-------------------------------------------------------------------

Sun Jun  7 07:09:12 UTC 2015 - wr@rosenauer.org

- update to Firefox 38.0.6

  * fixes bmo#1171730 which is not really relevant to oS builds

- fix KDE regression from 38.0.5 builds (bsc#933439)

-------------------------------------------------------------------

Sat May 23 21:13:49 UTC 2015 - wr@rosenauer.org

- update to Firefox 38.0.5

  * Keep track of articles and videos with Pocket

  * Clean formatting for articles and blog posts with Reader View

  * Share the active tab or window in a Hello conversation

- add changes file as source for SRPM (bsc#932142)

-------------------------------------------------------------------

Fri May 15 10:40:19 UTC 2015 - normand@linux.vnet.ibm.com

- add mozilla-add-glibcxx_use_cxx11_abi.patch grabbed from

  https://bugzilla.mozilla.org/show_bug.cgi?id=1153109

-------------------------------------------------------------------

Fri May 15 07:37:46 UTC 2015 - wr@rosenauer.org

- update to Firefox 38.0.1

  stability and regression fixes

  * Systems with first generation NVidia Optimus graphics cards

    may crash on start-up

  * Users who import cookies from Google Chrome can end up with

    broken websites

  * Large animated images may fail to play and may stop other

    images from loading

-------------------------------------------------------------------

Sun May 10 07:07:49 UTC 2015 - wr@rosenauer.org

- update to Firefox 38.0 (bnc#930622)

  * New tab-based preferences

  * Ruby annotation support

  * more info: https://www.mozilla.org/en-US/firefox/38.0/releasenotes/

  security fixes:

  * MFSA 2015-46/CVE-2015-2708/CVE-2015-2709

    Miscellaneous memory safety hazards

  * MFSA 2015-47/VE-2015-0797 (bmo#1080995)

    Buffer overflow parsing H.264 video with Linux Gstreamer

  * MFSA 2015-48/CVE-2015-2710 (bmo#1149542)

    Buffer overflow with SVG content and CSS

  * MFSA 2015-49/CVE-2015-2711 (bmo#1113431)

    Referrer policy ignored when links opened by middle-click and

    context menu

  * MFSA 2015-50/CVE-2015-2712 (bmo#1152280)

    Out-of-bounds read and write in asm.js validation

  * MFSA 2015-51/CVE-2015-2713 (bmo#1153478)

    Use-after-free during text processing with vertical text enabled

  * MFSA 2015-53/CVE-2015-2715 (bmo#988698)

    Use-after-free due to Media Decoder Thread creation during shutdown

  * MFSA 2015-54/CVE-2015-2716 (bmo#1140537)

    Buffer overflow when parsing compressed XML

  * MFSA 2015-55/CVE-2015-2717 (bmo#1154683)

    Buffer overflow and out-of-bounds read while parsing MP4 video

    metadata

  * MFSA 2015-56/CVE-2015-2718 (bmo#1146724)

    Untrusted site hosting trusted page can intercept webchannel

    responses

  * MFSA 2015-57/CVE-2011-3079 (bmo#1087565)

    Privilege escalation through IPC channel messages

- requires NSS 3.18.1

- removed obsolete patches:

  * mozilla-skia-bmo1136958.patch

- remove gnomevfs build options as it is removed from sources

- rebased patches

-------------------------------------------------------------------

Fri Apr 17 16:39:20 UTC 2015 - wr@rosenauer.org

- update to Firefox 37.0.2 (bnc#928116)

  * MFSA 2015-45/CVE-2015-2706 (bmo#1141081)

    Memory corruption during failed plugin initialization

-------------------------------------------------------------------

Fri Apr  3 08:27:24 UTC 2015 - wr@rosenauer.org

- update to Firefox 37.0.1 (bnc#926166)

  * MFSA 2015-43/CVE-2015-0798 (bmo#1147597) (Android only)

    Loading privileged content through Reader mode

  * MFSA 2015-44/CVE-2015-0799 (bmo#1148328)

    Certificate verification bypass through the HTTP/2 Alt-Svc header

-------------------------------------------------------------------

Sat Mar 28 09:46:48 UTC 2015 - wr@rosenauer.org

- update to Firefox 37.0 (bnc#925368)

  * Heartbeat user rating system

  * Yandex set as default search provider for the Turkish locale

  * Bing search now uses HTTPS for secure searching

  * Improved protection against site impersonation via OneCRL

    centralized certificate revocation

  * Opportunistically encrypt HTTP traffic where the server supports

    HTTP/2 AltSvc

  * some more behaviour changes for TLS

  security fixes:

  * MFSA 2015-30/CVE-2015-0814/CVE-2015-0815

    Miscellaneous memory safety hazards

  * MFSA 2015-31/CVE-2015-0813 (bmo#1106596))

    Use-after-free when using the Fluendo MP3 GStreamer plugin

  * MFSA 2015-32/CVE-2015-0812 (bmo#1128126)

    Add-on lightweight theme installation approval bypassed through

    MITM attack

  * MFSA 2015-33/CVE-2015-0816 (bmo#1144991)

    resource:// documents can load privileged pages

  * MFSA-2015-34/CVE-2015-0811 (bmo#1132468)

    Out of bounds read in QCMS library

  * MFSA-2015-35/CVE-2015-0810 (bmo#1125013)

    Cursor clickjacking with flash and images (OS X only)

  * MFSA-2015-36/CVE-2015-0808 (bmo#1109552)

    Incorrect memory management for simple-type arrays in WebRTC

  * MFSA-2015-37/CVE-2015-0807 (bmo#1111834)

    CORS requests should not follow 30x redirections after preflight

  * MFSA-2015-38/CVE-2015-0805/CVE-2015-0806 (bmo#1135511, bmo#1099437)

    Memory corruption crashes in Off Main Thread Compositing

  * MFSA-2015-39/CVE-2015-0803/CVE-2015-0804 (bmo#1134560)

    Use-after-free due to type confusion flaws

  * MFSA-2015-40/CVE-2015-0801 (bmo#1146339)

    Same-origin bypass through anchor navigation

  * MFSA-2015-41/CVE-2015-0800/CVE-2012-2808

    PRNG weakness allows for DNS poisoning on Android (only)

  * MFSA-2015-42/CVE-2015-0802 (bmo#1124898)

    Windows can retain access to privileged content on navigation

    to unprivileged pages

- removed obsolete patches

  * mozilla-bmo1088588.patch

  * mozilla-bmo1108834.patch

- requires NSPR 4.10.8

-------------------------------------------------------------------

Tue Mar 24 15:35:24 UTC 2015 - dvaleev@suse.com

- Fix builds with skia on Power

  mozilla-skia-be-le.patch (patch from #bmo1136958)

  mozilla-bmo1108834.patch

  mozilla-bmo1005535.patch

-------------------------------------------------------------------

Sat Mar 21 09:03:12 UTC 2015 - wr@rosenauer.org

- update to Firefox 36.0.4 (bnc#923534)

  * MFSA 2015-28/CVE-2015-0818 (bmo#1144988)

    Privilege escalation through SVG navigation

  * MFSA 2015-29/CVE-2015-0817 (bmo#1145255)

    Code execution through incorrect JavaScript bounds checking

    elimination

-------------------------------------------------------------------

Fri Mar 20 15:02:33 UTC 2015 - dimstar@opensuse.org

- Copy the icons to /usr/share/icons instead of symlinking them:

  in preparation for containerized apps (e.g. xdg-app) as well as

  AppStream metadata extraction, there are a couple locations that

  need to be real files for system integration (.desktop files,

  icons, mime-type info).

-------------------------------------------------------------------

Sat Mar  7 07:40:56 UTC 2015 - wr@rosenauer.org

- update to Firefox 36.0.1

  Bugfixes:

  * Disable the usage of the ANY DNS query type (bmo#1093983)

  * Hello may become inactive until restart (bmo#1137469)

  * Print preferences may not be preserved (bmo#1136855)

  * Hello contact tabs may not be visible (bmo#1137141)

  * Accept hostnames that include an underscore character ("_")

    (bmo#1136616)

  * WebGL may use significant memory with Canvas2d (bmo#1137251)

  * Option -remote has been restored (bmo#1080319)

- added mozilla-skia-bmo1136958.patch to fix build issues for

  ARM and PPC

-------------------------------------------------------------------

Fri Feb 20 22:53:39 UTC 2015 - wr@rosenauer.org

- update to Firefox 36.0 (bnc#917597)

  * mozilla-xremote-client was removed

  * added libclearkey.so media plugin

  * Pinned tiles on the new tab page can be synced

  * Support for the full HTTP/2 protocol. HTTP/2 enables a faster,

    more scalable, and more responsive web.

  * Locale added: Uzbek (uz)

  security fixes:

  * MFSA 2015-11/CVE-2015-0835/CVE-2015-0836

    Miscellaneous memory safety hazards

  * MFSA 2015-12/CVE-2015-0833 (bmo#945192)

    Invoking Mozilla updater will load locally stored DLL files

    (Windows only)

  * MFSA 2015-13/CVE-2015-0832 (bmo#1065909)

    Appended period to hostnames can bypass HPKP and HSTS protections

  * MFSA 2015-14/CVE-2015-0830 (bmo#1110488)

    Malicious WebGL content crash when writing strings

  * MFSA 2015-15/CVE-2015-0834 (bmo#1098314)

    TLS TURN and STUN connections silently fail to simple TCP connections

  * MFSA 2015-16/CVE-2015-0831 (bmo#1130514)

    Use-after-free in IndexedDB

  * MFSA 2015-17/CVE-2015-0829 (bmo#1128939)

    Buffer overflow in libstagefright during MP4 video playback

  * MFSA 2015-18/CVE-2015-0828 (bmo#1030667, bmo#988675)

    Double-free when using non-default memory allocators with a

    zero-length XHR

  * MFSA 2015-19/CVE-2015-0827 (bmo#1117304)

    Out-of-bounds read and write while rendering SVG content

  * MFSA 2015-20/CVE-2015-0826 (bmo#1092363)

    Buffer overflow during CSS restyling

  * MFSA 2015-21/CVE-2015-0825 (bmo#1092370)

    Buffer underflow during MP3 playback

  * MFSA 2015-22/CVE-2015-0824 (bmo#1095925)

    Crash using DrawTarget in Cairo graphics library

  * MFSA 2015-23/CVE-2015-0823 (bmo#1098497)

    Use-after-free in Developer Console date with OpenType Sanitiser

  * MFSA 2015-24/CVE-2015-0822 (bmo#1110557)

    Reading of local files through manipulation of form autocomplete

  * MFSA 2015-25/CVE-2015-0821 (bmo#1111960)

    Local files or privileged URLs in pages can be opened into new tabs

  * MFSA 2015-26/CVE-2015-0819 (bmo#1079554)

    UI Tour whitelisted sites in background tab can spoof foreground

    tabs

  * MFSA 2015-27CVE-2015-0820 (bmo#1125398)

    Caja Compiler JavaScript sandbox bypass

- rebased patches

- requires NSS 3.17.4

-------------------------------------------------------------------

Sat Jan 31 18:37:38 UTC 2015 - wr@rosenauer.org

- update to Firefox 35.0.1

  * With the Enhanced Steam extension, Firefox could crash (bmo#1123732)

  * Kerberos authentication did not work with alias (bmo#1108971)

  * SVG / CSS animation had a regression causing rendering issues on

    websites like openstreemap.org (bmo#1083079)

  * On Godaddy webmail, Firefox could crash (bmo#1113121)

  * document.baseURI did not get updated to document.location after

    base tag was removed from DOM for site with a CSP (bmo#1121857)

  * With a Right-to-left (RTL) version of Firefox, the text selection

    could be broken (bmo#1104036)

  * CSP had a change in behavior with regard to case sensitivity

    resources loading (bmo#1122445)

-------------------------------------------------------------------

Sat Jan 10 18:36:37 UTC 2015 - wr@rosenauer.org

- update to Firefox 35.0 (bnc#910669)

  notable features:

  * Firefox Hello with new rooms-based conversations model

  * Implemented HTTP Public Key Pinning Extension (for enhanced

    authentication of encrypted connections)

  security fixes:

  * MFSA 2015-01/CVE-2014-8634/CVE-2014-8635

    Miscellaneous memory safety hazards

  * MFSA 2015-02/CVE-2014-8637 (bmo#1094536)

    Uninitialized memory use during bitmap rendering

  * MFSA 2015-03/CVE-2014-8638 (bmo#1080987)

    sendBeacon requests lack an Origin header

  * MFSA 2015-04/CVE-2014-8639 (bmo#1095859)

    Cookie injection through Proxy Authenticate responses

  * MFSA 2015-05/CVE-2014-8640 (bmo#1100409)

    Read of uninitialized memory in Web Audio

  * MFSA 2015-06/CVE-2014-8641 (bmo#1108455)

    Read-after-free in WebRTC

  * MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only)

    Gecko Media Plugin sandbox escape

  * MFSA 2015-08/CVE-2014-8642 (bmo#1079658)

    Delegated OCSP responder certificates failure with

    id-pkix-ocsp-nocheck extension

  * MFSA 2015-09/CVE-2014-8636 (bmo#987794)

    XrayWrapper bypass through DOM objects

- rebased patches

- dropped explicit support for everything older than 12.3

  (including SLES11)

  * merge firefox-kde.patch and firefox-kde-114.patch

  * dropped mozilla-sle11.patch

- reworked specfile to build conditionally based on release channel

  either Firefox or Firefox Developer Edition

- added mozilla-openaes-decl.patch to fix implicit declarations

- obsolete tracker-miner-firefox < 0.15 because it leads to startup

  crashes (bnc#908892)

-------------------------------------------------------------------

Sat Dec 13 22:13:00 UTC 2014 - Led <ledest@gmail.com>

- fix bashism in mozilla.sh script

-------------------------------------------------------------------

Sat Nov 29 21:23:03 UTC 2014 - wr@rosenauer.org

- update to Firefox 34.0.5 (bnc#908009)

  * Default search engine changed to Yahoo! for North America

  * Default search engine changed to Yandex for Belarusian, Kazakh,

    and Russian locales

  * Improved search bar (en-US only)

  * Firefox Hello real-time communication client

  * Easily switch themes/personas directly in the Customizing mode

  * Implementation of HTTP/2 (draft14) and ALPN

  * Disabled SSLv3

  * MFSA 2014-83/CVE-2014-1587/CVE-2014-1588

    Miscellaneous memory safety hazards

  * MFSA 2014-84/CVE-2014-1589 (bmo#1043787)

    XBL bindings accessible via improper CSS declarations

  * MFSA 2014-85/CVE-2014-1590 (bmo#1087633)

    XMLHttpRequest crashes with some input streams

  * MFSA 2014-86/CVE-2014-1591 (bmo#1069762)

    CSP leaks redirect data via violation reports

  * MFSA 2014-87/CVE-2014-1592 (bmo#1088635)

    Use-after-free during HTML5 parsing

  * MFSA 2014-88/CVE-2014-1593 (bmo#1085175)

    Buffer overflow while parsing media content

  * MFSA 2014-89/CVE-2014-1594 (bmo#1074280)

    Bad casting from the BasicThebesLayer to BasicContainerLayer

- rebased patches

- limit linker memory usage for %ix86

- rebased patches

-------------------------------------------------------------------

Fri Nov  7 20:14:32 UTC 2014 - wr@rosenauer.org

- update to Firefox 33.1

  * Adding DuckDuckGo as a search option (upstream)

  * Forget Button added

  * Enhanced Tiles

  * Privacy tour introduced

- fix typo in GStreamer Recommends

-------------------------------------------------------------------

Tue Nov  4 18:00:35 UTC 2014 - guillaume@opensuse.org

- Disable elf-hack for aarch64

- Enable EGL for aarch64

- Limit RAM usage during link for %arm

- Fix _constraints for ARM

-------------------------------------------------------------------

Mon Nov  3 11:36:04 UTC 2014 - dmueller@suse.com

- use proper macros for ARM

-------------------------------------------------------------------

Mon Nov  3 11:26:23 UTC 2014 - josua.mayer97@gmail.com

- use '--disable-optimize' not only on 32-bit x86, but on 32-bit arm too

  to fix compiling.

- pass '-Wl,--no-keep-memory' to linker to reduce required memory during

  linking on arm.

-------------------------------------------------------------------

Thu Oct 30 11:31:05 UTC 2014 - wr@rosenauer.org

- update to Firefox 33.0.2

  * Fix a startup crash with some combination of hardware and drivers

  33.0.1

  * Firefox displays a black screen at start-up with certain

    graphics drivers

- adjusted _constraints for ARM

-------------------------------------------------------------------

Tue Oct 28 15:23:09 UTC 2014 - josua.mayer97@gmail.com

- added mozilla-bmo1088588.patch to fix build with EGL (bmo#1088588)

-------------------------------------------------------------------

Sat Oct 25 08:45:43 UTC 2014 - wr@rosenauer.org

- define /usr/share/myspell as additional dictionary location

  and remove add-plugins.sh finally (bnc#900639)

-------------------------------------------------------------------

Sun Oct 19 12:59:28 UTC 2014 - vindex17@outlook.it

- use Firefox default optimization flags instead of -Os

- specfile cleanup

-------------------------------------------------------------------

Wed Oct 15 08:05:33 UTC 2014 - wr@rosenauer.org

- fix build for all ppc by not enabling elf-hack

  (bnc#901213)

-------------------------------------------------------------------

Sat Oct 11 08:48:24 UTC 2014 - wr@rosenauer.org

- update to Firefox 33.0 (bnc#900941)

  New features:

  * OpenH264 support (sandboxed)

  * Enhanced Tiles

  * Improved search experience through the location bar

  * Slimmer and faster JavaScript strings

  * New CSP (Content Security Policy) backend

  * Support for connecting to HTTP proxy over HTTPS

  * Improved reliability of the session restoration

  * Proprietary window.crypto properties/functions removed

  Security:

  * MFSA 2014-74/CVE-2014-1574/CVE-2014-1575

    Miscellaneous memory safety hazards

  * MFSA 2014-75/CVE-2014-1576 (bmo#1041512)

    Buffer overflow during CSS manipulation

  * MFSA 2014-76/CVE-2014-1577 (bmo#1012609)

    Web Audio memory corruption issues with custom waveforms

  * MFSA 2014-77/CVE-2014-1578 (bmo#1063327)

    Out-of-bounds write with WebM video

  * MFSA 2014-78/CVE-2014-1580 (bmo#1063733)

    Further uninitialized memory use during GIF rendering

  * MFSA 2014-79/CVE-2014-1581 (bmo#1068218)

    Use-after-free interacting with text directionality

  * MFSA 2014-80/CVE-2014-1582/CVE-2014-1584 (bmo#1049095, bmo#1066190)

    Key pinning bypasses

  * MFSA 2014-81/CVE-2014-1585/CVE-2014-1586 (bmo#1062876, bmo#1062981)

    Inconsistent video sharing within iframe

  * MFSA 2014-82/CVE-2014-1583 (bmo#1015540)

    Accessing cross-origin objects via the Alarms API

    (only relevant for installed web apps)

- requires NSPR 4.10.7

- requires NSS 3.17.1

- removed obsolete patches:

  * mozilla-ppc.patch

  * mozilla-libproxy-compat.patch

- added basic appdata information

-------------------------------------------------------------------

Sat Sep 20 13:33:51 UTC 2014 - wr@rosenauer.org

- update to Firefox 32.0.2

  * just a version bump for our builds

  * fixed the in application update process for certain environments

    (in application update is not enabled in openSUSE and Linux

    is unaffected in any case)

- build with --disable-optimize for 13.1 and above for i586 to

  workaround miscompilations (bnc#896624)

- use some more build flags to align with upstream

-------------------------------------------------------------------

Sat Sep 13 16:58:16 UTC 2014 - wr@rosenauer.org

- update to Firefox 32.0.1

  * fixed stability issues for computers with multiple graphics cards

  * mixed content icon may be incorrectly displayed instead of lock

    icon for SSL sites in 32.0 (

  * WebRTC: setRemoteDescription() silently fails if no success

    callback is specified (bmo#1063971)

-------------------------------------------------------------------

Sun Aug 31 07:44:54 UTC 2014 - wr@rosenauer.org

- update to Firefox 32.0 (bnc#894370)

  * MFSA 2014-67/CVE-2014-1553/CVE-2014-1554/CVE-2014-1562

    Miscellaneous memory safety hazards

  * MFSA 2014-68/CVE-2014-1563 (bmo#1018524)

    Use-after-free during DOM interactions with SVG

  * MFSA 2014-69/CVE-2014-1564 (bmo#1045977)

    Uninitialized memory use during GIF rendering

  * MFSA 2014-70/CVE-2014-1565 (bmo#1047831)

    Out-of-bounds read in Web Audio audio timeline

  * MFSA 2014-72/CVE-2014-1567 (bmo#1037641)

    Use-after-free setting text directionality

- rebased patches

- requires NSS 3.16.4

- removed upstreamed patch

  * mozilla-aarch64-bmo-810631.patch

-------------------------------------------------------------------

Wed Aug 20 13:50:58 CEST 2014 - behlert@suse.de

- adapted _constraints, used more than 3900MB on s390x during

  last build

-------------------------------------------------------------------

Sun Jul 20 18:11:44 UTC 2014 - wr@rosenauer.org

- update to Firefox 31.0 (bnc#887746)

  * MFSA 2014-56/CVE-2014-1547/CVE-2014-1548

    Miscellaneous memory safety hazards

  * MFSA 2014-57/CVE-2014-1549 (bmo#1020205)

    Buffer overflow during Web Audio buffering for playback

  * MFSA 2014-58/CVE-2014-1550 (bmo#1020411)

    Use-after-free in Web Audio due to incorrect control message ordering

  * MFSA 2014-60/CVE-2014-1561 (bmo#1000514, bmo#910375)

    Toolbar dialog customization event spoofing

  * MFSA 2014-61/CVE-2014-1555 (bmo#1023121)

    Use-after-free with FireOnStateChange event

  * MFSA 2014-62/CVE-2014-1556 (bmo#1028891)

    Exploitable WebGL crash with Cesium JavaScript library