1
0
Commit Graph

341 Commits

Author SHA256 Message Date
Wolfgang Rosenauer
68b80ea39c - Mozilla Thunderbird 60.7.1
MFSA 2019-17 (boo#1137595)
  * CVE-2019-11703 (bmo#1553820)
    Heap buffer overflow in icalparser.c
  * CVE-2019-11704 (bmo#1553814)
    Heap buffer overflow in icalvalue.c
  * CVE-2019-11705 (bmo#1553808)
    Stack buffer overflow in icalrecur.c
  * CVE-2019-11706 (bmo#1555646)
    Type confusion in icalproperty.c

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=471
2019-06-14 05:42:27 +00:00
Wolfgang Rosenauer
04f1d004f6 Accepting request 708966 from home:aaronpuchert
Increase disk space requirements in _constraints, because some builds have run out of disk space on x86_64.

OBS-URL: https://build.opensuse.org/request/show/708966
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=470
2019-06-12 13:56:51 +00:00
Wolfgang Rosenauer
35447776a4 - Mozilla Thunderbird 60.7.0
* Attachment pane of Write window no longer focussed when attaching
    files using a keyboard shortcut
  MFSA 2019-15 (boo#1135824)
  * CVE-2019-9815 (bmo#1546544)
    Disable hyperthreading on content JavaScript threads on macOS
  * CVE-2019-9816 (bmo#1536768)
    Type confusion with object groups and UnboxedObjects
  * CVE-2019-9817 (bmo#1540221)
    Stealing of cross-domain images using canvas
  * CVE-2019-9818 (bmo#1542581) (Windows only)
    Use-after-free in crash generation server
  * CVE-2019-9819 (bmo#1532553)
    Compartment mismatch with fetch API
  * CVE-2019-9820 (bmo#1536405)
    Use-after-free of ChromeEventHandler by DocShell
  * CVE-2019-11691 (bmo#1542465)
    Use-after-free in XMLHttpRequest
  * CVE-2019-11692 (bmo#1544670)
    Use-after-free removing listeners in the event listener manager
  * CVE-2019-11693 (bmo#1532525)
    Buffer overflow in WebGL bufferdata on Linux
  * CVE-2019-7317 (bmo#1542829)
    Use-after-free in png_image_free of libpng library
  * CVE-2019-9797 (bmo#1528909)
    Cross-origin theft of images with createImageBitmap
  * CVE-2018-18511 (bmo#1526218)
    Cross-origin theft of images with ImageBitmapRenderingContext
  * CVE-2019-11694 (bmo#1534196) (Windows only)
    Uninitialized memory memory leakage in Windows sandbox

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=468
2019-05-25 20:31:48 +00:00
Wolfgang Rosenauer
35edb05724 Accepting request 697618 from home:marxin:branches:mozilla:Factory
Disable LTO (boo#1133267).

OBS-URL: https://build.opensuse.org/request/show/697618
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=466
2019-04-24 20:43:44 +00:00
Wolfgang Rosenauer
1c30fa795c - Add patch to fix build using rust-1.33: (boo#1130694)
* mozilla-bmo1519629.patch (bmo#1519629)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=463
2019-03-30 11:50:20 +00:00
Wolfgang Rosenauer
fa5d322d3e - Add patch to fix build using rust-1.33:
* mozilla-bmo1519629.patch

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=462
2019-03-30 11:48:53 +00:00
Wolfgang Rosenauer
3e2908cf21 - Mozilla Thunderbird 60.6.1
MFSA 2019-12 (bsc#1130262)
  * CVE-2019-9810 (bmo#1537924)
    IonMonkey MArraySlice has incorrect alias information
  * CVE-2019-9813 (bmo#1538006)
    Ionmonkey type confusion with __proto__ mutations

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=460
2019-03-27 16:08:50 +00:00
Wolfgang Rosenauer
82c07d74ff - Mozilla Thunderbird 60.6.0
* Calendar: Can't create repeating event with end date when using
    certain time zones, for example Europe/Minsk
  * some minor bugfixes
  * using 60.6.0esr Mozilla platform (bsc#1129821)

- Mozilla Thunderbird 60.5.3
  * fixed a regression on the Windows platform:
    Problem when using "Send to > Mail recipient" on Windows

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=458
2019-03-20 21:48:06 +00:00
Wolfgang Rosenauer
6fbce4789b - Mozilla Thunderbird 60.5.2
* UTF-8 support for MAPISendMail
  * Problem with S/MIME certificate verification when receiving email
    from Outlook (issue introduced in version 60.5.1)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=456
2019-02-26 17:37:51 +00:00
Wolfgang Rosenauer
e67981f7a0 - Mozilla Thunderbird 60.5.1
* CalDav access to some servers not working
  MFSA 2019-06 (bsc#1125330)
  * CVE-2018-18356 bmo#1525817
    Use-after-free in Skia
  * CVE-2019-5785 bmo#1525433
    Integer overflow in Skia
  * CVE-2018-18335 bmo#1525815
    Buffer overflow in Skia with accelerated Canvas 2D
  * CVE-2018-18509 bmo#1507218
    S/MIME signature spoofing
- Mozilla Thunderbird 60.5.0:

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=454
2019-02-14 22:12:08 +00:00
Wolfgang Rosenauer
d7db4b785d MFSA 2019-03 (bsc#1122983)
* CVE-2018-18500 bmo#1510114
    Use-after-free parsing HTML5 stream
  * CVE-2018-18505 bmo#1497749
    Privilege escalation through IPC channel messages
  * CVE-2016-5824 bmo#1275400
    DoS (use-after-free) via a crafted ics file
  * CVE-2018-18501 bmo#1512450 bmo#1517542 bmo#1513201 bmo#1460619
    bmo#1502871 bmo#1516738 bmo#1516514
    Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=452
2019-01-29 21:58:55 +00:00
Wolfgang Rosenauer
126ce832a3 changelog (security related) missing still
- MozillaThunderbird 60.5.0:
  * FileLink provider WeTransfer to upload large attachments
  * Thunderbird now allows the addition of OpenSearch search engines
    from a local XML file using a minimal user inferface: [+] button
    to select a file an add, [-] to remove.
  * More search engines: Google and DuckDuckGo available by default
    in some locales
  * During account creation, Thunderbird will now detect servers
    using the Microsoft Exchange protocol. It will offer the
    installation of a 3rd party add-on (Owl) which supports that
    protocol.
  * Thunderbird now compatible with other WebExtension-based
    FileLink add-ons like the Dropbox add-on
- requires NSS 3.36.7
- removed obsolete patch
  mozilla-no-stdcxx-check.patch
- rebased patches
  MFSA 2018-31
  * CVE-2018-17466 bmo#1488295
    Buffer overflow and out-of-bounds read in ANGLE library with
    TextureStorage11
  * CVE-2018-18492 bmo#1499861
    Use-after-free with select element
  * CVE-2018-18493 bmo#1504452
    Buffer overflow in accelerated 2D canvas with Skia
  * CVE-2018-18494 bmo#1487964
    Same-origin policy violation using location attribute and
    performance.getEntries to steal cross-origin URLs
  * CVE-2018-18498 bmo#1500011
    Integer overflow when calculating buffer sizes for images

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=451
2019-01-29 19:03:55 +00:00
Wolfgang Rosenauer
6953ad0d97 - requires NSS 3.36.6
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=448
2018-12-21 21:18:40 +00:00
Wolfgang Rosenauer
b67553185b Accepting request 660601 from home:AndreasStieger:branches:mozilla:Factory
Mozilla Thunderbird 60.4.0

OBS-URL: https://build.opensuse.org/request/show/660601
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=447
2018-12-21 21:10:16 +00:00
Wolfgang Rosenauer
47ff8451c2 - Mozilla Thunderbird 60.3.3
* Thunderbird 60 will migrate security databases (key3.db, cert8.db
    to key4.db, cert9.db). Thunderbird 60.3.2 and earlier contained a
    fault that potentially deleted saved passwords and private certificate
    keys for users using a master password. Version 60.3.3 will prevent
    the loss of data; affected users who have already upgraded to version
    60.3.2 or earlier can restore the deleted key3.db file from backup
    to complete the migration.
  * Address book search and auto-complete slowness introduced in
    Thunderbird 60.3.2
  * Plain text markup with * for bold, / for italics, _ for underline
    and | for code did not work when the enclosed text contained
    non-ASCII characters
  * While composing a message, a link not removed when link location
    was removed in the link properties panel

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=445
2018-12-05 21:18:03 +00:00
Wolfgang Rosenauer
0f47d98b6b Accepting request 653550 from home:AndreasStieger:branches:mozilla:Factory
- Fix build on openSUSE Leap 15.x w.r.t. rust-std requirement

OBS-URL: https://build.opensuse.org/request/show/653550
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=443
2018-12-03 15:06:20 +00:00
Wolfgang Rosenauer
e5fa4278bb - Mozilla Thunderbird 60.3.2
* Encoding problems when exporting address books or messages using
    the system charset. Messages are now always exported using the
    UTF-8 encoding
  * If the "Date" header of a message was invalid, Jan 1970 or Dec 1969
    was displayed. Now using date from "Received" header instead.
  * Body search/filtering didn't reliably ignore content of tags
  * Inappropriate warning "Thunderbird prevented the site
    (addons.thunderbird.net) from asking you to install software on
    your computer" when installing add-ons
  * Incorrect display of correspondents column since own email
    address was not always detected
  * Spurious 
 (encoded newline) inserted into drafts and sent email

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=442
2018-11-30 10:20:59 +00:00
Wolfgang Rosenauer
a3384a6fef Accepting request 649349 from home:AndreasStieger:branches:mozilla:Factory
Mozilla Thunderbird 60.3.1

OBS-URL: https://build.opensuse.org/request/show/649349
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=439
2018-11-16 06:40:27 +00:00
Wolfgang Rosenauer
effd24db38 - update to Thunderbird 60.3.0
* various theme fixes
  * Shift+PageUp/PageDown in Write window
  * Gloda attachment filtering
  * Mailing list address auto-complete enter/return handling
  * Thunderbird hung if HTML signature references non-existent image
  * Filters not working for headers that appear more than once
- Security fixes for the Mozilla platform picked up from 60.3
  (Firefox ESR release). In general, these flaws cannot be exploited
  through email in Thunderbird because scripting is disabled when
  reading mail, but are potentially risks in browser or browser-like
  contexts (MFSA 2018-28) (bsc#1112852)
  * CVE-2018-12391 (bmo#1478843) (Android only)
    HTTP Live Stream audio data is accessible cross-origin
  * CVE-2018-12392 (bmo#1492823)
    Crash with nested event loops
  * CVE-2018-12393 (bmo#1495011)
    Integer overflow during Unicode conversion while loading JavaScript
  * CVE-2018-12389 (bmo#1498460, bmo#1499198)
    Memory safety bugs fixed in Firefox ESR 60.3
  * CVE-2018-12390 (bmo#1487098, bmo#1487660, bmo#1490234, bmo#1496159,
    bmo#1443748, bmo#1496340, bmo#1483905, bmo#1493347, bmo#1488803,
    bmo#1498701, bmo#1498482, bmo#1442010, bmo#1495245, bmo#1483699,
    bmo#1469486, bmo#1484905, bmo#1490561, bmo#1492524, bmo#1481844)
    Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3

  * Fix security info dialog in compose window not showing

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=437
2018-11-01 17:28:09 +00:00
Wolfgang Rosenauer
9bb3d7bcac Accepting request 644807 from home:Guillaume_G:branches:mozilla:Factory
- Update _constraints for armv6/7
- Add patch to fix build on armv7:
  * mozilla-bmo1463035.patch
- Add memory-constraints to avoid OOM errors

OBS-URL: https://build.opensuse.org/request/show/644807
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=436
2018-10-29 08:28:50 +00:00
Wolfgang Rosenauer
234d7a115c Accepting request 641717 from home:msmeissn:branches:mozilla:Factory
- provide / obsolete MozillaThunderbird-devel as this is no longer
  shipped to allow migration scenarios

OBS-URL: https://build.opensuse.org/request/show/641717
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=434
2018-10-12 15:11:47 +00:00
Wolfgang Rosenauer
266f4763da Accepting request 640045 from home:AndreasStieger:branches:mozilla:Factory
add CVEs from MFSA 2018-25

OBS-URL: https://build.opensuse.org/request/show/640045
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=432
2018-10-05 09:08:04 +00:00
Wolfgang Rosenauer
c0d713ad9e Accepting request 640011 from home:AndreasStieger:branches:mozilla:Factory
some changelog additions. Are these okay for you?

OBS-URL: https://build.opensuse.org/request/show/640011
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=431
2018-10-04 20:00:55 +00:00
Wolfgang Rosenauer
46ff0ae0de - update to Thunderbird 60.2.1
* several bugfixes since release of version 60.0
  * security fixes for the Mozilla platform picked up from
    60.1 and 60.2 (Firefox ESR releases)
- Update file list since minidump-analyzer is only available when
  * Various fixes and changes to e-mail workflow

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=430
2018-10-03 20:05:00 +00:00
Wolfgang Rosenauer
31b60fdd31 Accepting request 635007 from home:Guillaume_G:branches:mozilla:Factory
- Update file list since minidump-analyzer is only available when crashreporter is enabled

OBS-URL: https://build.opensuse.org/request/show/635007
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=428
2018-09-12 09:58:10 +00:00
Wolfgang Rosenauer
c08272f856 Accepting request 632919 from home:AndreasStieger:branches:mozilla:Factory
Add changelog detail for MFSA 2018-19 (bsc#1098998)

OBS-URL: https://build.opensuse.org/request/show/632919
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=426
2018-09-03 20:13:55 +00:00
Wolfgang Rosenauer
affcd2db3c Accepting request 631539 from home:AndreasStieger:branches:mozilla:Factory
- remove non-free untar licenced code from distributed tarball

OBS-URL: https://build.opensuse.org/request/show/631539
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=423
2018-08-27 08:09:20 +00:00
Wolfgang Rosenauer
275bc9bdcb Accepting request 629370 from home:iznogood:branches:mozilla:Factory
- Add conditional for pkgconfig(gconf-2.0) BuildRequires, and pass
  conditional --disable-gconf to configure: no longer pull in
  obsolete gconf2 for Tumbleweed.

OBS-URL: https://build.opensuse.org/request/show/629370
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=422
2018-08-15 09:38:21 +00:00
Wolfgang Rosenauer
b3d2742026 * mozilla-develdirs.patch
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=421
2018-08-07 06:32:26 +00:00
Wolfgang Rosenauer
696d48eaf5 * tb-ssldap.patch
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=420
2018-08-06 21:32:03 +00:00
Wolfgang Rosenauer
cde9b1d6a6 - update to Thunderbird 60.0
* requires NSPR 4.19 and NSS 3.36.4
  * what's new
    https://www.thunderbird.net/en-US/thunderbird/60.0/releasenotes/
- source archives are now signed directly
  (removed checksum signature check)
- imported patches from Firefox 60
  * mozilla-bmo1375074.patch
  * mozilla-bmo1464766.patch
  * mozilla-i586-DecoderDoctorLogger.patch
  * mozilla-i586-domPrefs.patch
- removed obsolete patches
  * mozilla-language.patch
- removed -devel subpackage as old-style extensions are mainly gone
- storing of remote content settings fixed (boo#1084603)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=419
2018-08-06 14:26:01 +00:00
Wolfgang Rosenauer
93fe18dfd9 Accepting request 621937 from home:AndreasStieger:branches:mozilla:Factory
add bugzilla reference

OBS-URL: https://build.opensuse.org/request/show/621937
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=417
2018-07-10 17:29:54 +00:00
Wolfgang Rosenauer
1179b0a448 * Deleting or detaching attachments corrupted messages under certain
circumstances (bmo#1473893)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=416
2018-07-10 09:03:21 +00:00
Wolfgang Rosenauer
97874126cc - update to Thunderbird 52.9.1
* fix detaching attachments (bmo#1473893)
    otherwise might reveal decryted content to the attacker.
    "simple" HTML view

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=415
2018-07-10 06:54:09 +00:00
Wolfgang Rosenauer
5e3677350a Accepting request 620593 from home:AndreasStieger:branches:mozilla:Factory
add some bugzilla references

OBS-URL: https://build.opensuse.org/request/show/620593
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=411
2018-07-04 08:58:13 +00:00
Wolfgang Rosenauer
4460ca6a07 MFSA 2018-16 (bsc#1098998)
* CVE-2018-12359 (bmo#1459162)
    Buffer overflow using computed size of canvas element
  * CVE-2018-12360 (bmo#1459693)
    Use-after-free when using focus()
  * CVE-2018-12372 (bmo#1419417)
    S/MIME and PGP decryption oracles can be built with HTML emails
  * CVE-2018-12373 (bmo#1464667, bmo#1464056)
    S/MIME plaintext can be leaked through HTML reply/forward
  * CVE-2018-12362 (bmo#1452375)
    Integer overflow in SSSE3 scaler
  * CVE-2018-12363 (bmo#1464784)
    Use-after-free when appending DOM nodes
  * CVE-2018-12364 (bmo#1436241)
    CSRF attacks through 307 redirects and NPAPI plugins
  * CVE-2018-12365 (bmo#1459206)
    Compromised IPC child process can list local filenames
  * CVE-2018-12366 (bmo#1464039)
    Invalid data handling during QCMS transformations
  * CVE-2018-12374 (bmo#1462910)
    Using form to exfiltrate encrypted mail part by pressing enter in form field
  * CVE-2018-5188 (bmo#1456189,bmo#1456975,bmo#1465898,bmo#1392739,
    bmo#1451297,bmo#1464063,bmo#1437842,bmo#1442722,bmo#1452576,
    bmo#1450688,bmo#1458264,bmo#1458270,bmo#1465108,bmo#1464829,
    bmo#1464079,bmo#1463494,bmo#1458048)
    Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=410
2018-07-04 05:58:22 +00:00
Wolfgang Rosenauer
9a9de5cf1f - update to Thunderbird 52.9 (bsc#1098998)
- correct requires and provides handling (boo#1076907)
- reduce memory footprint with %ix86 at linking time via additional
  compiler flags (boo#1091376)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=409
2018-07-02 13:49:36 +00:00
Wolfgang Rosenauer
07cdaea7b5 Accepting request 620026 from home:AndreasStieger:branches:mozilla:Factory
- Build from upstream source archive and verify source signature
  (boo#1085780)

OBS-URL: https://build.opensuse.org/request/show/620026
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=408
2018-07-02 12:10:40 +00:00
Wolfgang Rosenauer
cd0e3ea9a0 - update to Thunderbird 52.8 (bsc#1092548)
MFSA 2018-13
  * CVE-2018-5183 (bmo#1454692)
    Backport critical security fixes in Skia
  * CVE-2018-5184 (bmo#1411592, bsc#1093152)
    Full plaintext recovery in S/MIME via chosen-ciphertext attack
  * CVE-2018-5154 (bmo#1443092)
    Use-after-free with SVG animations and clip paths
  * CVE-2018-5155 (bmo#1448774)
    Use-after-free with SVG animations and text paths
  * CVE-2018-5159 (bmo#1441941)
    Integer overflow and out-of-bounds write in Skia
  * CVE-2018-5161 (bmo#1411720)
    Hang via malformed headers
  * CVE-2018-5162 (bmo#1457721, bsc#1093152)
    Encrypted mail leaks plaintext through src attribute
  * CVE-2018-5170 (bmo#1411732)
    Filename spoofing for external attachments
  * CVE-2018-5168 (bmo#1449548)
    Lightweight themes can be installed without user interaction
  * CVE-2018-5174 (bmo#1447080) (Windows only)
    Windows Defender SmartScreen UI runs with less secure behavior
    for downloaded files in Windows 10 April 2018 Update
  * CVE-2018-5178 (bmo#1443891)
    Buffer overflow during UTF-8 to Unicode string conversion
    through legacy extension
  * CVE-2018-5185 (bmo#1450345)
    Leaking plaintext through HTML forms
  * CVE-2018-5150 (bmo#1388020,bmo#1433609,bmo#1409440,bmo#1448705,
    bmo#1451376,bmo#1452202,bmo#1444668,bmo#1393367,bmo#1411415,

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=406
2018-05-19 10:55:26 +00:00
Wolfgang Rosenauer
b632ec1b68 Accepting request 592294 from home:oertel:branches:mozilla:Factory
- Exclude bigendian archs for now, have not built
  since version 45.8.0
  ExcludeArch: ppc ppc64 s390 s390x

OBS-URL: https://build.opensuse.org/request/show/592294
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=404
2018-03-29 13:46:17 +00:00
Wolfgang Rosenauer
2fe1d46e22 Accepting request 590831 from home:AndreasStieger:branches:mozilla:Factory
Adjust changelog based on MFSA 2018-09

OBS-URL: https://build.opensuse.org/request/show/590831
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=402
2018-03-26 11:03:30 +00:00
Wolfgang Rosenauer
120baf56d9 - update to Thunderbird 52.7 (bsc#1085130)
* Searching message bodies of messages in local folders, including
    filter and quick filter operations, did not find content in
    message attachments
  * Better error handling for Yahoo accounts
  MFSA 2018-08
  * CVE-2018-5146 (bmo#1446062)
    Out of bounds memory write in libvorbis
  * CVE-2018-5147 (bmo#1446365)
    Out of bounds memory write in libtremor

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=401
2018-03-24 09:35:07 +00:00
Wolfgang Rosenauer
77c48f2707 * CVE-2017-7846 (bmo#1411716, bsc#1074043)
* CVE-2017-7847 (bmo#1411708, bsc#1074044)
  * CVE-2017-7848 (bmo#1411699, bsc#1074045)
  * CVE-2017-7829 (bmo#1423432, bsc#1074046)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=399
2018-02-16 09:09:25 +00:00
Wolfgang Rosenauer
f8a44525c7 - update to Thunderbird 52.6 (bsc#1077291)
* Searching message bodies of messages in local folders, including
    filter and quick filter operations, not working reliably: Content
    not found in base64-encode message parts, non-ASCII text not found
    and false positives found.
  * Defective messages (without at least one expected header) not shown
    in IMAP folders but shown on mobile devices
  * Calendar: Unintended task deletion if numlock is enabled
  * Mozilla platform security fixes
  MFSA 2018-04
  * CVE-2018-5095 (bmo#1418447)
    Integer overflow in Skia library during edge builder allocation
  * CVE-2018-5096 (bmo#1418922)
    Use-after-free while editing form elements
  * CVE-2018-5097 (bmo#1387427)
    Use-after-free when source document is manipulated during XSLT
  * CVE-2018-5098 (bmo#1399400)
    Use-after-free while manipulating form input elements
  * CVE-2018-5099 (bmo#1416878)
    Use-after-free with widget listener
  * CVE-2018-5102 (bmo#1419363)
    Use-after-free in HTML media elements
  * CVE-2018-5103 (bmo#1423159)
    Use-after-free during mouse event handling
  * CVE-2018-5104 (bmo#1425000)
    Use-after-free during font face manipulation
  * CVE-2018-5117 (bmo#1395508)
    URL spoofing with right-to-left text aligned left-to-right
  * CVE-2018-5089
    Memory safety bugs fixed in Firefox 58 and Firefox ESR 52.6

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=397
2018-01-26 07:14:05 +00:00
Wolfgang Rosenauer
fa26255979 Accepting request 559653 from home:AndreasStieger:branches:mozilla:Factory
changlog

OBS-URL: https://build.opensuse.org/request/show/559653
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=395
2017-12-23 21:58:24 +00:00
Wolfgang Rosenauer
a542d644fe - update to Thunderbird 52.5.2
* This releases fixes the "Mailsploit" vulnerability and other
    vulnerabilities detected by the "Cure53" audit
  MFSA 2017-30
  * CVE-2017-7845 (bmo#1402372)
    Buffer overflow when drawing and validating elements with ANGLE
    library using Direct 3D 9
  * CVE-2017-7846 (bmo#1411716)
    JavaScript Execution via RSS in mailbox:// origin
  * CVE-2017-7847 (bmo#1411708)
    Local path string can be leaked from RSS feed
  * CVE-2017-7848 (bmo#1411699)
    RSS Feed vulnerable to new line Injection
  * CVE-2017-7829 (bmo#1423432)
    Mailsploit part 1: From address with encoded null character is
    cut off in message header display

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=394
2017-12-23 20:06:58 +00:00
Wolfgang Rosenauer
a9f94c0e74 Accepting request 555272 from home:dimstar:Factory
- Explicitly buildrequires python2-xml: The build system relies on
  it. We wrongly relied on other packages pulling it in for us.

- Escape the usage of %{VERSION} when calling out to rpm.
  RPM 4.14 has %{VERSION} defined as 'the main packages version'.

OBS-URL: https://build.opensuse.org/request/show/555272
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=392
2017-12-11 08:32:59 +00:00
Wolfgang Rosenauer
ca09b0503f * Better support for Charter/Spectrum IMAP: Thunderbird will now
detect Charter's IMAP service and send an additional IMAP select
    command to the server. Check the various preferences ending in
    "force_select" to see whether auto-detection has discovered this case.
  * In search folders spanning multiple base folders clicking on a
    message sometimes marked another message as read
  * IMAP alerts have been corrected and now show the correct server
    name in case of connection problems
  * POP alerts have been corrected and now indicate connection problems
    in case the configured POP server cannot be found
  MFSA 2017-26

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=390
2017-11-25 07:08:27 +00:00
Wolfgang Rosenauer
db14770321 Accepting request 544396 from home:Zaitor:branches:mozilla:Factory
Resub rebased

OBS-URL: https://build.opensuse.org/request/show/544396
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=389
2017-11-22 19:21:46 +00:00
Wolfgang Rosenauer
21edfd304e - update to Thunderbird 52.5.0 (bsc#1068101)
MFSA 2017-25
  * CVE-2017-7828 (bmo#1406750. bmo#1412252)
    Use-after-free of PressShell while restyling layout
  * CVE-2017-7830 (bmo#1408990)
    Cross-origin URL information leak through Resource Timing API
  * CVE-2017-7826
    Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=388
2017-11-22 10:48:23 +00:00
Wolfgang Rosenauer
c0196e9638 * new behavior was introduced for replies to mailing list posts:
"When replying to a mailing list, reply will be sent to address
    in From header ignoring Reply-to header". A new preference
    mail.override_list_reply_to allows to restore the previous behavior.
  * Under certain circumstances (image attachment and non-image
    attachment), attached images were shown truncated in messages
    stored in IMAP folders not synchronised for offline use.
  * IMAP UIDs > 0x7FFFFFFF now handled properly
  Security fixes from Gecko 52.4esr
  * CVE-2017-7793 (bmo#1371889)
    Use-after-free with Fetch API
  * CVE-2017-7818 (bmo#1363723)
    Use-after-free during ARIA array manipulation
  * CVE-2017-7819 (bmo#1380292)
    Use-after-free while resizing images in design mode
  * CVE-2017-7824 (bmo#1398381)
    Buffer overflow when drawing and validating elements with ANGLE
  * CVE-2017-7805 (bmo#1377618) (fixed via NSS requirement)
    Use-after-free in TLS 1.2 generating handshake hashes
  * CVE-2017-7814 (bmo#1376036)
    Blob and data URLs bypass phishing and malware protection warnings
  * CVE-2017-7825 (bmo#1393624, bmo#1390980) (OSX-only)
    OS X fonts render some Tibetan and Arabic unicode characters as spaces
  * CVE-2017-7823 (bmo#1396320)
    CSP sandbox directive did not create a unique origin
  * CVE-2017-7810
    Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=386
2017-10-06 20:50:03 +00:00
Wolfgang Rosenauer
5a7900b24a Accepting request 531253 from home:AndreasStieger:branches:mozilla:Factory
Mozilla Thunderbird 52.4.0 (bsc#1060445)
MFSA/CVEs still missing...

OBS-URL: https://build.opensuse.org/request/show/531253
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=385
2017-10-04 15:11:54 +00:00
Wolfgang Rosenauer
86366658fe Accepting request 529099 from home:dimstar:Factory
- Add alsa-devel BuildRequires: we care for ALSA support to be
  built and thus need to ensure we get the dependencies in place.
  In the past, alsa-devel was pulled in by accident: we
  buildrequire libgnome-devel. This required esound-devel and that
  in turn pulled in alsa-devel for us. libgnome is being fixed to
  no longer require esound-devel.

OBS-URL: https://build.opensuse.org/request/show/529099
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=384
2017-09-28 08:25:59 +00:00
Wolfgang Rosenauer
3cf568899e - update to Thunderbird 52.3 (boo#1052829)
Fixed issues:
  * Unwanted inline images shown in rogue SPAM messages
  * Deleting message from the POP3 server not working when maildir
    storage was used
  * Message disposition flag (replied / forwarded) lost when reply or
    forwarded message was stored as draft and draft was sent later
  * Inline images not scaled to fit when printing
  * Selected text from another message sometimes included in a reply
  * No authorisation prompt displayed when inserting image into email
    body although image URL requires authentication
  * Large attachments taking a long time to open under some circumstances
  security
  Security fixes from Gecko 52.3esr
  * CVE-2017-7798 (bmo#1371586, bmo#1372112)
    XUL injection in the style editor in devtools
  * CVE-2017-7800 (bmo#1374047)
    Use-after-free in WebSockets during disconnection
  * CVE-2017-7801 (bmo#1371259)
    Use-after-free with marquee during window resizing
  * CVE-2017-7784 (bmo#1376087)
    Use-after-free with image observers
  * CVE-2017-7802 (bmo#1378147)
    Use-after-free resizing image elements
  * CVE-2017-7785 (bmo#1356985)
    Buffer overflow manipulating ARIA attributes in DOM
  * CVE-2017-7786 (bmo#1365189)
    Buffer overflow while painting non-displayable SVG
  * CVE-2017-7753 (bmo#1353312)
    Out-of-bounds read with cached style data and pseudo-elements#

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=382
2017-08-16 19:17:30 +00:00
Wolfgang Rosenauer
9c1bac3491 Accepting request 515837 from home:Andreas_Schwab:Factory
- mozilla-ucontext.patch: use ucontext_t instead of struct ucontext

OBS-URL: https://build.opensuse.org/request/show/515837
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=381
2017-08-10 06:56:53 +00:00
Wolfgang Rosenauer
a6a4f44e7b Accepting request 506827 from home:Guillaume_G:branches:mozilla:Factory
Remove the --disable-neon option as it is not available anymore.

OBS-URL: https://build.opensuse.org/request/show/506827
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=379
2017-06-29 09:32:34 +00:00
Wolfgang Rosenauer
1b6e938d0c - update to Thunderbird 52.2.1
* Problems with Gmail fixed (folders not showing, repeated email
    download, etc.) introduced in version 52.2.0. (boo#1045895)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=378
2017-06-26 05:17:01 +00:00
Wolfgang Rosenauer
d85085e956 - update to Thunderbird 52.2 (boo#1043960)
* Embedded images not shown in email received from Hotmail/Outlook
    webmailer
  * Detection of non-ASCII font names in font selector
  * Attachment not forwarded correctly under certain circumstances
  * Multiple requests for master password when GMail OAuth2 is enabled
  * Large number of blank pages being printed under certain
    circumstances when invalid preferences were present
  * Messages sent via the Simple MAPI interface are forced to HTML
  * Calendar: Invitations can't be printed
  * Mailing list (group) not accessible from macOS or Outlook address book
  * Clicking on links with references/anchors where target doesn't
    exist in the message not opening in external browser
  MFSA 2017-17
  * CVE-2017-5472 (bmo#1365602)
    Use-after-free using destroyed node when regenerating trees
  * CVE-2017-7749 (bmo#1355039)
    Use-after-free during docshell reloading
  * CVE-2017-7750 (bmo#1356558)
    Use-after-free with track elements
  * CVE-2017-7751 (bmo#1363396)
    Use-after-free with content viewer listeners
  * CVE-2017-7752 (bmo#1359547)
    Use-after-free with IME input
  * CVE-2017-7754 (bmo#1357090)
    Out-of-bounds read in WebGL with ImageInfo object
  * CVE-2017-7756 (bmo#1366595)
    Use-after-free and use-after-scope logging XHR header errors
  * CVE-2017-7757 (bmo#1356824)
    Use-after-free in IndexedDB

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=376
2017-06-15 11:08:05 +00:00
Wolfgang Rosenauer
a1880e072f - remove legacy -Os optimization breaking gcc7/i586 (boo#1042090)
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=374
2017-06-04 07:32:08 +00:00
Wolfgang Rosenauer
84d1aa88aa - explicitely optimize with -O2 for openSUSE > 13.2/Leap 42 to work
with gcc7 (boo#1040105, boo#1042090)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=370
2017-06-01 06:10:49 +00:00
Wolfgang Rosenauer
c8307ea894 - update to Thunderbird 52.1.1
* fixed crash when compacting IMAP folder (boo#1038753)
  * Some attachments could not be opened or saved if the message
    body is empty
  * Unable to load full message via POP if message was downloaded
    partially (or only headers) before
  * Large attachments may not be shown or saved correctly if the
    message is stored in an IMAP folder which is not synchronized
    for offline use

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=367
2017-05-15 20:50:25 +00:00
Wolfgang Rosenauer
7301b54ab6 - update to Thunderbird 52.1.0
* Background images not working and other issues related to
    embedded images when composing email have been fixed
  * Google Oauth setup can sometimes not progress to the next step
  * requires NSS >= 3.28.4
- security fixes (boo#1035082), MFSA 2017-13
  * CVE-2017-5443 (bmo#1342661)
    Out-of-bounds write during BinHex decoding
  * CVE-2017-5429 (bmo#1341096, bmo#1342823, bmo#1343261, bmo#1348894,
     bmo#1348941, bmo#1349340, bmo#1350844, bmo#1352926, bmo#1353088)
    Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and
    Firefox ESR 52.1
  * CVE-2017-5464 (bmo#1347075)
    Memory corruption with accessibility and DOM manipulation
  * CVE-2017-5465 (bmo#1347617)
    Out-of-bounds read in ConvolvePixel
  * CVE-2017-5466 (bmo#1353975)
    Origin confusion when reloading isolated data:text/html URL
  * CVE-2017-5467 (bmo#1347262)
    Memory corruption when drawing Skia content
  * CVE-2017-5460 (bmo#1343642)
    Use-after-free in frame selection
  * CVE-2017-5461 (bmo#1344380)
    Out-of-bounds write in Base64 encoding in NSS
  * CVE-2017-5449 (bmo#1340127)
    Crash during bidirectional unicode manipulation with animation
  * CVE-2017-5446 (bmo#1343505)
    Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data
  * CVE-2017-5447 (bmo#1343552)
    Out-of-bounds read during glyph processing

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=365
2017-05-02 07:59:46 +00:00
Wolfgang Rosenauer
55377bc24a - require libffi explicitely to fix PPC64LE build where a system
library is required

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=364
2017-04-19 09:45:54 +00:00
Wolfgang Rosenauer
cb96a9588a Accepting request 489077 from home:AndreasStieger:branches:mozilla:Factory
Adding changelog entries for 52:

- security fixes (bsc#1028391, MFSA 2017-09):
  In general, these flaws cannot be exploited through email because
  scripting is disabled when reading mail, but are potentially
  risks in browser or browser-like contexts.
  * CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP (bmo#1334933)
  * CVE-2017-5401: Memory Corruption when handling ErrorResult (bmo#1328861)
  * CVE-2017-5402: Use-after-free working with events in FontFace objects (bmo#1334876)
  * CVE-2017-5403: Use-after-free using addRange to add range to an incorrect root object (bmo#1340186)
  * CVE-2017-5404: Use-after-free working with ranges in selections (bmo#1340138)
  * CVE-2017-5406: Segmentation fault in Skia with canvas operations (bmo#1306890)
  * CVE-2017-5407: Pixel and history stealing via floating-point timing side channel with SVG filters (bmo#1336622)
  * CVE-2017-5410: Memory corruption during JavaScript garbage collection incremental sweeping (bmo#1330687)
  * CVE-2017-5408: Cross-origin reading of video captions in violation of CORS (bmo#1313711)
  * CVE-2017-5412: Buffer overflow read in SVG filters (bmo#1328323)
  * CVE-2017-5413: Segmentation fault during bidirectional operations (bmo#1337504)
  * CVE-2017-5414: File picker can choose incorrect default directory (bmo#1319370)
  * CVE-2017-5416: Null dereference crash in HttpChannel (bmo#1328121)
  * CVE-2017-5426: Gecko Media Plugin sandbox is not started if seccomp-bpf filter is running (bmo#1257361)
  * CVE-2017-5418: Out of bounds read when parsing HTTP digest authorization responses (bmo#1338876)
  * CVE-2017-5419: Repeated authentication prompts lead to DOS attack (bmo#1312243)
  * CVE-2017-5405: FTP response codes can cause use of uninitialized values for ports (bmo#1336699)
  * CVE-2017-5421: Print preview spoofing (bmo#1301876)
  * CVE-2017-5422: DOS attack by using view-source: protocol repeatedly in one hyperlink (bmo#1295002)
  * CVE-2017-5399: Memory safety bugs fixed in Thunderbird 52
  * CVE-2017-5398: Memory safety bugs fixed in Thunderbird 52 and Thunderbird 45.8

OBS-URL: https://build.opensuse.org/request/show/489077
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=363
2017-04-18 12:03:08 +00:00
Wolfgang Rosenauer
8699f618bd - update to Thunderbird 52.0.1
* Clicking on a link in an email may not open this link in the
    external browser
  * addon blocklist updates
- enable ALSA for systems w/o PA

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=362
2017-04-17 12:52:44 +00:00
Wolfgang Rosenauer
2fb682c18e - use Gtk3 for Tumbleweed
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=361
2017-04-02 21:31:26 +00:00
Wolfgang Rosenauer
5894d6fffd Accepting request 483796 from home:AndreasStieger:branches:mozilla:Factory
- fix build on Leap and Tumbleweed
- take tarball from release tag
- adjust mozilla-kde.patch to match

OBS-URL: https://build.opensuse.org/request/show/483796
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=360
2017-04-02 21:22:13 +00:00
Wolfgang Rosenauer
9d47ba1d60 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=359 2017-03-22 13:30:37 +00:00
Wolfgang Rosenauer
d6fa566d17 - update to Thunderbird 52.0
* Optionally remove corresponding data files when removing an account
  * Possibility to copy message filter
  * Calendar: Event can now be created and edited in a tab
  * Calendar: Processing of received invitation counter proposals
  * Chat: Support Twitter Direct Messages
  * Chat: Liking and favoriting in Twitter
  * Chat: Removed Yahoo! Messenger support
  * serveral bugfixes
- removed obsolete patches
  * mozilla-aarch64-48bit-va.patch
  * mozilla-binutils-visibility.patch
  * mozilla-flex_buffer_overrun.patch
  * mozilla-gcc6.patch
- added generic mozilla patches
  * mozilla-aarch64-startup-crash.patch
- require newer versions of NSPR and NSS

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=358
2017-03-18 21:27:55 +00:00
Wolfgang Rosenauer
e3be4ae3e0 - update to Thunderbird 45.8.0 (boo#1028391)
* MFSA 2017-07
    CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP
                   (bmo#1334933)
    CVE-2017-5401: Memory Corruption when handling ErrorResult
                   (bmo#1328861)
    CVE-2017-5402: Use-after-free working with events in FontFace
                   objects (bmo#1334876)
    CVE-2017-5404: Use-after-free working with ranges in selections
                   (bmo#1340138)
    CVE-2017-5407: Pixel and history stealing via floating-point
                   timing side channel with SVG filters (bmo#1336622)
    CVE-2017-5410: Memory corruption during JavaScript garbage
                   collection incremental sweeping (bmo#1330687)
    CVE-2017-5408: Cross-origin reading of video captions in violation
                   of CORS (bmo#1313711)
    CVE-2017-5405: FTP response codes can cause use of
                   uninitialized values for ports (bmo#1336699)
    CVE-2017-5398: Memory safety bugs fixed in Firefox 52 and
                   Firefox ESR 45.8

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=355
2017-03-09 16:34:03 +00:00
Wolfgang Rosenauer
ea8836e41b - update to Thunderbird 45.8.0
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=354
2017-03-08 14:16:14 +00:00
Wolfgang Rosenauer
85695aab79 - update to Thunderbird 45.7.1
* fixed Crash when viewing certain IMAP messages (introduced in 45.7.0)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=352
2017-02-09 10:45:25 +00:00
Wolfgang Rosenauer
9af44ffd70 Accepting request 452925 from home:AndreasStieger:branches:mozilla:Factory
Adjust CVE list as perMFSA 2017-03

OBS-URL: https://build.opensuse.org/request/show/452925
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=350
2017-01-27 13:27:58 +00:00
Wolfgang Rosenauer
cd4d95cddf - update to Thunderbird 45.7.0
* Message preview pane non-functional after IMAP folder was renamed
    or moved
  * "Move To" button on "Search Messages" panel not working
  * Message sent to "undisclosed recipients" shows no recipient
    (non-functional since Thunderbird version 38)
  * MFSA 2017-02 (Gecko 45.7.0)
    CVE-2017-5375: Excessive JIT code allocation allows bypass of
                   ASLR and DEP (bmo#1325200, boo#1021814)
    CVE-2017-5376: Use-after-free in XSL (bmo#1311687, boo#1021817)
    CVE-2017-5378: Pointer and frame data leakage of Javascript objects
                   (bmo#1312001, bmo#1330769, boo#1021818)
    CVE-2017-5380: Potential use-after-free during DOM manipulations
                   (bmo#1322107, boo#1021819)
    CVE-2017-5390: Insecure communication methods in Developer Tools
                   JSON viewer (bmo#1297361, boo#1021820)
    CVE-2017-5396: Use-after-free with Media Decoder
                   (bmo#1329403, boo#1021821)
    CVE-2017-5383: Location bar spoofing with unicode characters
                   (bmo#1323338, bmo#1324716, boo#1021822)
    CVE-2017-5386: WebExtensions can use data: protocol to affect other
                   extensions (bmo#1319070, boo#1021823)
    CVE-2017-5373: Memory safety bugs fixed in Firefox 51 and
                   Firefox ESR 45.7 (boo#1021824)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=349
2017-01-25 10:46:35 +00:00
Wolfgang Rosenauer
329b61bb18 * The system integration dialog was shown every time when starting
Thunderbird
  * MFSA 2016-96
    CVE-2016-9899: Use-after-free while manipulating DOM events and
                   audio elements (bmo#1317409)
    CVE-2016-9895: CSP bypass using marquee tag (bmo#1312272)
    CVE-2016-9897: Memory corruption in libGLES (bmo#1301381)
    CVE-2016-9898: Use-after-free in Editor while manipulating DOM
                   subtrees (bmo#1314442)
    CVE-2016-9900: Restricted external resources can be loaded by
                   SVG images through data URLs (bmo#1319122)
    CVE-2016-9904: Cross-origin information leak in shared atoms
                   (bmo#1317936)
    CVE-2016-9905: Crash in EnumerateSubDocuments (bmo#1293985)
    CVE-2016-9893: Memory safety bugs fixed in Thunderbird 45.6

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=347
2016-12-29 08:33:54 +00:00
Wolfgang Rosenauer
fc422ca055 - update to Thunderbird 45.6.0 (boo#1015422)
CVE-2016-5290: Memory safety bugs fixed in Thunderbird ESR 45.5

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=345
2016-12-16 13:14:25 +00:00
Wolfgang Rosenauer
eb2ff4df0b Accepting request 443018 from home:AndreasStieger:branches:mozilla:Factory
- Mozilla Thunderbird 45.5.1:
  * CVE-2016-9079: SVG Animation Remote Code Execution
                   (MFSA 2016-92, bsc#1012964, bmo#1321066)

OBS-URL: https://build.opensuse.org/request/show/443018
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=343
2016-12-01 17:32:58 +00:00
Wolfgang Rosenauer
d0c08cd8c9 Accepting request 440956 from home:AndreasStieger:branches:mozilla:Factory
- Mozilla Thunderbird 45.5.0 (boo#1009026)

OBS-URL: https://build.opensuse.org/request/show/440956
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=341
2016-11-19 14:26:56 +00:00
Wolfgang Rosenauer
fa72463659 - update to Thunderbird 45.4.0 (boo#999701)
* Display name was truncated if no separating space before email
    address.
  * Recipient addresses were shown in wrong color in some circumstances.
  * Additional spaces were inserted when drafts were edited.
  * Mail saved as template copied In-Reply-To and References from
    original email.
  * Threading broken when editing message draft, due to loss of Message-ID
  * "Apply columns to..." did not honor special folders

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=339
2016-10-01 18:21:17 +00:00
Wolfgang Rosenauer
f478d3d254 Accepting request 423866 from home:AndreasStieger:branches:mozilla:Factory
Use upstream versioning scheme - append .0

OBS-URL: https://build.opensuse.org/request/show/423866
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=337
2016-08-31 06:57:06 +00:00
Wolfgang Rosenauer
e77528174a - update to Thunderbird 45.3 (boo#991809)
* Disposition-Notification-To could not be used in
    mail.compose.other.header
  * "edit as new message" on a received message pre-filled the sender
    as the composing identity.
  * Certain messages caused corruption of the drafts summary database.
  security fixes:
  * MFSA 2016-62/CVE-2016-2836
    Miscellaneous memory safety hazards
  * MFSA 2016-63/CVE-2016-2830 (bmo#1255270)
    Favicon network connection can persist when page is closed
  * MFSA 2016-64/CVE-2016-2838 (bmo#1279814)
    Buffer overflow rendering SVG with bidirectional content
  * MFSA 2016-65/CVE-2016-2839 (bmo#1275339)
    Cairo rendering crash due to memory allocation issue with FFmpeg 0.10
  * MFSA 2016-67/CVE-2016-5252 (bmo#1268854)
    Stack underflow during 2D graphics rendering
  * MFSA 2016-70/CVE-2016-5254 (bmo#1266963)
    Use-after-free when using alt key and toplevel menus
  * MFSA 2016-72/CVE-2016-5258 (bmo#1279146)
    Use-after-free in DTLS during WebRTC session shutdown
  * MFSA 2016-73/CVE-2016-5259 (bmo#1282992)
    Use-after-free in service workers with nested sync events
  * MFSA 2016-76/CVE-2016-5262 (bmo#1277475)
    Scripts on marquee tag can execute in sandboxed iframes
  * MFSA 2016-77/CVE-2016-2837 (bmo#1274637)
    Buffer overflow in ClearKey Content Decryption Module (CDM)
    during video playback
  * MFSA 2016-78/CVE-2016-5263 (bmo#1276897)
    Type confusion in display transformation

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=336
2016-08-30 14:03:54 +00:00
Wolfgang Rosenauer
16ad6788d3 Accepting request 417429 from home:pcerny:mozilla:Factory
flex hotfix - changelog update

OBS-URL: https://build.opensuse.org/request/show/417429
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=334
2016-08-08 09:15:17 +00:00
Wolfgang Rosenauer
d81c4a7fc9 Accepting request 417133 from home:pcerny:mozilla:Factory
flex hotfix

OBS-URL: https://build.opensuse.org/request/show/417133
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=333
2016-08-05 19:12:21 +00:00
Wolfgang Rosenauer
0e16848923 Accepting request 412542 from home:Mailaender:branches:mozilla:Factory
added a screenshot for the upcoming software.opensuse.org changes

OBS-URL: https://build.opensuse.org/request/show/412542
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=331
2016-07-21 20:54:18 +00:00
Wolfgang Rosenauer
163d55c56a Accepting request 407284 from home:AndreasStieger:branches:mozilla:Factory
add CVEs

OBS-URL: https://build.opensuse.org/request/show/407284
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=329
2016-07-08 13:23:10 +00:00
Wolfgang Rosenauer
e6dba6284a Accepting request 406885 from home:AndreasStieger:branches:mozilla:Factory
build fix

OBS-URL: https://build.opensuse.org/request/show/406885
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=328
2016-07-06 12:33:21 +00:00
Wolfgang Rosenauer
be6d7c004a - update to Thunderbird 45.2 (boo#983549)
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=326
2016-06-30 09:53:29 +00:00
Wolfgang Rosenauer
12225ae415 - mozilla-binutils-visibility.patch to fix build issues with
gcc/binutils combination used in Leap 42.2 (boo#984637)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=325
2016-06-24 14:11:32 +00:00
Wolfgang Rosenauer
c29742319f - build with -fno-delete-null-pointer-checks for Tumbleweed/gcc6
as long as underlying issues have been addressed upstream
  (boo#986162)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=323
2016-06-23 14:40:05 +00:00
Wolfgang Rosenauer
7e7d69ebc9 Accepting request 401908 from home:algraf:branches:mozilla:Factory
- Fix running on 48bit va aarch64 (bsc#984126)
  - Add patch mozilla-aarch64-48bit-va.patch

OBS-URL: https://build.opensuse.org/request/show/401908
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=322
2016-06-14 19:47:55 +00:00
Wolfgang Rosenauer
e6a17911a5 - update to Thunderbird 45.1.1
* When entering members into a mailing list, the enter key
    dismissed the panel instead of just moving onto the next line
  * Email without HTML elements was sent as HTML, despite
    "Delivery Format: Auto-detect" option
  * Options applied to a template were lost when the template was used
  * Contacts could not be deleted when they were found through a search
  * Views from global searches did not respect
    "mail.threadpane.use_correspondents"

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=320
2016-05-31 08:09:00 +00:00
Wolfgang Rosenauer
e2e9d6aec1 Accepting request 398081 from home:badshah400:branches:mozilla:Factory
Fixed builds for TB the same way, applying the patches unconditionally. Again, sorry for breaking stuff earlier.

OBS-URL: https://build.opensuse.org/request/show/398081
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=319
2016-05-26 05:55:57 +00:00
Wolfgang Rosenauer
825fd5282e Accepting request 397789 from home:badshah400:branches:openSUSE:Factory:Rings:2-TestDVD
Add patches to fix building against gcc >= 6

OBS-URL: https://build.opensuse.org/request/show/397789
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=318
2016-05-25 07:19:28 +00:00
Wolfgang Rosenauer
9192f70485 Accepting request 395139 from home:dimstar:Factory
- Copy the icons to /usr/share/icons instead of symlinking them:
  in preparation for containerized apps (e.g. xdg-app) as well as
  AppStream metadata extraction, there are a couple locations that
  need to be real files for system integration (.desktop files,
  icons, mime-type info).

- The exact same fix was done in MozillaFirefox in March 2015

OBS-URL: https://build.opensuse.org/request/show/395139
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=316
2016-05-17 06:38:09 +00:00
Wolfgang Rosenauer
bde1e0ee1f - update to Thunderbird 45.1.0 (boo#977333)
* MFSA 2016-39/CVE-2016-2806/CVE-2016-2807 (boo#977375, boo#977376)
    Miscellaneous memory safety hazards
  in this particular case (i.e. do not pass
- update to Thunderbird 45.0 (boo#969894)
  * MFSA 2016-16/CVE-2016-1952/CVE-2016-1953
    Miscellaneous memory safety hazards
  * MFSA 2016-17/CVE-2016-1954 (bmo#1243178)
    Local file overwriting and potential privilege escalation through
    CSP reports
  * MFSA 2016-18/CVE-2016-1955 (bmo#1208946)
    CSP reports fail to strip location information for embedded iframe pages
  * MFSA 2016-19/CVE-2016-1956 (bmo#1199923)
    Linux video memory DOS with Intel drivers
  * MFSA 2016-20/CVE-2016-1957 (bmo#1227052)
    Memory leak in libstagefright when deleting an array during MP4
    processing
  * MFSA 2016-23/CVE-2016-1960/ZDI-CAN-3545 (bmo#1246014)
    Use-after-free in HTML5 string parser
  * MFSA 2016-24/CVE-2016-1961/ZDI-CAN-3574 (bmo#1249377)
    Use-after-free in SetBody
  * MFSA 2016-27/CVE-2016-1964 (bmo#1243335)
    Use-after-free during XML transformations
  * MFSA 2016-34/CVE-2016-1974 (bmo#1228103)
    Out-of-bounds read in HTML parser following a failed allocation
  * MFSA 2016-35/CVE-2016-1950 (bmo#1245528)
    Buffer overflow during ASN.1 decoding in NSS
    (fixed by requiring 3.21.1)
  * MFSA 2016-36/CVE-2016-1979 (bmo#1185033)
    Use-after-free during processing of DER encoded keys in NSS

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=315
2016-05-13 05:36:32 +00:00
Wolfgang Rosenauer
f244ebf410 - For openSUSE > 13.2, the build fails for i586 as it goes out of
memory. Prevent this from happening by disabing parallel build
  in this particular case (i.e. do not pass 
  mk_add_options MOZ_MAKE_FLAGS%{?jobs:-j%jobs}).

- update to Thunderbird 45.0
  * Add a Correspondents column combining Sender and Recipient
  * Much better support for XMPP chatrooms and commands
  * Remote content exceptions: Improved options to add exceptions
  * Implement option to always use HTML formatting to prevent
    unexpected format loss when converting messages to plain text
  * Use OpenStreetmap for maps (even allow the user to choose from
    list of map services)
  * Allow spell checking and dictionary selection in the subject line
  * Allow editing of From when composing a message
  * Add dropdown in compose to allow specific setting of font size
  * Return/Enter in composer will now insert a new paragraph by
    default (shift-Enter will insert a line break)
  * Allow copying of name and email address from the message header
    of an email
  * Mail.ru supports OAuth authentication

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=314
2016-04-30 13:53:52 +00:00
Wolfgang Rosenauer
c7c14f778a Accepting request 385776 from home:AndreasStieger:branches:mozilla:Factory
Mozilla Thunderbird 38.7.2

OBS-URL: https://build.opensuse.org/request/show/385776
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=312
2016-04-07 20:21:42 +00:00
Wolfgang Rosenauer
96f5c06ecf - update to Thunderbird 38.7.1
* disabled Graphite font shaping library

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=310
2016-03-25 20:24:23 +00:00
Wolfgang Rosenauer
df5751d33a - update to Thunderbird 38.7.0 (boo#969894)
* MFSA 2015-81/CVE-2015-4477 (bmo#1179484)
    Use-after-free in MediaStream playback
  * MFSA 2015-136/CVE-2015-7207 (bmo#1185256)
    Same-origin policy violation using performance.getEntries and
    history navigation
  * MFSA 2016-16/CVE-2016-1952
    Miscellaneous memory safety hazards
  * MFSA 2016-17/CVE-2016-1954 (bmo#1243178)
    Local file overwriting and potential privilege escalation through
    CSP reports
  * MFSA 2016-20/CVE-2016-1957 (bmo#1227052)
    Memory leak in libstagefright when deleting an array during MP4
    processing
  * MFSA 2016-21/CVE-2016-1958 (bmo#1228754)
    Displayed page address can be overridden
  * MFSA 2016-23/CVE-2016-1960/ZDI-CAN-3545 (bmo#1246014)
    Use-after-free in HTML5 string parser
  * MFSA 2016-24/CVE-2016-1961/ZDI-CAN-3574 (bmo#1249377)
    Use-after-free in SetBody
  * MFSA 2016-25/CVE-2016-1962 (bmo#1240760)
    Use-after-free when using multiple WebRTC data channels
  * MFSA 2016-27/CVE-2016-1964 (bmo#1243335)
    Use-after-free during XML transformations
  * MFSA 2016-28/CVE-2016-1965 (bmo#1245264)
    Addressbar spoofing though history navigation and Location protocol
    property
  * MFSA 2016-31/CVE-2016-1966 (bmo#1246054)
    Memory corruption with malicious NPAPI plugin
  * MFSA 2016-34/CVE-2016-1974 (bmo#1228103)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=308
2016-03-15 15:00:26 +00:00
Wolfgang Rosenauer
35e3b574dc Accepting request 361907 from home:AndreasStieger:branches:mozilla:Factory
adjust _constraints to current peak build memory and disk usage

OBS-URL: https://build.opensuse.org/request/show/361907
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=306
2016-02-26 20:59:10 +00:00