From f6f1953e39cebcc2f2920f3d7b95d0945ba2c0fc451093f5e3fb7a8db0b9f247 Mon Sep 17 00:00:00 2001 From: Wolfgang Rosenauer Date: Sat, 21 Jan 2017 08:10:15 +0000 Subject: [PATCH 1/5] Accepting request 451698 from home:bjoernv:branches:mozilla:Factory Firefox could not open Google, Wikipedia etc. with HTTPS anymore after update of NSS to 3.28 Sources: - https://bugs.gentoo.org/show_bug.cgi?id=603622 - https://bugzilla.redhat.com/show_bug.cgi?id=1413303#c5 - https://bugzilla.mozilla.org/show_bug.cgi?id=1290037 OBS-URL: https://build.opensuse.org/request/show/451698 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaFirefox?expand=0&rev=566 --- MozillaFirefox.changes | 10 ++++++++++ MozillaFirefox.spec | 4 +++- mozilla-ecdh-rfc7540.patch | 41 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 54 insertions(+), 1 deletion(-) create mode 100644 mozilla-ecdh-rfc7540.patch diff --git a/MozillaFirefox.changes b/MozillaFirefox.changes index 05904f4..c07ade4 100644 --- a/MozillaFirefox.changes +++ b/MozillaFirefox.changes @@ -1,3 +1,13 @@ +------------------------------------------------------------------- +Fri Jan 20 21:38:08 UTC 2017 - bjoernv@arcor.de + +- Firefox could not open Google, Wikipedia etc. with HTTPS anymore + after update of NSS to 3.28 + - Sources: + - https://bugs.gentoo.org/show_bug.cgi?id=603622 + - https://bugzilla.redhat.com/show_bug.cgi?id=1413303#c5 + - https://bugzilla.mozilla.org/show_bug.cgi?id=1290037 + ------------------------------------------------------------------- Mon Dec 12 21:18:41 UTC 2016 - wr@rosenauer.org diff --git a/MozillaFirefox.spec b/MozillaFirefox.spec index 206c66a..2f95810 100644 --- a/MozillaFirefox.spec +++ b/MozillaFirefox.spec @@ -1,7 +1,7 @@ # # spec file for package MozillaFirefox # -# Copyright (c) 2016 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany. # 2006-2016 Wolfgang Rosenauer # # All modifications and additions to the file contributed by third parties @@ -154,6 +154,7 @@ Patch103: firefox-branded-icons.patch # hotfix Patch150: mozilla-flex_buffer_overrun.patch Patch200: mozilla-aarch64-startup-crash.patch +Patch250: mozilla-ecdh-rfc7540.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build Requires(post): coreutils shared-mime-info desktop-file-utils @@ -268,6 +269,7 @@ cd $RPM_BUILD_DIR/mozilla %patch103 -p1 %patch150 -p1 %patch200 -p1 +%patch250 -p1 %build # no need to add build time to binaries diff --git a/mozilla-ecdh-rfc7540.patch b/mozilla-ecdh-rfc7540.patch new file mode 100644 index 0000000..fc12c7a --- /dev/null +++ b/mozilla-ecdh-rfc7540.patch @@ -0,0 +1,41 @@ +Patch for Gentoo Bug 603622 - nss-3.28 - Firefox refuses to load Google and other +http2 websites ( NS_ERROR_NET_INADEQUATE_SECURITY ) +Sources: +- https://bugs.gentoo.org/show_bug.cgi?id=603622 +- https://bugzilla.redhat.com/show_bug.cgi?id=1413303#c5 +- https://bugzilla.mozilla.org/show_bug.cgi?id=1290037 + +# HG changeset patch +# User Franziskus Kiefer +# Date 1469717280 -7200 +# Thu Jul 28 16:48:00 2016 +0200 +# Node ID 95aa61f1e3562e526bf88179d9d078fd90ad1bda +# Parent d42aacfe34af25e2f5110e2ca3d24a210eabeb33 +Update keybits in H2, r=mt + +MozReview-Commit-ID: 35oWoDMqe1Y + +diff --git a/netwerk/protocol/http/Http2Session.cpp b/netwerk/protocol/http/Http2Session.cpp +--- a/netwerk/protocol/http/Http2Session.cpp ++++ b/netwerk/protocol/http/Http2Session.cpp +@@ -3544,18 +3544,18 @@ Http2Session::ConfirmTLSProfile() + RETURN_SESSION_ERROR(this, INADEQUATE_SECURITY); + } + + uint32_t keybits = ssl->GetKEAKeyBits(); + if (kea == ssl_kea_dh && keybits < 2048) { + LOG3(("Http2Session::ConfirmTLSProfile %p FAILED due to DH %d < 2048\n", + this, keybits)); + RETURN_SESSION_ERROR(this, INADEQUATE_SECURITY); +- } else if (kea == ssl_kea_ecdh && keybits < 256) { // 256 bits is "security level" of 128 +- LOG3(("Http2Session::ConfirmTLSProfile %p FAILED due to ECDH %d < 256\n", ++ } else if (kea == ssl_kea_ecdh && keybits < 224) { // see rfc7540 9.2.1. ++ LOG3(("Http2Session::ConfirmTLSProfile %p FAILED due to ECDH %d < 224\n", + this, keybits)); + RETURN_SESSION_ERROR(this, INADEQUATE_SECURITY); + } + + int16_t macAlgorithm = ssl->GetMACAlgorithmUsed(); + LOG3(("Http2Session::ConfirmTLSProfile %p MAC Algortihm (aead==6) %d\n", + this, macAlgorithm)); + if (macAlgorithm != nsISSLSocketControl::SSL_MAC_AEAD) { From 0f2d4906dd155e4e07c98f939ae825a24579ced193ff41d060eed4b638fcb952 Mon Sep 17 00:00:00 2001 From: Wolfgang Rosenauer Date: Wed, 25 Jan 2017 10:27:08 +0000 Subject: [PATCH 2/5] - update to Firefox 51.0 * requires NSPR >= 4.13.1, NSS >= 3.28.1 * Added support for FLAC (Free Lossless Audio Codec) playback * Added support for WebGL 2 * Added Georgian (ka) and Kabyle (kab) locales * Support saving passwords for forms without 'submit' events * Improved video performance for users without GPU acceleration * Zoom indicator is shown in the URL bar if the zoom level is not at default level * View passwords from the prompt before saving them * Remove Belarusian (be) locale * Use Skia for content rendering (Linux) * MFSA 2017-01 CVE-2017-5375: Excessive JIT code allocation allows bypass of ASLR and DEP (bmo#1325200, boo#1021814) CVE-2017-5376: Use-after-free in XSL (bmo#1311687, boo#1021817) CVE-2017-5377: Memory corruption with transforms to create gradients in Skia (bmo#1306883, boo#1021826) CVE-2017-5378: Pointer and frame data leakage of Javascript objects (bmo#1312001, bmo#1330769, boo#1021818) CVE-2017-5379: Use-after-free in Web Animations (bmo#1309198,boo#1021827) CVE-2017-5380: Potential use-after-free during DOM manipulations (bmo#1322107, boo#1021819) CVE-2017-5390: Insecure communication methods in Developer Tools JSON viewer (bmo#1297361, boo#1021820) CVE-2017-5389: WebExtensions can install additional add-ons via modified host requests (bmo#1308688, boo#1021828) CVE-2017-5396: Use-after-free with Media Decoder (bmo#1329403, boo#1021821) OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaFirefox?expand=0&rev=567 --- MozillaFirefox.changes | 75 ++++++++- MozillaFirefox.spec | 25 ++- compare-locales.tar.xz | 4 +- create-tar.sh | 4 +- firefox-50.1.0-source.tar.xz | 3 - firefox-51.0-source.tar.xz | 3 + firefox-kde.patch | 247 ++++++++++-------------------- l10n-50.1.0.tar.xz | 3 - l10n-51.0.tar.xz | 3 + l10n_changesets.txt | 183 +++++++++++----------- mozilla-ecdh-rfc7540.patch | 41 ----- mozilla-flex_buffer_overrun.patch | 76 --------- mozilla-kde.patch | 106 ++++++------- mozilla-language.patch | 23 ++- mozilla-openaes-decl.patch | 4 +- mozilla-shared-nss-db.patch | 32 ++-- source-stamp.txt | 2 +- 17 files changed, 351 insertions(+), 483 deletions(-) delete mode 100644 firefox-50.1.0-source.tar.xz create mode 100644 firefox-51.0-source.tar.xz delete mode 100644 l10n-50.1.0.tar.xz create mode 100644 l10n-51.0.tar.xz delete mode 100644 mozilla-ecdh-rfc7540.patch delete mode 100644 mozilla-flex_buffer_overrun.patch diff --git a/MozillaFirefox.changes b/MozillaFirefox.changes index c07ade4..7f8f45f 100644 --- a/MozillaFirefox.changes +++ b/MozillaFirefox.changes @@ -1,12 +1,73 @@ ------------------------------------------------------------------- -Fri Jan 20 21:38:08 UTC 2017 - bjoernv@arcor.de +Fri Jan 20 13:57:56 UTC 2017 - wr@rosenauer.org -- Firefox could not open Google, Wikipedia etc. with HTTPS anymore - after update of NSS to 3.28 - - Sources: - - https://bugs.gentoo.org/show_bug.cgi?id=603622 - - https://bugzilla.redhat.com/show_bug.cgi?id=1413303#c5 - - https://bugzilla.mozilla.org/show_bug.cgi?id=1290037 +- update to Firefox 51.0 + * requires NSPR >= 4.13.1, NSS >= 3.28.1 + * Added support for FLAC (Free Lossless Audio Codec) playback + * Added support for WebGL 2 + * Added Georgian (ka) and Kabyle (kab) locales + * Support saving passwords for forms without 'submit' events + * Improved video performance for users without GPU acceleration + * Zoom indicator is shown in the URL bar if the zoom level is not + at default level + * View passwords from the prompt before saving them + * Remove Belarusian (be) locale + * Use Skia for content rendering (Linux) + * MFSA 2017-01 + CVE-2017-5375: Excessive JIT code allocation allows bypass of + ASLR and DEP (bmo#1325200, boo#1021814) + CVE-2017-5376: Use-after-free in XSL (bmo#1311687, boo#1021817) + CVE-2017-5377: Memory corruption with transforms to create + gradients in Skia (bmo#1306883, boo#1021826) + CVE-2017-5378: Pointer and frame data leakage of Javascript objects + (bmo#1312001, bmo#1330769, boo#1021818) + CVE-2017-5379: Use-after-free in Web Animations + (bmo#1309198,boo#1021827) + CVE-2017-5380: Potential use-after-free during DOM manipulations + (bmo#1322107, boo#1021819) + CVE-2017-5390: Insecure communication methods in Developer Tools + JSON viewer (bmo#1297361, boo#1021820) + CVE-2017-5389: WebExtensions can install additional add-ons via + modified host requests (bmo#1308688, boo#1021828) + CVE-2017-5396: Use-after-free with Media Decoder + (bmo#1329403, boo#1021821) + CVE-2017-5381: Certificate Viewer exporting can be used to navigate + and save to arbitrary filesystem locations + (bmo#1017616, boo#1021830) + CVE-2017-5382: Feed preview can expose privileged content errors + and exceptions (bmo#1295322, boo#1021831) + CVE-2017-5383: Location bar spoofing with unicode characters + (bmo#1323338, bmo#1324716, boo#1021822) + CVE-2017-5384: Information disclosure via Proxy Auto-Config (PAC) + (bmo#1255474, boo#1021832) + CVE-2017-5385: Data sent in multipart channels ignores referrer-policy + response headers (bmo#1295945, boo#1021833) + CVE-2017-5386: WebExtensions can use data: protocol to affect other + extensions (bmo#1319070, boo#1021823) + CVE-2017-5394: Android location bar spoofing using fullscreen and + JavaScript events (bmo#1222798) + CVE-2017-5391: Content about: pages can load privileged about: pages + (bmo#1309310, boo#1021835) + CVE-2017-5392: Weak references using multiple threads on weak proxy + objects lead to unsafe memory usage (bmo#1293709) + (Android only) + CVE-2017-5393: Remove addons.mozilla.org CDN from whitelist for + mozAddonManager (bmo#1309282, boo#1021837) + CVE-2017-5395: Android location bar spoofing during scrolling + (bmo#1293463) (Android only) + CVE-2017-5387: Disclosure of local file existence through TRACK + tag error messages (bmo#1295023, boo#1021839) + CVE-2017-5388: WebRTC can be used to generate a large amount of + UDP traffic for DDOS attacks + (bmo#1281482, boo#1021840) + CVE-2017-5374: Memory safety bugs fixed in Firefox 51 (boo#1021841) + CVE-2017-5373: Memory safety bugs fixed in Firefox 51 and + Firefox ESR 45.7 (boo#1021824) +- switch Firefox to Gtk3 for Tumbleweed +- removed obsolete patches + * mozilla-flex_buffer_overrun.patch +- updated RPM locale support tag +- improve recognition of LANGUAGE env variable (boo#1017174) ------------------------------------------------------------------- Mon Dec 12 21:18:41 UTC 2016 - wr@rosenauer.org diff --git a/MozillaFirefox.spec b/MozillaFirefox.spec index 2f95810..28276f1 100644 --- a/MozillaFirefox.spec +++ b/MozillaFirefox.spec @@ -2,7 +2,7 @@ # spec file for package MozillaFirefox # # Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany. -# 2006-2016 Wolfgang Rosenauer +# 2006-2017 Wolfgang Rosenauer # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -18,10 +18,10 @@ # changed with every update -%define major 50 -%define mainver %major.1.0 +%define major 51 +%define mainver %major.0 %define update_channel release -%define releasedate 20161212000000 +%define releasedate 20170119000000 # PIE, full relro (x86_64 for now) %define build_hardened 1 @@ -36,6 +36,9 @@ %define pkgname firefox-dev-edition %define appname Firefox Developer Edition %endif +%if 0%{?suse_version} > 1320 +%define firefox_use_gtk3 1 +%endif %define progdir %{_prefix}/%_lib/%{progname} %define gnome_dir %{_prefix} %define desktop_file_name %{progname} @@ -74,8 +77,8 @@ BuildRequires: libiw-devel BuildRequires: libnotify-devel BuildRequires: libproxy-devel BuildRequires: makeinfo -BuildRequires: mozilla-nspr-devel >= 4.12 -BuildRequires: mozilla-nss-devel >= 3.26.2 +BuildRequires: mozilla-nspr-devel >= 4.13.1 +BuildRequires: mozilla-nss-devel >= 3.28.1 BuildRequires: nss-shared-helper-devel BuildRequires: python-devel BuildRequires: startup-notification-devel @@ -152,9 +155,7 @@ Patch101: firefox-kde.patch Patch102: firefox-no-default-ualocale.patch Patch103: firefox-branded-icons.patch # hotfix -Patch150: mozilla-flex_buffer_overrun.patch Patch200: mozilla-aarch64-startup-crash.patch -Patch250: mozilla-ecdh-rfc7540.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build Requires(post): coreutils shared-mime-info desktop-file-utils @@ -204,7 +205,7 @@ of %{appname}. %package translations-other Summary: Extra translations for %{appname} Group: System/Localization -Provides: locale(%{name}:ach;af;an;as;ast;az;be;bg;bn_BD;bn_IN;br;bs;cak;cy;dsb;en_ZA;eo;es_MX;et;eu;fa;ff;fy_NL;ga_IE;gd;gl;gn;gu_IN;he;hi_IN;hr;hsb;hy_AM;id;is;kk;km;kn;lij;lt;lv;mai;mk;ml;mr;ms;nn_NO;or;pa_IN;rm;ro;si;sk;sl;son;sq;sr;ta;te;th;tr;uk;uz;vi;xh) +Provides: locale(%{name}:ach;af;an;as;ast;az;bg;bn_BD;bn_IN;br;bs;cak;cy;dsb;en_ZA;eo;es_MX;et;eu;fa;ff;fy_NL;ga_IE;gd;gl;gn;gu_IN;he;hi_IN;hr;hsb;hy_AM;id;is;ka;kab;kk;km;kn;lij;lt;lv;mai;mk;ml;mr;ms;nn_NO;or;pa_IN;rm;ro;si;sk;sl;son;sq;sr;ta;te;th;tr;uk;uz;vi;xh) Requires: %{name} = %{version} Obsoletes: %{name}-translations < %{version}-%{release} @@ -267,9 +268,7 @@ cd $RPM_BUILD_DIR/mozilla %patch101 -p1 %patch102 -p1 %patch103 -p1 -%patch150 -p1 %patch200 -p1 -%patch250 -p1 %build # no need to add build time to binaries @@ -399,9 +398,9 @@ install -m 644 %{SOURCE9} %{buildroot}%{progdir}/browser/defaults/preferences/fi %if %localize rm -f %{_tmppath}/translations.* touch %{_tmppath}/translations.{common,other} -for locale in $(awk '{ print $1; }' ../mozilla/browser/locales/shipped-locales); do +for locale in $(awk '{ print $1; }' %{SOURCE17}); do case $locale in - ja-JP-mac|en-US) + ja-JP-mac|en-US|'') ;; *) pushd $RPM_BUILD_DIR/compare-locales diff --git a/compare-locales.tar.xz b/compare-locales.tar.xz index b283d28..2981caf 100644 --- a/compare-locales.tar.xz +++ b/compare-locales.tar.xz @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:117aadfa96671239dd02fd11b3cfcd219fb5b3637a2400f532169dbd38d1729c -size 28352 +oid sha256:12c32d95d0c71f3fbfc29c6931b0ff0c57f4f696bd60aef2413cfcc7e9e9d3d2 +size 28376 diff --git a/create-tar.sh b/create-tar.sh index e2cbf04..a9ce290 100644 --- a/create-tar.sh +++ b/create-tar.sh @@ -7,8 +7,8 @@ CHANNEL="release" BRANCH="releases/mozilla-$CHANNEL" -RELEASE_TAG="8612c3320053b796678921f8f23358e3e9df997e" -VERSION="50.1.0" +RELEASE_TAG="ea82b5e20cbbd103f8fa65f0df0386ee4135cc47" +VERSION="51.0" # mozilla if [ -d mozilla ]; then diff --git a/firefox-50.1.0-source.tar.xz b/firefox-50.1.0-source.tar.xz deleted file mode 100644 index a996a7e..0000000 --- a/firefox-50.1.0-source.tar.xz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:0d45f1d01b6375aa3323f8f457d7ee85c5bf7bb9acdfdd51a366d808c2f10d04 -size 206009156 diff --git a/firefox-51.0-source.tar.xz b/firefox-51.0-source.tar.xz new file mode 100644 index 0000000..87f8dc0 --- /dev/null +++ b/firefox-51.0-source.tar.xz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:4eebff694596c0e614ffb160420c67bbc087ba741464b71f283a1acb6c3b334d +size 213540564 diff --git a/firefox-kde.patch b/firefox-kde.patch index e2c4a87..f2ef0e6 100644 --- a/firefox-kde.patch +++ b/firefox-kde.patch @@ -1,11 +1,11 @@ # HG changeset patch -# Parent 2cb2f829aabd7e3efaa973a0a8cf99aca9605bdc +# Parent 2cae514c05c8836ca5b69884d3a07998a5d53e8b diff --git a/browser/base/content/browser-kde.xul b/browser/base/content/browser-kde.xul new file mode 100644 --- /dev/null +++ b/browser/base/content/browser-kde.xul -@@ -0,0 +1,1200 @@ +@@ -0,0 +1,1119 @@ +#filter substitution + +# -*- Mode: HTML -*- @@ -160,14 +160,7 @@ new file mode 100644 + noautofocus="true" + hidden="true" + flip="none" -+ level="parent"> -+#ifdef NIGHTLY_BUILD -+ -+