- Mozilla Firefox 97.0

MFSA 2022-04 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during update
  * CVE-2022-22755 (bmo#1309630)
    XSL could have allowed JavaScript execution after a tab was closed
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22757 (bmo#1720098)
    Remote Agent did not prevent local websites from connecting
  * CVE-2022-22758 (bmo#1728742)
    tel: links could have sent USSD codes to the dialer on
    Firefox for Android
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22762 (bmo#1743931)
    JavaScript Dialogs could have been displayed over other
    domains on Firefox for Android
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaFirefox?expand=0&rev=958

MozillaFirefox.changes

@@ -1,3 +1,47 @@
+-------------------------------------------------------------------
+Tue Feb  8 08:40:45 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>
+
+- Mozilla Firefox 97.0
+  MFSA 2022-04 (bsc#1195682)
+  * CVE-2022-22753 (bmo#1732435)
+    Privilege Escalation to SYSTEM on Windows via Maintenance Service
+  * CVE-2022-22754 (bmo#1750565)
+    Extensions could have bypassed permission confirmation during update
+  * CVE-2022-22755 (bmo#1309630)
+    XSL could have allowed JavaScript execution after a tab was closed
+  * CVE-2022-22756 (bmo#1317873)
+    Drag and dropping an image could have resulted in the dropped
+    object being an executable
+  * CVE-2022-22757 (bmo#1720098)
+    Remote Agent did not prevent local websites from connecting
+  * CVE-2022-22758 (bmo#1728742)
+    tel: links could have sent USSD codes to the dialer on
+    Firefox for Android
+  * CVE-2022-22759 (bmo#1739957)
+    Sandboxed iframes could have executed script if the parent
+    appended elements
+  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
+    Cross-Origin responses could be distinguished between script
+    and non-script content-types
+  * CVE-2022-22761 (bmo#1745566)
+    frame-ancestors Content Security Policy directive was not
+    enforced for framed extension pages
+  * CVE-2022-22762 (bmo#1743931)
+    JavaScript Dialogs could have been displayed over other
+    domains on Firefox for Android
+  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
+    bmo#1748210, bmo#1748279)
+    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6
+  * CVE-2022-0511 (bmo#1713579, bmo#1735448, bmo#1743821, bmo#1746313,
+    bmo#1746314, bmo#1746316, bmo#1746321, bmo#1746322, bmo#1746323,
+    bmo#1746412, bmo#1746430, bmo#1746451, bmo#1746488, bmo#1746875,
+    bmo#1746898, bmo#1746905, bmo#1746907, bmo#1746917, bmo#1747128,
+    bmo#1747137, bmo#1747331, bmo#1747346, bmo#1747439, bmo#1747457,
+    bmo#1747870, bmo#1749051, bmo#1749274, bmo#1749831)
+    Memory safety bugs fixed in Firefox 97
+- requires NSS 3.74
+- requires rust 1.57
+
 -------------------------------------------------------------------
 Mon Feb  7 22:21:29 UTC 2022 - Dirk Müller <dmueller@suse.com>
 
@@ -12,10 +56,10 @@ Mon Feb  7 22:21:29 UTC 2022 - Dirk Müller <dmueller@suse.com>
 -------------------------------------------------------------------
 Sun Jan 30 23:58:34 UTC 2022 - Dirk Müller <dmueller@suse.com>
 
-- disable ccache, this adds about 1 minute of build time and 
+- disable ccache, this adds about 1 minute of build time and
   over 2 GB of disk space usage without benefit on OBS builds
 - build with rust-simd like upstream does
-- use -g1 for debuginfo generation as this is what upstream 
+- use -g1 for debuginfo generation as this is what upstream
   does as well and it saves ~ 2GB of writes
 - use %limit on x86_64 to scale down to less capable workers
 - disable install stripping so that debuginfo is useful

MozillaFirefox.spec

@@ -2,7 +2,7 @@
 # spec file
 #
 # Copyright (c) 2022 SUSE LLC
-#               2006-2021 Wolfgang Rosenauer <wr@rosenauer.org>
+#               2006-2022 Wolfgang Rosenauer <wr@rosenauer.org>
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -28,9 +28,9 @@
 # orig_suffix b3
 # major 69
 # mainver %major.99
-%define major          96
+%define major          97
-%define mainver        %major.0.3
+%define mainver        %major.0
-%define orig_version   96.0.3
+%define orig_version   97.0
 %define orig_suffix    %{nil}
 %define update_channel release
 %define branding       1
@@ -97,13 +97,13 @@ BuildRequires:  gcc9-c++
 BuildRequires:  gcc-c++
 %endif
 %if 0%{?suse_version} < 1550 && 0%{?sle_version} < 150300
-BuildRequires:  cargo >= 1.53
+BuildRequires:  cargo >= 1.57
-BuildRequires:  rust >= 1.53
+BuildRequires:  rust >= 1.57
 %else
 # Newer sle/leap/tw use parallel versioned rust releases which have
 # a different method for provides that we can use to request a
 # specific version
-BuildRequires:  rust+cargo >= 1.53
+BuildRequires:  rust+cargo >= 1.57
 %endif
 %if 0%{useccache} != 0
 BuildRequires:  ccache
@@ -114,7 +114,7 @@ BuildRequires:  libiw-devel
 BuildRequires:  libproxy-devel
 BuildRequires:  makeinfo
 BuildRequires:  mozilla-nspr-devel >= 4.33
-BuildRequires:  mozilla-nss-devel >= 3.73.1
+BuildRequires:  mozilla-nss-devel >= 3.74
 BuildRequires:  nasm >= 2.14
 BuildRequires:  nodejs >= 10.22.1
 %if 0%{?sle_version} >= 120000 && 0%{?sle_version} < 150000

firefox-96.0.3.source.tar.xz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:1a741d6fcf20e6833a90169f41d29141ea4610f58b848e06091a683af6304dea
-size 406721708

firefox-96.0.3.source.tar.xz.asc

@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCgAdFiEEQ2D+IQnEl2MYb44h6+QekPbxL20FAmHxt6kACgkQ6+QekPbx
-L223hg//cw8Tdp8yS7L1VS2BccGT6NtqM+lbo6jcsv2nHIjAft+3RIefkAtP2mNI
-Rd/N7gpDuJGLo7pfKZeXpr/U9Vd4Y8P8VbIF00GVhufx2hCSW1PVsyZfiMOSAxnq
-zzsQEuV7V33hudmkKN5dncM2uZasrzcNcfl6xAhnUd/Y9OLPfjoUeh4FWfztf7K6
-fv3jTcxASEkYV4YNN9DQXJNM5Doisz2pzVsjrVSz38dZ9Jkjk/qSObOPjuAZnDrZ
-nddAgVM+wih7SbhtOd8vaSalRitt2hl3fVJlWmzijKCUeC05QtZwuYXAZyDXd+at
-GjSlFGqY4KCsv+VehQo1fHhR+CDOh84q1tVxKwMKe/7YjXbTL1rK581uUKDTVZJg
-7DHgHqb2KCm2NPdY+upM7wXaGyPznTlioZlWGf4o3U7i2+9+dPd3/RPz12OvHHO1
-MsqJ6X8XcH4NXulrTVtbmufvyDJuyJXpiky5Y7+UMKfEoifO2Tsl0jzgYeF4XiPs
-/snWgf02uWc1Tvp7c+U2Js8zyeDUw70tCdRabomUKu4JGqYZul5XkuEIdYki/jFV
-69EYTnlg9TFxf1mZqHHhvdPrImD5cITEb2WPV0HVWoJ3/5tfk+W6yr7hUma8ZL/c
-Qoz/98d4M5kV0vGTq2lpI+rueok5MY5yy9js/oKNL9xNXKpcaQI=
-=LkFi
------END PGP SIGNATURE-----

firefox-97.0.source.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:6c8a7dcb47122d033383fd62a1bcaefff0290a6c23d057898e8ff9c72749df28
+size 481365988

firefox-97.0.source.tar.xz.asc

@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEEQ2D+IQnEl2MYb44h6+QekPbxL20FAmH69GUACgkQ6+QekPbx
+L21e4A//Qi0IjtTbFXJZVqgsy/0oihhz0EKMw/mZ7JNA0WR2U6q4x6dSgb7XWVc2
+zTiPUdOuT7DlTHEtXW8VBObffLAvbzbEh24EoTJdrSLSsEXB4u1Pf3nkCbcFZzRn
+ECf+mLYG3Y9SamAzWDE1aQD3b4G+i0otQ7LvSaYIc61dDn2BS5qD3VTGqRvp21CN
+TMk8HSt9ixRC/IodCIsyD9dqnuMYNKmH58NjYwcfNXlvaWw3uxTHwWDgcJmnC2Xt
+mB3o2A3Kki5V0f/a5EKzkU7hgOeR5Z3Fq9fWIqHN68QSwhtJAuQRUFWZcCpHArZt
+yRLTC40gj7enjMzHgmyjYTdf5BV4XltTXeRri35kxLM12vPx3m8095l9haFQ7TrQ
+/Z6T2jAP7oh5ejEOtEwO1bsw4hz/xFs8eXLSMnkwE7XZIiHcWGRreE6/sLTSYUB2
+207kOMYWf9mrr31qYaMKQ8zmfPPcfDC/8t9CcY9JT2XzKdvqVgjNPsJzuWJKckwY
+amUxLQcw/wdx+ps4phcqLzRuA4AbZtQ9gvZV9AVtMIP4pqVoNTUHZDifiT7nH6w0
+zCECRlNBxgZO1LhvcVvQ++CASpSGqFjF0AMlbHBEgKoOE+Ts0nUUhZeW3Xt/OSDB
+sWXrL0Mhe38qMAc+KgzExbtUIoTETVpSADCbeRdYQWIPFSwjEVo=
+=/5GN
+-----END PGP SIGNATURE-----

l10n-96.0.3.tar.xz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:83aeb97d1afc70328dc600d2282a35070837944634166ad153d4eb8fb7c1748c
-size 49474288

l10n-97.0.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:4f25795ef08179f70f67ceed07a66535e8d48ca586f3bbc32fc06799f9a96c20
+size 49611916

mozilla-kde.patch

@@ -3,7 +3,7 @@
 # Date 1559294891 -7200
 #      Fri May 31 11:28:11 2019 +0200
 # Node ID c2aa7198fb925e7fde96abf65b6f68b9b755f112
-# Parent  9db1669be16001a48b62d147070fb75f60bac251
+# Parent  8d1110b6918acc4e7d3f655d1e55f4b4ff630abe
 Description: Add KDE integration to Firefox (toolkit parts)
 Author: Wolfgang Rosenauer <wolfgang@rosenauer.org>
 Author: Lubos Lunak <lunak@suse.com>
@@ -31,7 +31,7 @@ diff --git a/modules/libpref/Preferences.cpp b/modules/libpref/Preferences.cpp
  #ifdef MOZ_MEMORY
  #  include "mozmemory.h"
  #endif
-@@ -4635,16 +4636,27 @@ nsresult Preferences::InitInitialObjects
+@@ -4634,16 +4635,27 @@ nsresult Preferences::InitInitialObjects
      "unix.js"
  #  if defined(_AIX)
      ,
@@ -59,7 +59,7 @@ diff --git a/modules/libpref/Preferences.cpp b/modules/libpref/Preferences.cpp
  
    // Load jar:$app/omni.jar!/defaults/preferences/*.js
    // or jar:$gre/omni.jar!/defaults/preferences/*.js.
-@@ -4709,17 +4721,17 @@ nsresult Preferences::InitInitialObjects
+@@ -4708,17 +4720,17 @@ nsresult Preferences::InitInitialObjects
        }
  
        nsCOMPtr<nsIFile> path = do_QueryInterface(elem);
@@ -81,7 +81,7 @@ diff --git a/modules/libpref/Preferences.cpp b/modules/libpref/Preferences.cpp
 diff --git a/modules/libpref/moz.build b/modules/libpref/moz.build
 --- a/modules/libpref/moz.build
 +++ b/modules/libpref/moz.build
-@@ -119,16 +119,20 @@ EXPORTS.mozilla += [
+@@ -118,16 +118,20 @@ EXPORTS.mozilla += [
  ]
  EXPORTS.mozilla += sorted(["!" + g for g in gen_h])
  
@@ -147,7 +147,7 @@ diff --git a/python/mozbuild/mozpack/chrome/manifest.py b/python/mozbuild/mozpac
 diff --git a/toolkit/components/downloads/moz.build b/toolkit/components/downloads/moz.build
 --- a/toolkit/components/downloads/moz.build
 +++ b/toolkit/components/downloads/moz.build
-@@ -45,10 +45,14 @@ XPCOM_MANIFESTS += [
+@@ -46,10 +46,14 @@ XPCOM_MANIFESTS += [
  
  if CONFIG["MOZ_PLACES"]:
      EXTRA_JS_MODULES += [
@@ -165,7 +165,7 @@ diff --git a/toolkit/components/downloads/moz.build b/toolkit/components/downloa
 diff --git a/toolkit/mozapps/downloads/HelperAppDlg.jsm b/toolkit/mozapps/downloads/HelperAppDlg.jsm
 --- a/toolkit/mozapps/downloads/HelperAppDlg.jsm
 +++ b/toolkit/mozapps/downloads/HelperAppDlg.jsm
-@@ -1231,36 +1231,66 @@ nsUnknownContentTypeDialog.prototype = {
+@@ -1252,36 +1252,66 @@ nsUnknownContentTypeDialog.prototype = {
          params.handlerApp &&
          params.handlerApp.executable &&
          params.handlerApp.executable.isFile()
@@ -841,11 +841,11 @@ diff --git a/uriloader/exthandler/moz.build b/uriloader/exthandler/moz.build
  ]
  
  if CONFIG["MOZ_ENABLE_DBUS"]:
-     CXXFLAGS += CONFIG["TK_CFLAGS"]
      CXXFLAGS += CONFIG["MOZ_DBUS_CFLAGS"]
  
  if CONFIG["MOZ_WIDGET_TOOLKIT"] == "gtk":
-     CXXFLAGS += CONFIG["TK_CFLAGS"]
+     CXXFLAGS += CONFIG["MOZ_GTK3_CFLAGS"]
+     CXXFLAGS += CONFIG["MOZ_DBUS_GLIB_CFLAGS"]
 diff --git a/uriloader/exthandler/unix/nsCommonRegistry.cpp b/uriloader/exthandler/unix/nsCommonRegistry.cpp
 new file mode 100644
 --- /dev/null
@@ -1260,7 +1260,7 @@ diff --git a/uriloader/exthandler/unix/nsOSHelperAppService.cpp b/uriloader/exth
 diff --git a/widget/gtk/moz.build b/widget/gtk/moz.build
 --- a/widget/gtk/moz.build
 +++ b/widget/gtk/moz.build
-@@ -135,16 +135,17 @@ FINAL_LIBRARY = "xul"
+@@ -136,16 +136,17 @@ FINAL_LIBRARY = "xul"
  
  LOCAL_INCLUDES += [
      "/layout/base",
@@ -1317,7 +1317,7 @@ diff --git a/widget/gtk/nsFilePicker.cpp b/widget/gtk/nsFilePicker.cpp
  #  include "Units.h"
  extern mozilla::LazyLogModule gWidgetLog;
  #  define LOG(args) MOZ_LOG(gWidgetLog, mozilla::LogLevel::Debug, args)
-@@ -242,17 +245,19 @@ nsFilePicker::AppendFilters(int32_t aFil
+@@ -236,17 +239,19 @@ nsFilePicker::AppendFilters(int32_t aFil
    mAllowURLs = !!(aFilterMask & filterAllowURLs);
    return nsBaseFilePicker::AppendFilters(aFilterMask);
  }
@@ -1338,7 +1338,7 @@ diff --git a/widget/gtk/nsFilePicker.cpp b/widget/gtk/nsFilePicker.cpp
  
    mFilters.AppendElement(filter);
    mFilterNames.AppendElement(name);
-@@ -352,16 +357,39 @@ nsresult nsFilePicker::Show(int16_t* aRe
+@@ -346,16 +351,39 @@ nsresult nsFilePicker::Show(int16_t* aRe
    return NS_OK;
  }
  
@@ -1378,7 +1378,7 @@ diff --git a/widget/gtk/nsFilePicker.cpp b/widget/gtk/nsFilePicker.cpp
    GtkFileChooserAction action = GetGtkFileChooserAction(mMode);
  
    const gchar* accept_button;
-@@ -581,16 +609,244 @@ void nsFilePicker::Done(void* file_choos
+@@ -575,16 +603,244 @@ void nsFilePicker::Done(void* file_choos
      mCallback->Done(result);
      mCallback = nullptr;
    } else {
@@ -1796,7 +1796,7 @@ diff --git a/xpcom/components/moz.build b/xpcom/components/moz.build
  ]
  
  if CONFIG["MOZ_WIDGET_TOOLKIT"] == "gtk":
-     CXXFLAGS += CONFIG["TK_CFLAGS"]
+     CXXFLAGS += CONFIG["MOZ_GTK3_CFLAGS"]
      if CONFIG["MOZ_ENABLE_DBUS"]:
          CXXFLAGS += CONFIG["MOZ_DBUS_GLIB_CFLAGS"]
  
@@ -1804,7 +1804,7 @@ diff --git a/xpcom/components/moz.build b/xpcom/components/moz.build
 diff --git a/xpcom/io/nsLocalFileUnix.cpp b/xpcom/io/nsLocalFileUnix.cpp
 --- a/xpcom/io/nsLocalFileUnix.cpp
 +++ b/xpcom/io/nsLocalFileUnix.cpp
-@@ -53,16 +53,17 @@
+@@ -54,16 +54,17 @@
  #include "prproces.h"
  #include "nsIDirectoryEnumerator.h"
  #include "nsSimpleEnumerator.h"
@@ -1822,7 +1822,7 @@ diff --git a/xpcom/io/nsLocalFileUnix.cpp b/xpcom/io/nsLocalFileUnix.cpp
  #  include "prmem.h"
  #  include "plbase64.h"
  
-@@ -2025,62 +2026,77 @@ nsLocalFile::SetPersistentDescriptor(con
+@@ -2071,62 +2072,77 @@ nsLocalFile::SetPersistentDescriptor(con
  
  NS_IMETHODIMP
  nsLocalFile::Reveal() {

mozilla-silence-no-return-type.patch

@@ -1,10 +1,10 @@
 # HG changeset patch
-# Parent  9b29b6b7548b93a599167774e747f6e0661cfbe1
+# Parent  216843712d6d6cd9d5bd519f6ef564d00406b43f
 
 diff --git a/Cargo.lock b/Cargo.lock
 --- a/Cargo.lock
 +++ b/Cargo.lock
-@@ -2078,18 +2078,16 @@ name = "glsl-to-cxx"
+@@ -2165,18 +2165,16 @@ name = "glsl-to-cxx"
  version = "0.1.0"
  dependencies = [
   "glsl",
@@ -26,24 +26,21 @@ diff --git a/Cargo.lock b/Cargo.lock
 diff --git a/Cargo.toml b/Cargo.toml
 --- a/Cargo.toml
 +++ b/Cargo.toml
-@@ -78,16 +78,17 @@ opt-level = 2
+@@ -102,13 +102,13 @@ moz_asserts = { path = "mozglue/static/r
- opt-level = 2
+ # Other overrides
- 
+ chardetng = { git = "https://github.com/hsivonen/chardetng", rev="3484d3e3ebdc8931493aa5df4d7ee9360a90e76b" }
- [patch.crates-io]
- chardetng = { git = "https://github.com/hsivonen/chardetng", rev="302c995f91f44cf26e77dc4758ad56c3ff0153ad" }
  chardetng_c = { git = "https://github.com/hsivonen/chardetng_c", rev="ed8a4c6f900a90d4dbc1d64b856e61490a1c3570" }
+ coremidi = { git = "https://github.com/chris-zen/coremidi.git", rev="fc68464b5445caf111e41f643a2e69ccce0b4f83" }
  libudev-sys = { path = "dom/webauthn/libudev-sys" }
  packed_simd = { git = "https://github.com/hsivonen/packed_simd", rev="8b4bd7d8229660a749dbe419a57ea01df9de5453" }
+ midir = { git = "https://github.com/mozilla/midir.git", rev = "4c11f0ffb5d6a10de4aff40a7b81218b33b94e6f" }
  minidump_writer_linux = { git = "https://github.com/msirringhaus/minidump_writer_linux.git", rev = "029ac0d54b237f27dc7d8d4e51bc0fb076e5e852" }
+-
 +glslopt = { path = "third_party/rust/glslopt/" }
- # The following overrides point to dummy projects, as a temporary measure until this is resolved:
+ # Patch mio 0.6 to use winapi 0.3 and miow 0.3, getting rid of winapi 0.2.
- # https://github.com/rust-lang/cargo/issues/6179
+ # There is not going to be new version of mio 0.6, mio now being >= 0.7.11.
- js-sys = { git = "https://github.com/kvark/dummy-web" }
+ [patch.crates-io.mio]
- slotmap = { git = "https://github.com/kvark/dummy-web" }
+ path = "third_party/rust/mio-0.6.23"
- wasm-bindgen = { git = "https://github.com/kvark/dummy-web" }
- web-sys = { git = "https://github.com/kvark/dummy-web" }
- 
- [patch.crates-io.cranelift-codegen]
 diff --git a/gfx/skia/skia/include/codec/SkEncodedOrigin.h b/gfx/skia/skia/include/codec/SkEncodedOrigin.h
 --- a/gfx/skia/skia/include/codec/SkEncodedOrigin.h
 +++ b/gfx/skia/skia/include/codec/SkEncodedOrigin.h

tar_stamps

@@ -1,10 +1,10 @@
 PRODUCT="firefox"
 CHANNEL="release"
-VERSION="96.0.3"
+VERSION="97.0"
 VERSION_SUFFIX=""
-PREV_VERSION="96.0.2"
+PREV_VERSION="96.0.3"
 PREV_VERSION_SUFFIX=""
 #SKIP_LOCALES="" # Uncomment to skip l10n and compare-locales-generation
 RELEASE_REPO="https://hg.mozilla.org/releases/mozilla-release"
-RELEASE_TAG="08a730393ae6e9e8f7096f1a040dc66948f245b1"
+RELEASE_TAG="71dce12fda8b1cf9c396a1900b4edf9844206ea5"
-RELEASE_TIMESTAMP="20220126154723"
+RELEASE_TIMESTAMP="20220202182137"