From 2dbba8a23d63be5e18849092fde20b70816de86b2cc40d2d5d930c08bd5de998 Mon Sep 17 00:00:00 2001 From: Wolfgang Rosenauer Date: Wed, 11 Dec 2013 08:31:54 +0000 Subject: [PATCH] - update to Firefox 26.0 (bnc#854367, bnc#854370) * rebased patches * requires NSPR 4.10.2 and NSS 3.15.3.1 * MFSA 2013-104/CVE-2013-5609/CVE-2013-5610 Miscellaneous memory safety hazards * MFSA 2013-105/CVE-2013-5611 (bmo#771294) Application Installation doorhanger persists on navigation * MFSA 2013-106/CVE-2013-5612 (bmo#871161) Character encoding cross-origin XSS attack * MFSA 2013-107/CVE-2013-5614 (bmo#886262) Sandbox restrictions not applied to nested object elements * MFSA 2013-108/CVE-2013-5616 (bmo#938341) Use-after-free in event listeners * MFSA 2013-109/CVE-2013-5618 (bmo#926361) Use-after-free during Table Editing * MFSA 2013-110/CVE-2013-5619 (bmo#917841) Potential overflow in JavaScript binary search algorithms * MFSA 2013-111/CVE-2013-6671 (bmo#930281) Segmentation violation when replacing ordered list elements * MFSA 2013-112/CVE-2013-6672 (bmo#894736) Linux clipboard information disclosure though selection paste * MFSA 2013-113/CVE-2013-6673 (bmo#970380) Trust settings for built-in roots ignored during EV certificate validation * MFSA 2013-114/CVE-2013-5613 (bmo#930381, bmo#932449) Use-after-free in synthetic mouse movement * MFSA 2013-115/CVE-2013-5615 (bmo#929261) GetElementIC typed array stubs can be generated outside observed typesets * MFSA 2013-116/CVE-2013-6629/CVE-2013-6630 (bmo#891693) OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaFirefox?expand=0&rev=358 --- MozillaFirefox.changes | 40 ++++++++ MozillaFirefox.spec | 12 +-- compare-locales.tar.bz2 | 4 +- create-tar.sh | 4 +- firefox-25.0-source.tar.bz2 | 3 - firefox-26.0-source.tar.bz2 | 3 + firefox-kde.patch | 39 ++++---- firefox-multilocale-chrome.patch | 12 +-- gecko.js | 1 - l10n-25.0.tar.bz2 | 3 - l10n-26.0.tar.bz2 | 3 + mozilla-kde.patch | 167 +++++++++++++------------------ mozilla-nongnome-proxies.patch | 4 +- mozilla-shared-nss-db.patch | 27 +++-- source-stamp.txt | 2 +- 15 files changed, 165 insertions(+), 159 deletions(-) delete mode 100644 firefox-25.0-source.tar.bz2 create mode 100644 firefox-26.0-source.tar.bz2 delete mode 100644 gecko.js delete mode 100644 l10n-25.0.tar.bz2 create mode 100644 l10n-26.0.tar.bz2 diff --git a/MozillaFirefox.changes b/MozillaFirefox.changes index d75d62d..c7e4b48 100644 --- a/MozillaFirefox.changes +++ b/MozillaFirefox.changes @@ -1,3 +1,43 @@ +------------------------------------------------------------------- +Sun Dec 8 20:26:23 UTC 2013 - wr@rosenauer.org + +- update to Firefox 26.0 (bnc#854367, bnc#854370) + * rebased patches + * requires NSPR 4.10.2 and NSS 3.15.3.1 + * MFSA 2013-104/CVE-2013-5609/CVE-2013-5610 + Miscellaneous memory safety hazards + * MFSA 2013-105/CVE-2013-5611 (bmo#771294) + Application Installation doorhanger persists on navigation + * MFSA 2013-106/CVE-2013-5612 (bmo#871161) + Character encoding cross-origin XSS attack + * MFSA 2013-107/CVE-2013-5614 (bmo#886262) + Sandbox restrictions not applied to nested object elements + * MFSA 2013-108/CVE-2013-5616 (bmo#938341) + Use-after-free in event listeners + * MFSA 2013-109/CVE-2013-5618 (bmo#926361) + Use-after-free during Table Editing + * MFSA 2013-110/CVE-2013-5619 (bmo#917841) + Potential overflow in JavaScript binary search algorithms + * MFSA 2013-111/CVE-2013-6671 (bmo#930281) + Segmentation violation when replacing ordered list elements + * MFSA 2013-112/CVE-2013-6672 (bmo#894736) + Linux clipboard information disclosure though selection paste + * MFSA 2013-113/CVE-2013-6673 (bmo#970380) + Trust settings for built-in roots ignored during EV certificate + validation + * MFSA 2013-114/CVE-2013-5613 (bmo#930381, bmo#932449) + Use-after-free in synthetic mouse movement + * MFSA 2013-115/CVE-2013-5615 (bmo#929261) + GetElementIC typed array stubs can be generated outside observed + typesets + * MFSA 2013-116/CVE-2013-6629/CVE-2013-6630 (bmo#891693) + JPEG information leak + * MFSA 2013-117 (bmo#946351) + Mis-issued ANSSI/DCSSI certificate + (fixed via NSS 3.15.3.1) +- removed gecko.js preference file as GStreamer is enabled by + default now + ------------------------------------------------------------------- Thu Oct 24 18:16:19 UTC 2013 - wr@rosenauer.org diff --git a/MozillaFirefox.spec b/MozillaFirefox.spec index d672b85..c2b3cd6 100644 --- a/MozillaFirefox.spec +++ b/MozillaFirefox.spec @@ -17,7 +17,7 @@ # -%define major 25 +%define major 26 %define mainver %major.0 %define update_channel release @@ -50,8 +50,8 @@ BuildRequires: libproxy-devel %else BuildRequires: wireless-tools %endif -BuildRequires: mozilla-nspr-devel >= 4.10.1 -BuildRequires: mozilla-nss-devel >= 3.15.2 +BuildRequires: mozilla-nspr-devel >= 4.10.2 +BuildRequires: mozilla-nss-devel >= 3.15.3.1 BuildRequires: nss-shared-helper-devel %if %suse_version > 1210 BuildRequires: pkgconfig(gstreamer-%gstreamer_ver) @@ -63,7 +63,7 @@ Recommends: gstreamer-0_10-plugins-ffmpeg %endif Version: %{mainver} Release: 0 -%define releasedate 2013102400 +%define releasedate 2013120700 Provides: firefox = %{mainver} Provides: firefox = %{version}-%{release} Provides: web_browser @@ -91,7 +91,6 @@ Source11: firefox.1 Source12: mozilla-get-app-id Source13: add-plugins.sh.in Source14: create-tar.sh -Source15: gecko.js # Gecko/Toolkit Patch1: toolkit-download-folder.patch Patch2: mozilla-nongnome-proxies.patch @@ -362,9 +361,6 @@ mkdir -p $RPM_BUILD_ROOT%{progdir}/browser/defaults/preferences/ install -m 644 %{SOURCE6} $RPM_BUILD_ROOT%{progdir}/browser/defaults/preferences/kde.js install -m 644 %{SOURCE9} $RPM_BUILD_ROOT%{progdir}/browser/defaults/preferences/firefox.js %endif -# core configuration (e.g. temporary gstreamer pref) -# this is expected to be just temporary and therefore not handled in openSUSE branding -install -m 644 %{SOURCE15} $RPM_BUILD_ROOT%{progdir}/defaults/pref/gecko.js # install add-plugins.sh sed "s:%%PROGDIR:%{progdir}:g" \ %{SOURCE13} > $RPM_BUILD_ROOT%{progdir}/add-plugins.sh diff --git a/compare-locales.tar.bz2 b/compare-locales.tar.bz2 index ad0a074..5c8ca04 100644 --- a/compare-locales.tar.bz2 +++ b/compare-locales.tar.bz2 @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:a2dc72bf30a7defc9046866286cce2ca2f5d255248d3625d6c6a23bfc91420ca -size 29959 +oid sha256:a93081c3f66e8b9f24509d773c5d0d7807679b1ec262846413d2093068572caa +size 29858 diff --git a/create-tar.sh b/create-tar.sh index 27ae551..71654f9 100644 --- a/create-tar.sh +++ b/create-tar.sh @@ -2,8 +2,8 @@ CHANNEL="release" BRANCH="releases/mozilla-$CHANNEL" -RELEASE_TAG="FIREFOX_25_0_RELEASE" -VERSION="25.0" +RELEASE_TAG="FIREFOX_26_0_RELEASE" +VERSION="26.0" # mozilla if [ -d mozilla ]; then diff --git a/firefox-25.0-source.tar.bz2 b/firefox-25.0-source.tar.bz2 deleted file mode 100644 index 0cf9078..0000000 --- a/firefox-25.0-source.tar.bz2 +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:3debc8f5e6f92abb2d38644ad0b302c91d518827729e49340ef64053180d24b7 -size 128652118 diff --git a/firefox-26.0-source.tar.bz2 b/firefox-26.0-source.tar.bz2 new file mode 100644 index 0000000..0548902 --- /dev/null +++ b/firefox-26.0-source.tar.bz2 @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:4a146ac1688d3ef4c6c0d448604383882783bd52c6be2cecf18ab5ed3a4b33e1 +size 128663938 diff --git a/firefox-kde.patch b/firefox-kde.patch index dbc9d2b..910f4e1 100644 --- a/firefox-kde.patch +++ b/firefox-kde.patch @@ -2,7 +2,7 @@ diff --git a/browser/base/content/browser-kde.xul b/browser/base/content/browser new file mode 100644 --- /dev/null +++ b/browser/base/content/browser-kde.xul -@@ -0,0 +1,1161 @@ +@@ -0,0 +1,1158 @@ +#filter substitution + +# -*- Mode: HTML -*- @@ -129,6 +129,9 @@ new file mode 100644 + +