From ff0ed7bc9231c2e4b73b162ae1ab08d5adb5ce6c04915bdc0e40e1695676ede8 Mon Sep 17 00:00:00 2001 From: Wolfgang Rosenauer Date: Mon, 11 Jan 2021 22:06:38 +0000 Subject: [PATCH 1/2] - Mozilla Thunderbird 78.6.1 MFSA 2021-02 (bsc#1180623) * CVE-2020-16044 (bmo#1683964) Use-after-free write when handling a malicious COOKIE-ECHO SCTP chunk OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=571 --- MozillaThunderbird.changes | 9 +++++++++ MozillaThunderbird.spec | 18 +++++++++--------- l10n-78.6.0.tar.xz | 3 --- l10n-78.6.1.tar.xz | 3 +++ tar_stamps | 8 ++++---- thunderbird-78.6.0.source.tar.xz | 3 --- thunderbird-78.6.0.source.tar.xz.asc | 16 ---------------- thunderbird-78.6.1.source.tar.xz | 3 +++ thunderbird-78.6.1.source.tar.xz.asc | 16 ++++++++++++++++ 9 files changed, 44 insertions(+), 35 deletions(-) delete mode 100644 l10n-78.6.0.tar.xz create mode 100644 l10n-78.6.1.tar.xz delete mode 100644 thunderbird-78.6.0.source.tar.xz delete mode 100644 thunderbird-78.6.0.source.tar.xz.asc create mode 100644 thunderbird-78.6.1.source.tar.xz create mode 100644 thunderbird-78.6.1.source.tar.xz.asc diff --git a/MozillaThunderbird.changes b/MozillaThunderbird.changes index 39e4797..50ec5df 100644 --- a/MozillaThunderbird.changes +++ b/MozillaThunderbird.changes @@ -1,3 +1,12 @@ +------------------------------------------------------------------- +Mon Jan 11 16:35:00 UTC 2021 - Wolfgang Rosenauer + +- Mozilla Thunderbird 78.6.1 + MFSA 2021-02 (bsc#1180623) + * CVE-2020-16044 (bmo#1683964) + Use-after-free write when handling a malicious COOKIE-ECHO SCTP + chunk + ------------------------------------------------------------------- Sat Dec 12 10:25:08 UTC 2020 - Wolfgang Rosenauer diff --git a/MozillaThunderbird.spec b/MozillaThunderbird.spec index 70e3650..4473812 100644 --- a/MozillaThunderbird.spec +++ b/MozillaThunderbird.spec @@ -1,7 +1,7 @@ # # spec file for package MozillaThunderbird # -# Copyright (c) 2020 SUSE LLC +# Copyright (c) 2021 SUSE LLC # 2006-2020 Wolfgang Rosenauer # # All modifications and additions to the file contributed by third parties @@ -26,8 +26,8 @@ # major 69 # mainver %major.99 %define major 78 -%define mainver %major.6.0 -%define orig_version 78.6.0 +%define mainver %major.6.1 +%define orig_version 78.6.1 %define orig_suffix %{nil} %define update_channel release %define source_prefix thunderbird-%{orig_version} @@ -477,6 +477,7 @@ xvfb-run --server-args="-screen 0 1920x1080x24" \ # build additional locales %if %localize +mkdir -p %{buildroot}%{progdir}/extensions/ truncate -s 0 %{_tmppath}/translations.{common,other} # langpack-build can not be done in parallel easily (see https://bugzilla.mozilla.org/show_bug.cgi?id=1660943) # Therefore, we have to have a separate obj-dir for each language @@ -494,7 +495,7 @@ ac_add_options --with-l10n-base=$RPM_BUILD_DIR/l10n ac_add_options --disable-updater ac_add_options --enable-official-branding EOF -mkdir -p $RPM_BUILD_DIR/langpacks_artifacts/ + sed -r '/^(ja-JP-mac|en-US|$)/d;s/ .*$//' $RPM_BUILD_DIR/%{source_prefix}/comm/mail/locales/shipped-locales \ | xargs -n 1 %{?jobs:-P %jobs} -I {} /bin/sh -c ' locale=$1 @@ -504,9 +505,10 @@ sed -r '/^(ja-JP-mac|en-US|$)/d;s/ .*$//' $RPM_BUILD_DIR/%{source_prefix}/comm/m # nsinstall is needed for langpack-build. It is already built by `./mach build`, but building it again is very fast ./mach build config/nsinstall langpack-$locale cp -rL ../obj_$locale/dist/xpi-stage/locale-$locale \ - $RPM_BUILD_DIR/langpacks_artifacts/langpack-$locale@thunderbird.mozilla.org - rm -rf $RPM_BUILD_DIR/langpacks_artifacts/langpack-$locale@thunderbird.mozilla.org/defaults - rm -rf $RPM_BUILD_DIR/langpacks_artifacts/langpack-$locale@thunderbird.mozilla.org/hyphenation + %{buildroot}%{progdir}/extensions/langpack-$locale@thunderbird.mozilla.org + # remove prefs, profile defaults, and hyphenation from langpack + rm -rf %{buildroot}%{progdir}/extensions/langpack-$locale@thunderbird.mozilla.org/defaults + rm -rf %{buildroot}%{progdir}/extensions/langpack-$locale@thunderbird.mozilla.org/hyphenation # Build systems like to run out of disc-space, so we delete the build-dir here (we copied already all relevant files) rm -rf ../obj_$locale/ # check against the fixed common list and sort into the right filelist @@ -532,8 +534,6 @@ make -C comm/mail/installer STRIP=/bin/true MOZ_PKG_FATAL_WARNINGS=0 # copy tree into RPM_BUILD_ROOT mkdir -p %{buildroot}%{progdir} cp -rf $RPM_BUILD_DIR/obj/dist/%{progname}/* %{buildroot}%{progdir} -mkdir -p %{buildroot}%{progdir}/extensions -cp -rf $RPM_BUILD_DIR/langpacks_artifacts/* %{buildroot}%{progdir}/extensions/ # remove some executable permissions find %{buildroot}%{progdir} \ diff --git a/l10n-78.6.0.tar.xz b/l10n-78.6.0.tar.xz deleted file mode 100644 index c48d980..0000000 --- a/l10n-78.6.0.tar.xz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:ea0feb7edc1f635e30748e84ad794eef90343c70a24b5743bd8d27f17d809564 -size 29071884 diff --git a/l10n-78.6.1.tar.xz b/l10n-78.6.1.tar.xz new file mode 100644 index 0000000..0df69a9 --- /dev/null +++ b/l10n-78.6.1.tar.xz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:c2f5e058346036259d0d945dc41f4cb0e56f8bd54b2eae9c6d47423574b57171 +size 29061960 diff --git a/tar_stamps b/tar_stamps index 698dc60..5c4c80e 100644 --- a/tar_stamps +++ b/tar_stamps @@ -1,10 +1,10 @@ PRODUCT="thunderbird" CHANNEL="esr78" -VERSION="78.6.0" +VERSION="78.6.1" VERSION_SUFFIX="" -PREV_VERSION="78.5.1" +PREV_VERSION="78.6.0" PREV_VERSION_SUFFIX="" #SKIP_LOCALES="" # Uncomment to skip l10n and compare-locales-generation RELEASE_REPO="https://hg.mozilla.org/releases/comm-esr78" -RELEASE_TAG="18be92a3f0388fe1b69941a50cdbadbf2c95b885" -RELEASE_TIMESTAMP="20201211152611" +RELEASE_TAG="f99e82f3f3cae6af48006c39fceb3beeabccd6f6" +RELEASE_TIMESTAMP="20210107201950" diff --git a/thunderbird-78.6.0.source.tar.xz b/thunderbird-78.6.0.source.tar.xz deleted file mode 100644 index 9522e33..0000000 --- a/thunderbird-78.6.0.source.tar.xz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:1dd6f9a4d88b4c3d0ec47bba60a891243ef95e105a9045b2d32e2b126779844b -size 353496712 diff --git a/thunderbird-78.6.0.source.tar.xz.asc b/thunderbird-78.6.0.source.tar.xz.asc deleted file mode 100644 index 77b95b4..0000000 --- a/thunderbird-78.6.0.source.tar.xz.asc +++ /dev/null @@ -1,16 +0,0 @@ ------BEGIN PGP SIGNATURE----- - -iQIzBAABCgAdFiEECXsxMHeuYqAvhNpN8aZmj7t9Vy4FAl/UFaYACgkQ8aZmj7t9 -Vy7Zxw//SSXD2GtgG0ko3xNQwQ2ujCOI80OYig92+GkFr1xIOuz3xvE5cLbWnYIP -Vzc6qBgaBZr4MJKL4B0URTOLivwKDNQb7c84zbUWJKaf3XHBQW+jroltl0J3lfgn -CpMoY3ekyzZeWZ+o0N0zexGRb1dUEAyUG4GgWUdozLeLG4DO7w70x/iI2wDP4QQN -VxQo0cYtdfizdvjky1v96OEFic6JFrDnj9VDQSI97NX5EAr+sI+ihvPr2mDzn+IA -kSmXfDGvTOvkoz13heNE2BHX5XM1GMuWpkrNQzW5G4mp5on52z1uHHIYZqc49uip -2KDAGX9NJbIGCn2utcwtsEhq3jtstjnHS5HzaeYEK4mjifdtxygXiWJZoaPSVTx0 -25ZjXI6LBJcuBKVZkvbEdR35nuA8Y83i/Jf7JtFoWlM/nyu+ElkW9gdvnmqYCPNp -0+0aEus0M0n5By+OxO9vF7Mm63z4Bj1YKnvU6+4s1d6G2HyICrNPZJ8IaDK3zj21 -oERuECpbWwrYU8cramlxxnpJfqI4EjQ6ZaPz1q9j3U7eT1Vr5cw2KGct2E6aHE36 -rUEgzO1TcZpGSWQUr1arDWePkCqHofUYsE15pjAFbBVF4Q9Ut3FKYUG6Jo0hbZJr -WKoQLzyxi0EGey5oiHiBnc+XOCr4ub1eujBf2uCciZHiZ7htr/E= -=RpOn ------END PGP SIGNATURE----- diff --git a/thunderbird-78.6.1.source.tar.xz b/thunderbird-78.6.1.source.tar.xz new file mode 100644 index 0000000..0a738f1 --- /dev/null +++ b/thunderbird-78.6.1.source.tar.xz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:870b544d26f5e52c187499d134e49eded2943a4a029269ae86aba6a69c53dcc6 +size 351971732 diff --git a/thunderbird-78.6.1.source.tar.xz.asc b/thunderbird-78.6.1.source.tar.xz.asc new file mode 100644 index 0000000..399d0bc --- /dev/null +++ b/thunderbird-78.6.1.source.tar.xz.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEECXsxMHeuYqAvhNpN8aZmj7t9Vy4FAl/3lTcACgkQ8aZmj7t9 +Vy6EDA//c6wZ8M/Nv73rHw3Vudq+vJiX7JsS0JyCQwalznTD9JAFGQbPSyrigtZ5 +iLbCeNxA9AAg+lO+oYW6TUQq+ZXJxB2bxYi/gygTmhSeYXKJEdXFXnZSyMo6imSc +Ctdzm23IumZ2SQ7q0rOQrsTTTDzSWHYT0TSwKQI7m91wJmXzate9fObYhOvQa1Lo +EX5WEe9ArnKAS/xrDGjXVvrXoLlT3sG+r4EdGX7ZzLqaifEvVX/yaKF8iVWapFaQ +eGJWvHZ9zr4MHLoS6Ca0DN7bpntfuGNB2U0++cxaJG8+QUc5DmnAH7A4aKPDq+Ji +hbwHo6O/8OFDOJCiir7CnyV9fQLkV92vuFKwFzanp1jP4hgOArMxHkt7E/eE4Ylw +jruNv3lFZ9d+LGqjxpyEtsH0Z71UvqbyM2rbq6oxB9DqOMvVGBKNS7eVXq3jFZkB +z7EsDbr8jDoKjkPMMrPO658yu4Pcx3tK0poTchzE/Rgj5hYHD/b8g9/yBOjNi1v2 +LMWhg3QCr9inp0LByMO+2SxoOqB/+4Kg/z0d+fic2pVSTaaRS93nvGfCrXrUmHCF +Yxd4L7/LtP6XUqsjJEcpvXH4GFPk850c+yHtaTyT0SbI0XGuCjT2ZVshtHj9yTD2 +5sia7yo/zl6e8GR8qgLmJXRM7SCnmmFqj1MhlKx5g9MTKv15y5k= +=NR/e +-----END PGP SIGNATURE----- From 5c0edfa8c60c51175c94e8697af0509c4e90826e1b549de42526b532d051d6ff Mon Sep 17 00:00:00 2001 From: Wolfgang Rosenauer Date: Wed, 13 Jan 2021 14:46:17 +0000 Subject: [PATCH 2/2] revert previous change OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=572 --- MozillaThunderbird.spec | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/MozillaThunderbird.spec b/MozillaThunderbird.spec index 4473812..bdcaec9 100644 --- a/MozillaThunderbird.spec +++ b/MozillaThunderbird.spec @@ -495,6 +495,7 @@ ac_add_options --with-l10n-base=$RPM_BUILD_DIR/l10n ac_add_options --disable-updater ac_add_options --enable-official-branding EOF +mkdir -p $RPM_BUILD_DIR/langpacks_artifacts/ sed -r '/^(ja-JP-mac|en-US|$)/d;s/ .*$//' $RPM_BUILD_DIR/%{source_prefix}/comm/mail/locales/shipped-locales \ | xargs -n 1 %{?jobs:-P %jobs} -I {} /bin/sh -c ' @@ -505,10 +506,9 @@ sed -r '/^(ja-JP-mac|en-US|$)/d;s/ .*$//' $RPM_BUILD_DIR/%{source_prefix}/comm/m # nsinstall is needed for langpack-build. It is already built by `./mach build`, but building it again is very fast ./mach build config/nsinstall langpack-$locale cp -rL ../obj_$locale/dist/xpi-stage/locale-$locale \ - %{buildroot}%{progdir}/extensions/langpack-$locale@thunderbird.mozilla.org - # remove prefs, profile defaults, and hyphenation from langpack - rm -rf %{buildroot}%{progdir}/extensions/langpack-$locale@thunderbird.mozilla.org/defaults - rm -rf %{buildroot}%{progdir}/extensions/langpack-$locale@thunderbird.mozilla.org/hyphenation + $RPM_BUILD_DIR/langpacks_artifacts/langpack-$locale@thunderbird.mozilla.org + rm -rf $RPM_BUILD_DIR/langpacks_artifacts/langpack-$locale@thunderbird.mozilla.org/defaults + rm -rf $RPM_BUILD_DIR/langpacks_artifacts/langpack-$locale@thunderbird.mozilla.org/hyphenation # Build systems like to run out of disc-space, so we delete the build-dir here (we copied already all relevant files) rm -rf ../obj_$locale/ # check against the fixed common list and sort into the right filelist @@ -534,6 +534,8 @@ make -C comm/mail/installer STRIP=/bin/true MOZ_PKG_FATAL_WARNINGS=0 # copy tree into RPM_BUILD_ROOT mkdir -p %{buildroot}%{progdir} cp -rf $RPM_BUILD_DIR/obj/dist/%{progname}/* %{buildroot}%{progdir} +mkdir -p %{buildroot}%{progdir}/extensions +cp -rf $RPM_BUILD_DIR/langpacks_artifacts/* %{buildroot}%{progdir}/extensions/ # remove some executable permissions find %{buildroot}%{progdir} \