diff --git a/MozillaFirefox.changes b/MozillaFirefox.changes index b6994ef..c2c5ef7 100644 --- a/MozillaFirefox.changes +++ b/MozillaFirefox.changes @@ -1,3 +1,106 @@ +------------------------------------------------------------------- +Tue Feb 6 07:03:42 UTC 2018 - fstrba@suse.com + +- Added patch: + * mozilla-alsa-sandbox.patch: Fix bmo#1430274, ALSA sound (still + or again?) not working in Firefox 58 due to sandboxing. + +------------------------------------------------------------------- +Mon Jan 29 22:32:21 UTC 2018 - wr@rosenauer.org + +- update to Firefox 58.0.1 + MFSA 2018-05 + * Arbitrary code execution through unsanitized browser UI (bmo#1432966) +- use correct language packs +- readd mozilla-enable-csd.patch as it only lands for FF59 upstream +- allow larger number of nested elements (mozilla-bmo256180.patch) + +------------------------------------------------------------------- +Tue Jan 23 20:40:57 UTC 2018 - wr@rosenauer.org + +- update to Firefox 58.0 (bsc#1077291) + * Added Nepali (ne-NP) locale + * Added support for form autofill for credit card + * Optimize page load by caching JavaScript internal representation + MFSA 2018-02 + * CVE-2018-5091 (bmo#1423086) + Use-after-free with DTMF timers + * CVE-2018-5092 (bmo#1418074) + Use-after-free in Web Workers + * CVE-2018-5093 (bmo#1415291) + Buffer overflow in WebAssembly during Memory/Table resizing + * CVE-2018-5094 (bmo#1415883) + Buffer overflow in WebAssembly with garbage collection on + uninitialized memory + * CVE-2018-5095 (bmo#1418447) + Integer overflow in Skia library during edge builder allocation + * CVE-2018-5097 (bmo#1387427) + Use-after-free when source document is manipulated during XSLT + * CVE-2018-5098 (bmo#1399400) + Use-after-free while manipulating form input elements + * CVE-2018-5099 (bmo#1416878) + Use-after-free with widget listener + * CVE-2018-5100 (bmo#1417405) + Use-after-free when IsPotentiallyScrollable arguments are freed + from memory + * CVE-2018-5101 (bmo#1417661) + Use-after-free with floating first-letter style elements + * CVE-2018-5102 (bmo#1419363) + Use-after-free in HTML media elements + * CVE-2018-5103 (bmo#1423159) + Use-after-free during mouse event handling + * CVE-2018-5104 (bmo#1425000) + Use-after-free during font face manipulation + * CVE-2018-5105 (bmo#1390882) + WebExtensions can save and execute files on local file system + without user prompts + * CVE-2018-5106 (bmo#1408708) + Developer Tools can expose style editor information cross-origin + through service worker + * CVE-2018-5107 (bmo#1379276) + Printing process will follow symlinks for local file access + * CVE-2018-5108 (bmo#1421099) + Manually entered blob URL can be accessed by subsequent private browsing tabs + * CVE-2018-5109 (bmo#1405599) + Audio capture prompts and starts with incorrect origin attribution + * CVE-2018-5110 (bmo#1423275) (affects only OS X) + Cursor can be made invisible on OS X + * CVE-2018-5111 (bmo#1321619) + URL spoofing in addressbar through drag and drop + * CVE-2018-5112 (bmo#1425224) + Extension development tools panel can open a non-relative URL in the panel + * CVE-2018-5113 (bmo#1425267) + WebExtensions can load non-HTTPS pages with browser.identity.launchWebAuthFlow + * CVE-2018-5114 (bmo#1421324) + The old value of a cookie changed to HttpOnly remains accessible to scripts + * CVE-2018-5115 (bmo#1409449) + Background network requests can open HTTP authentication in unrelated foreground tabs + * CVE-2018-5116 (bmo#1396399) + WebExtension ActiveTab permission allows cross-origin frame content access + * CVE-2018-5117 (bmo#1395508) + URL spoofing with right-to-left text aligned left-to-right + * CVE-2018-5118 (bmo#1420049) + Activity Stream images can attempt to load local content through file: + * CVE-2018-5119 (bmo#1420507) + Reader view will load cross-origin content in violation of CORS headers + * CVE-2018-5121 (bmo#1402368) (affects only OS X) + OS X Tibetan characters render incompletely in the addressbar + * CVE-2018-5122 (bmo#1413841) + Potential integer overflow in DoCrypt + * CVE-2018-5090 + Memory safety bugs fixed in Firefox 58 + * CVE-2018-5089 + Memory safety bugs fixed in Firefox 58 and Firefox ESR 52.6 +- requires NSS 3.34.1 +- requires rust 1.21 +- removed obsolete patches: + mozilla-bindgen-systemlibs.patch + mozilla-bmo1360278.patch + mozilla-bmo1399611-csd.patch + mozilla-rust-1.23.patch +- rebased patches +- updated man-page + ------------------------------------------------------------------- Tue Jan 9 18:48:02 UTC 2018 - wr@rosenauer.org diff --git a/MozillaFirefox.spec b/MozillaFirefox.spec index e9697f9..89a5735 100644 --- a/MozillaFirefox.spec +++ b/MozillaFirefox.spec @@ -18,11 +18,11 @@ # changed with every update -%define major 57 -%define mainver %major.0.4 +%define major 58 +%define mainver %major.0.1 %define update_channel release %define branding 1 -%define releasedate 20180103231032 +%define releasedate 20180128191252 # PIE, full relro (x86_64 for now) %define build_hardened 1 @@ -73,10 +73,10 @@ BuildRequires: libnotify-devel BuildRequires: libproxy-devel BuildRequires: makeinfo BuildRequires: mozilla-nspr-devel >= 4.17 -BuildRequires: mozilla-nss-devel >= 3.33 +BuildRequires: mozilla-nss-devel >= 3.34.1 BuildRequires: python-devel BuildRequires: python2-xml -BuildRequires: rust >= 1.19 +BuildRequires: rust >= 1.21 BuildRequires: rust-std BuildRequires: startup-notification-devel BuildRequires: unzip @@ -153,10 +153,9 @@ Patch4: mozilla-openaes-decl.patch Patch5: mozilla-no-stdcxx-check.patch Patch6: mozilla-reduce-files-per-UnifiedBindings.patch Patch7: mozilla-aarch64-startup-crash.patch -Patch8: mozilla-bindgen-systemlibs.patch -Patch9: mozilla-bmo1360278.patch -Patch10: mozilla-bmo1399611-csd.patch -Patch11: mozilla-rust-1.23.patch +Patch8: mozilla-enable-csd.patch +Patch9: mozilla-bmo256180.patch +Patch10: mozilla-alsa-sandbox.patch # Firefox/browser Patch101: firefox-kde.patch Patch102: firefox-no-default-ualocale.patch @@ -211,7 +210,7 @@ of %{appname}. %package translations-other Summary: Extra translations for %{appname} Group: System/Localization -Provides: locale(%{name}:ach;af;an;as;ast;az;bg;bn_BD;bn_IN;br;bs;cak;cy;dsb;en_ZA;eo;es_MX;et;eu;fa;ff;fy_NL;ga_IE;gd;gl;gn;gu_IN;he;hi_IN;hr;hsb;hy_AM;id;is;ka;kab;kk;km;kn;lij;lt;lv;mai;mk;ml;mr;ms;nn_NO;or;pa_IN;rm;ro;si;sk;sl;son;sq;sr;ta;te;th;tr;uk;uz;vi;xh) +Provides: locale(%{name}:ach;af;an;as;ast;az;bg;bn_BD;bn_IN;br;bs;cak;cy;dsb;en_ZA;eo;es_MX;et;eu;fa;ff;fy_NL;ga_IE;gd;gl;gn;gu_IN;he;hi_IN;hr;hsb;hy_AM;id;is;ka;kab;kk;km;kn;lij;lt;lv;mai;mk;ml;mr;ms;ne-NP;nn_NO;or;pa_IN;rm;ro;si;sk;sl;son;sq;sr;ta;te;th;tr;uk;uz;vi;xh) Requires: %{name} = %{version} Obsoletes: %{name}-translations < %{version}-%{release} @@ -270,7 +269,6 @@ cd $RPM_BUILD_DIR/mozilla %patch8 -p1 %patch9 -p1 %patch10 -p1 -%patch11 -p1 # Firefox %patch101 -p1 %patch102 -p1 @@ -381,7 +379,7 @@ ac_add_options --with-arch=armv7-a ac_add_options --disable-webrtc %endif EOF -make -f client.mk build +./mach build %install cd $RPM_BUILD_DIR/obj diff --git a/_constraints b/_constraints index 57c2694..61bd64a 100644 --- a/_constraints +++ b/_constraints @@ -2,10 +2,10 @@ - 13 + 16 - 6000 + 9000 diff --git a/compare-locales.tar.xz b/compare-locales.tar.xz index 42e3784..d16c86e 100644 --- a/compare-locales.tar.xz +++ b/compare-locales.tar.xz @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:6441a12de7f0735fd9a2b4580bb7cdccec86b34acda3a8718ce9b0bf39a59ca7 -size 28824 +oid sha256:088110e577f98b08da247cfe931afdbcec697e74890362d95895360bda0d8989 +size 28404 diff --git a/create-tar.sh b/create-tar.sh index c169287..6097ca5 100644 --- a/create-tar.sh +++ b/create-tar.sh @@ -7,8 +7,8 @@ CHANNEL="release" BRANCH="releases/mozilla-$CHANNEL" -RELEASE_TAG="afa87f9be3a8852da3a30f286b15ae599c7874f6" -VERSION="57.0.4" +RELEASE_TAG="FIREFOX_58_0_1_RELEASE" +VERSION="58.0.1" # mozilla if [ -d mozilla ]; then @@ -54,7 +54,7 @@ tar $compression -cf firefox-$VERSION-source.tar.xz --exclude=.hgtags --exclude= # l10n echo "fetching locales..." test ! -d l10n && mkdir l10n -for locale in $(awk '{ print $1; }' mozilla/browser/locales/shipped-locales); do +for locale in $(awk '{ print $1; }' l10n_changesets.txt); do case $locale in ja-JP-mac|en-US) ;; @@ -62,7 +62,7 @@ for locale in $(awk '{ print $1; }' mozilla/browser/locales/shipped-locales); do echo "reading changeset information for $locale" _changeset=$(grep ^$locale l10n_changesets.txt | awk '{ print $2; }') echo "fetching $locale changeset $_changeset ..." - hg clone http://hg.mozilla.org/releases/l10n/mozilla-$CHANNEL/$locale l10n/$locale + hg clone http://hg.mozilla.org/l10n-central/$locale l10n/$locale [ "$RELEASE_TAG" == "default" ] || hg -R l10n/$locale up -C -r $_changeset ;; esac diff --git a/firefox-57.0.4-source.tar.xz b/firefox-57.0.4-source.tar.xz deleted file mode 100644 index 5f55e4c..0000000 --- a/firefox-57.0.4-source.tar.xz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:7ab9870937e8683ea435f8cbd4ff52d4e53a263d3ab31e6ba2d6fe61f3aa636c -size 267408064 diff --git a/firefox-58.0.1-source.tar.xz b/firefox-58.0.1-source.tar.xz new file mode 100644 index 0000000..61b937e --- /dev/null +++ b/firefox-58.0.1-source.tar.xz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:423e214603cf8e0d6b16bfbb428be20e2b868278129821f017b659fc0934253a +size 265350860 diff --git a/firefox-kde.patch b/firefox-kde.patch index a840dc4..ff51f53 100644 --- a/firefox-kde.patch +++ b/firefox-kde.patch @@ -1,11 +1,11 @@ # HG changeset patch -# Parent 9f19902f8bcde21fa63172a85818fb11714878d8 +# Parent 89cbe8c49d05965b87815143d1944ab6964f12c7 diff --git a/browser/base/content/browser-kde.xul b/browser/base/content/browser-kde.xul new file mode 100644 --- /dev/null +++ b/browser/base/content/browser-kde.xul -@@ -0,0 +1,1252 @@ +@@ -0,0 +1,1248 @@ +#filter substitution + +# -*- Mode: HTML -*- @@ -104,12 +104,6 @@ new file mode 100644 + accesskey="&moveToNewWindow.accesskey;" + tbattr="tabbrowser-multiple" + oncommand="gBrowser.replaceTabWithWindow(TabContextMenu.contextTab);"/> -+#ifdef E10S_TESTING_ONLY -+