bmo1634646.patch as part of fixing PGO build (still not working)
Wolfgang Rosenauer
2020-06-02 14:55:49 +00:00
15bd5b7707Accepting request 805351 from home:michel_mno:branches:mozilla:Factory
Wolfgang Rosenauer
2020-05-14 06:50:59 +00:00
d5f3632780- Mozilla Firefox 76.0.1 * Fixed a bug causing some add-ons such as Amazon Assistant to see multiple onConnect events, impairing functionality (bmo#1635637)
Wolfgang Rosenauer
2020-05-12 21:40:30 +00:00
81c21d1d0f- fix build issue in libvpx for i586 via mozilla-bmo1622013.patch
Wolfgang Rosenauer
2020-04-09 17:21:52 +00:00
65f3f19592* https://www.mozilla.org/en-US/firefox/75.0/releasenotes MFSA 2020-12 (bsc#1168874) * CVE-2020-6821 (bmo#1625404) Uninitialized memory could be read when using the WebGL copyTexSubImage method * CVE-2020-6822 (bmo#1544181) Out of bounds write in GMPDecodeData when processing large images * CVE-2020-6823 (bmo#1614919) Malicious Extension could obtain auth codes from OAuth login flows * CVE-2020-6824 (bmo#1621853) Generated passwords may be identical on the same site between separate private browsing sessions * CVE-2020-6825 (bmo#1572541,bmo#1620193,bmo#1620203) Memory safety bugs fixed in Firefox 75 and Firefox ESR 68.7 * CVE-2020-6826 (bmo#1613009,bmo#1613195,bmo#1616734,bmo#1617488, bmo#1619229,bmo#1620719,bmo#1624897) Memory safety bugs fixed in Firefox 75
Wolfgang Rosenauer
2020-04-07 20:38:25 +00:00
67fc595cea- mozilla-sandbox-fips.patch: allow /proc/sys/crypto/fips_enabled to be read, as openssl 1.1.1 FIPS aborts if it cannot access it (bsc#1167132)
Wolfgang Rosenauer
2020-03-25 09:43:20 +00:00
1fdca0de1dAccepting request 788017 from home:msmeissn:branches:mozilla:Factory
Wolfgang Rosenauer
2020-03-25 09:12:06 +00:00
aafd1faf85(bmo#1609538, boo#1166471)
Wolfgang Rosenauer
2020-03-12 19:15:11 +00:00
a9628fa6ae- Mozilla Firefox 74.0 * https://www.mozilla.org/en-US/firefox/74.0/releasenotes/ MFSA 2020-08 (bsc#1166238) * CVE-2020-6805 (bmo#1610880) Use-after-free when removing data about origins * CVE-2020-6806 (bmo#1612308) BodyStream::OnInputStreamReady was missing protections against state confusion * CVE-2020-6807 (bmo#1614971) Use-after-free in cubeb during stream destruction * CVE-2020-6808 (bmo#1247968) URL Spoofing via javascript: URL * CVE-2020-6809 (bmo#1420296) Web Extensions with the all-urls permission could access local files * CVE-2020-6810 (bmo#1432856) Focusing a popup while in fullscreen could have obscured the fullscreen notification * CVE-2020-6811 (bmo#1607742) Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection * CVE-2019-20503 (bmo#1613765) Out of bounds reads in sctp_load_addresses_from_init * CVE-2020-6812 (bmo#1616661) The names of AirPods with personally identifiable information were exposed to websites with camera or microphone permission * CVE-2020-6813 (bmo#1605814) @import statements in CSS could bypass the Content Security Policy nonce feature * CVE-2020-6814 (bmo#1592078,bmo#1604847,bmo#1608256,bmo#1612636,
Wolfgang Rosenauer
2020-03-12 19:14:24 +00:00
32b74d8c4c- Mozilla Firefox 73.0.1 * Resolved problems connecting to the RBC Royal Bank website (bmo#1613943) * Fixed Firefox unexpectedly exiting when leaving Print Preview mode (bmo#1611133) * Fixed crashes when playing encrypted content on some Linux systems (bmo#1614535) - start in wayland mode when running under wayland session
Wolfgang Rosenauer
2020-02-20 13:56:27 +00:00
8ca328042dAccepting request 773730 from mozilla:Factory
Oliver Kurz
2020-02-14 15:29:09 +00:00
82f4bf17d0- Mozilla Firefox 73.0 * Added support for setting a default zoom level applicable for all web content * High-contrast mode has been updated to allow background images * Improved audio quality when playing back audio at a faster or slower speed * Added NextDNS as alternative option for DNS over HTTPS MFSA 2020-05 (bsc#1163368) * CVE-2020-6796 (bmo#1610426) Missing bounds check on shared memory read in the parent process * CVE-2020-6797 (bmo#1596668) (MacOS X only) Extensions granted downloads.open permission could open arbitrary applications on Mac OSX * CVE-2020-6798 (bmo#1602944) Incorrect parsing of template tag could result in JavaScript injection * CVE-2020-6799 (bmo#1606596) (Windows only) Arbitrary code execution when opening pdf links from other applications, when Firefox is configured as default pdf reader * CVE-2020-6800 (bmo#1595786,bmo#1596706,bmo#1598543,bmo#1604851, bmo#1608580,bmo#1608785,bmo#1605777) Memory safety bugs fixed in Firefox 73 and Firefox ESR 68.5 * CVE-2020-6801 (bmo#1601024,bmo#1601712,bmo#1604836,bmo#1606492) Memory safety bugs fixed in Firefox 73 - updated requirements * rust >= 1.39 * NSS >= 3.49.2 * rust-cbindgen >= 0.12.0 - rebased patches - removed obsolete patch * mozilla-bmo1601707.patch
Wolfgang Rosenauer
2020-02-12 14:14:39 +00:00
f7f1c3fabe- Mozilla Firefox 72.0.2 * Various stability fixes * Fixed issues opening files with spaces in their path (bmo#1601905) * Fixed a hang opening about:logins when a master password is set (bmo#1606992) * Fixed a web compatibility issue with CSS Shadow Parts which shipped in Firefox 72 (bmo#1604989) * Fixed inconsistent playback performance for fullscreen 1080p videos on some systems (bmo#1608485)
Wolfgang Rosenauer
2020-01-22 10:33:47 +00:00
abdc4f99a4Accepting request 766087 from home:Guillaume_G:branches:openSUSE:Factory:ARM
Wolfgang Rosenauer
2020-01-22 10:26:26 +00:00
84f4043538MFSA 2020-01 (bsc#1160305)
Wolfgang Rosenauer
2020-01-09 07:35:03 +00:00
e6daec17eeMFSA 2020-03 (bsc#1160498) * CVE-2019-17026 (bmo#1607443) IonMonkey type confusion with StoreElementHole and FallibleStoreElement
Wolfgang Rosenauer
2020-01-09 07:31:08 +00:00
31f1b363df- Mozilla Firefox 72.0.1
Wolfgang Rosenauer
2020-01-08 11:59:18 +00:00
5863c2f0e9- added mozilla-bmo1601707.patch to fix gcc/LTO builds (bmo#1601707, boo#1158466)
Wolfgang Rosenauer
2019-12-18 17:50:22 +00:00
d61baa9d35- added mozilla-bmo849632.patch to fix big endian issues in skia used for WebGL
Wolfgang Rosenauer
2019-12-10 08:08:57 +00:00
474457216d- Mozilla Firefox 71.0 * Improvements to Lockwise, our integrated password manager * More information about Enhanced Tracking Protection in action * Native MP3 decoding on Windows, Linux, and macOS * Configuration page (about:config) reimplemented in HTML * New kiosk mode functionality, which allows maximum screen space for customer-facing displays MFSA 2019-36 * CVE-2019-11756 (bmo#1508776) Use-after-free of SFTKSession object * CVE-2019-17008 (bmo#1546331) Use-after-free in worker destruction * CVE-2019-13722 (bmo#1580156) (Windows only) Stack corruption due to incorrect number of arguments in WebRTC code * CVE-2019-17014 (bmo#1322864) Dragging and dropping a cross-origin resource, incorrectly loaded as an image, could result in information disclosure * CVE-2019-17010 (bmo#1581084) Use-after-free when performing device orientation checks * CVE-2019-17005 (bmo#1584170) Buffer overflow in plain text serializer * CVE-2019-17011 (bmo#1591334) Use-after-free when retrieving a document in antitracking * CVE-2019-17012 (bmo#1449736, bmo#1533957, bmo#1560667, bmo#1567209 bmo#1580288, bmo#1585760, bmo#1592502) Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 * CVE-2019-17013 (bmo#1298509, bmo#1472328, bmo#1577439, bmo#1577937 bmo#1580320, bmo#1584195, bmo#1585106, bmo#1586293, bmo#1593865 bmo#1594181) Memory safety bugs fixed in Firefox 71
Wolfgang Rosenauer
2019-12-09 07:58:52 +00:00
c5265ac327- Mozilla Firefox 70.0.1 * Fix for an issue that caused some websites or page elements using dynamic JavaScript to fail to load. (bmo#1592136) * Title bar no longer shows in full screen view (bmo#1588747) - added mozilla-bmo1504834-part4.patch to fix some visual issues on big endian platforms
Wolfgang Rosenauer
2019-11-01 14:24:05 +00:00
9b8d4398e7- Mozilla Firefox 70.0 * more privacy protections from Enhanced Tracking Protection * Firefox Lockwise passwordmanager * Improvements to core engine components, for better browsing on more sites * Improved privacy and security indicators MFSA 2019-34 * CVE-2018-6156 (bmo#1480088) Heap buffer overflow in FEC processing in WebRTC * CVE-2019-15903 (bmo#1584907) Heap overflow in expat library in XML_GetCurrentLineNumber * CVE-2019-11757 (bmo#1577107) Use-after-free when creating index updates in IndexedDB * CVE-2019-11759 (bmo#1577953) Stack buffer overflow in HKDF output * CVE-2019-11760 (bmo#1577719) Stack buffer overflow in WebRTC networking * CVE-2019-11761 (bmo#1561502) Unintended access to a privileged JSONView object * CVE-2019-11762 (bmo#1582857) document.domain-based origin isolation has same-origin-property violation * CVE-2019-11763 (bmo#1584216) Incorrect HTML parsing results in XSS bypass technique * CVE-2019-11765 (bmo#1562582) Incorrect permissions could be granted to a website * CVE-2019-17000 (bmo#1441468) CSP bypass using object tag with data: URI * CVE-2019-17001 (bmo#1587976) CSP bypass using object tag when script-src 'none' is specified * CVE-2019-17002 (bmo#1561056) upgrade-insecure-requests was not being honored for links dragged and dropped
Wolfgang Rosenauer
2019-10-25 09:13:30 +00:00
929b941313- Mozilla Firefox 69.0.3 * Fixed Yahoo mail users being prompted to download files when clicking on emails (bmo#1582848) - devel package build can easily be disabled now
Wolfgang Rosenauer
2019-10-13 16:07:47 +00:00
f335d9044a* Fixed a crash when editing files on Office 365 websites (bmo#1579858) * Fixed a Linux-only crash when changing the playback speed while watching YouTube videos (bmo#1582222)
Wolfgang Rosenauer
2019-10-04 12:31:42 +00:00
1328266653- extension preferences moved from branding package to core package (packaging but not branding specific)
Wolfgang Rosenauer
2019-10-03 20:32:17 +00:00
13cc39d491- Mozilla Firefox 69.0.2 - updated supported locale list - remove obsolete kde.js setting (boo#1151186) and related patch firefox-add-kde.js-in-order-to-survive-PGO-build.patch
Wolfgang Rosenauer
2019-10-03 08:42:59 +00:00
a21dd9a5f8- update create-tar.sh to latest revision and adjusted tar_stamps
Wolfgang Rosenauer
2019-09-25 11:40:52 +00:00
84a21a1533(contributed by Bernhard Wiedemann) - Make build verbose (contributed by Martin Liška) - remove obsolete kde.js setting (boo#1151186)
Wolfgang Rosenauer
2019-09-25 11:38:27 +00:00
b4dcd00367Accepting request 733089 from home:bmwiedemann:branches:mozilla:Factory
Wolfgang Rosenauer
2019-09-25 08:59:57 +00:00
1ff1de7746Accepting request 732112 from home:marxin:branches:mozilla:Factory
Wolfgang Rosenauer
2019-09-20 10:17:52 +00:00
1f7d350ac4- Mozilla Firefox 69.0.1 * Fixed external programs launching in the background when clicking a link from inside Firefox to launch them (bmo#1570845) * Usability improvements to the Add-ons Manager for users with screen readers (bmo#1567600) * Fixed the Captive Portal notification bar not being dismissable in some situations after login is complete (bmo#1578633) * Fixed the maximum size of fonts in Reader Mode when zoomed (bmo#1578454) * Fixed missing stacks in the Developer Tools Performance section (bmo#1578354) MFSA 2019-31 * CVE-2019-11754 (bmo#1580506) Pointer Lock is enabled with no user notification - disable DOH by default
Wolfgang Rosenauer
2019-09-20 07:16:58 +00:00
2176e2a590Accepting request 730473 from mozilla:FactoryYuchen Lin2019-09-17 11:34:43 +00:00
0c3a6afdc4- Mozilla Firefox 69.0 * Enhanced Tracking Protection (ETP) for stronger privacy protections * Block Autoplay feature is enhanced to give users the option to block any video * Users in the US or using the en-US browser, can get a new “New Tab” page experience connecting to the best of Pocket's content. * Support for the Web Authentication HmacSecret extension via Windows Hello introduced. * Support for receiving multiple video codecs with this release makes it easier for WebRTC conferencing services to mix video from different clients. - requires * rust/cargo >= 1.35 * rust-cbindgen >= 0.9.0 * mozilla-nss >= 3.45 - rebased patches * mozilla-bmo1504834-part1.patch (currently unused as it breaks LE) * mozilla-bmo1504834-part2.patch (currently unused as it breaks LE) * mozilla-bmo1504834-part3.patch (currently unused as it breaks LE)
Wolfgang Rosenauer
2019-09-09 06:28:12 +00:00
Wolfgang Rosenauer
Dominique Leuenberger
Oliver Kurz
Yuchen Lin