-------------------------------------------------------------------

Fri Mar 16 06:40:11 UTC 2018 - wr@rosenauer.org

- update to Firefox 59.0.1 (bsc#1085671)

  MFSA 2018-08

  * CVE-2018-5146 (bmo#1446062)

    Vorbis audio processing out of bounds write

  * CVE-2018-5147 (bmo#1446365)

    Out of bounds memory write in libtremor

-------------------------------------------------------------------

Wed Mar 14 19:27:07 UTC 2018 - cgrobertson@suse.com

- Added patch:

  * mozilla-bmo1005535.patch:

    Enable skia_gpu on big endian platforms.

-------------------------------------------------------------------

Sun Mar 11 22:12:12 UTC 2018 - wr@rosenauer.org

- update to Firefox 59.0

  * Performance enhancements

  * Drag-and-drop to rearrange Top Sites on the Firefox Home page

  * added features for Firefox Screenshots

  * Enhanced WebExtensions API

  * Improved RTC capabilities

  MFSA 2018-06 (bsc#1085130)

  * CVE-2018-5127 (bmo#1430557)

    Buffer overflow manipulating SVG animatedPathSegList

  * CVE-2018-5128 (bmo#1431336)

    Use-after-free manipulating editor selection ranges

  * CVE-2018-5129 (bmo#1428947)

    Out-of-bounds write with malformed IPC messages

  * CVE-2018-5130 (bmo#1433005)

    Mismatched RTP payload type can trigger memory corruption

  * CVE-2018-5131 (bmo#1440775)

    Fetch API improperly returns cached copies of no-store/no-cache resources

  * CVE-2018-5132 (bmo#1408194)

    WebExtension Find API can search privileged pages

  * CVE-2018-5133 (bmo#1430511, bmo#1430974)

    Value of the app.support.baseURL preference is not properly sanitized

  * CVE-2018-5134 (bmo#1429379)

    WebExtensions may use view-source: URLs to bypass content restrictions

  * CVE-2018-5135 (bmo#1431371)

    WebExtension browserAction can inject scripts into unintended contexts

  * CVE-2018-5136 (bmo#1419166)

    Same-origin policy violation with data: URL shared workers

  * CVE-2018-5137 (bmo#1432870)

    Script content can access legacy extension non-contentaccessible resources

  * CVE-2018-5138 (bmo#1432624) (Android only)

    Android Custom Tab address spoofing through long domain names

  * CVE-2018-5140 (bmo#1424261)

    Moz-icon images accessible to web content through moz-icon: protocol

  * CVE-2018-5141 (bmo#1429093)

    DOS attack through notifications Push API

  * CVE-2018-5142 (bmo#1366357)

    Media Capture and Streams API permissions display incorrect origin

    with data: and blob: URLs

  * CVE-2018-5143 (bmo#1422643)

    Self-XSS pasting javascript: URL with embedded tab into addressbar

  * CVE-2018-5126

    Memory safety bugs fixed in Firefox 59

  * CVE-2018-5125

    Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7

- requires NSPR 4.18 and NSS 3.35

- requires rust >= 1.22.1

- removed obsolete patches:

  mozilla-alsa-sandbox.patch

  mozilla-enable-csd.patch

  firefox-no-default-ualocale.patch

- removed l10n_changesets.txt since same information is now in

  Firefox source tree (updated create-tar.sh now requires jq)

-------------------------------------------------------------------

Fri Feb  9 13:37:46 UTC 2018 - astieger@suse.com

- Mozilla Firefox 58.0.2:

  * Blocklisted graphics drivers related to off main thread painting

    crashes

  * Fix tab crash during printing

  * Fix clicking links and scrolling emails on Microsoft Hotmail

    and Outlook (OWA) webmail

-------------------------------------------------------------------

Fri Feb  9 12:06:31 UTC 2018 - wr@rosenauer.org

- correct requires and provides handling (boo#1076907)

-------------------------------------------------------------------

Tue Feb  6 07:03:42 UTC 2018 - fstrba@suse.com

- Added patch:

  * mozilla-alsa-sandbox.patch: Fix bmo#1430274, ALSA sound (still

    or again?) not working in Firefox 58 due to sandboxing.

-------------------------------------------------------------------

Mon Jan 29 22:32:21 UTC 2018 - wr@rosenauer.org

- update to Firefox 58.0.1

  MFSA 2018-05

  * Arbitrary code execution through unsanitized browser UI (bmo#1432966)

- use correct language packs

- readd mozilla-enable-csd.patch as it only lands for FF59 upstream

- allow larger number of nested elements (mozilla-bmo256180.patch)

-------------------------------------------------------------------

Tue Jan 23 20:40:57 UTC 2018 - wr@rosenauer.org

- update to Firefox 58.0 (bsc#1077291)

  * Added Nepali (ne-NP) locale

  * Added support for form autofill for credit card

  * Optimize page load by caching JavaScript internal representation

  MFSA 2018-02

  * CVE-2018-5091 (bmo#1423086)

    Use-after-free with DTMF timers

  * CVE-2018-5092 (bmo#1418074)

    Use-after-free in Web Workers

  * CVE-2018-5093 (bmo#1415291)

    Buffer overflow in WebAssembly during Memory/Table resizing

  * CVE-2018-5094 (bmo#1415883)

    Buffer overflow in WebAssembly with garbage collection on

    uninitialized memory

  * CVE-2018-5095 (bmo#1418447)

    Integer overflow in Skia library during edge builder allocation

  * CVE-2018-5097 (bmo#1387427)

    Use-after-free when source document is manipulated during XSLT

  * CVE-2018-5098 (bmo#1399400)

    Use-after-free while manipulating form input elements

  * CVE-2018-5099 (bmo#1416878)

    Use-after-free with widget listener

  * CVE-2018-5100 (bmo#1417405)

    Use-after-free when IsPotentiallyScrollable arguments are freed

    from memory

  * CVE-2018-5101 (bmo#1417661)

    Use-after-free with floating first-letter style elements

  * CVE-2018-5102 (bmo#1419363)

    Use-after-free in HTML media elements

  * CVE-2018-5103 (bmo#1423159)

    Use-after-free during mouse event handling

  * CVE-2018-5104 (bmo#1425000)

    Use-after-free during font face manipulation

  * CVE-2018-5105 (bmo#1390882)

    WebExtensions can save and execute files on local file system

    without user prompts

  * CVE-2018-5106 (bmo#1408708)

    Developer Tools can expose style editor information cross-origin

    through service worker

  * CVE-2018-5107 (bmo#1379276)

    Printing process will follow symlinks for local file access

  * CVE-2018-5108 (bmo#1421099)

    Manually entered blob URL can be accessed by subsequent private browsing tabs

  * CVE-2018-5109 (bmo#1405599)

    Audio capture prompts and starts with incorrect origin attribution

  * CVE-2018-5110 (bmo#1423275) (affects only OS X)

    Cursor can be made invisible on OS X

  * CVE-2018-5111 (bmo#1321619)

    URL spoofing in addressbar through drag and drop

  * CVE-2018-5112 (bmo#1425224)

    Extension development tools panel can open a non-relative URL in the panel

  * CVE-2018-5113 (bmo#1425267)

    WebExtensions can load non-HTTPS pages with browser.identity.launchWebAuthFlow

  * CVE-2018-5114 (bmo#1421324)

    The old value of a cookie changed to HttpOnly remains accessible to scripts

  * CVE-2018-5115 (bmo#1409449)

    Background network requests can open HTTP authentication in unrelated foreground tabs

  * CVE-2018-5116 (bmo#1396399)

    WebExtension ActiveTab permission allows cross-origin frame content access

  * CVE-2018-5117 (bmo#1395508)

    URL spoofing with right-to-left text aligned left-to-right

  * CVE-2018-5118 (bmo#1420049)

    Activity Stream images can attempt to load local content through file:

  * CVE-2018-5119 (bmo#1420507)

    Reader view will load cross-origin content in violation of CORS headers

  * CVE-2018-5121 (bmo#1402368) (affects only OS X)

    OS X Tibetan characters render incompletely in the addressbar

  * CVE-2018-5122 (bmo#1413841)

    Potential integer overflow in DoCrypt

  * CVE-2018-5090

    Memory safety bugs fixed in Firefox 58

  * CVE-2018-5089

    Memory safety bugs fixed in Firefox 58 and Firefox ESR 52.6

- requires NSS 3.34.1

- requires rust 1.21

- removed obsolete patches:

  mozilla-bindgen-systemlibs.patch

  mozilla-bmo1360278.patch

  mozilla-bmo1399611-csd.patch

  mozilla-rust-1.23.patch

- rebased patches

- updated man-page

-------------------------------------------------------------------

Tue Jan  9 18:48:02 UTC 2018 - wr@rosenauer.org

- fixed build with latest rust (mozilla-rust-1.23.patch)

-------------------------------------------------------------------

Thu Jan  4 12:23:41 UTC 2018 - wr@rosenauer.org

- update to Firefox 57.0.4

  MFSA 2018-1: Speculative execution side-channel attack ("Spectre")

  (boo#1074723)

-------------------------------------------------------------------

Wed Jan  3 08:29:38 UTC 2018 - wr@rosenauer.org

- fixed regression introduced Oct 10th which made Firefox crash

  when cancelling the KDE file dialog (boo#1069962)

-------------------------------------------------------------------

Fri Dec 29 19:52:34 UTC 2017 - astieger@suse.com

- Mozilla Firefox 57.0.3:

  * Fix a crash reporting issue that inadvertently sends background

    tab crash reports to Mozilla without user opt-in (bmo#1427111,

    bsc#1074235)

- Includes changes from 57.0.2:

  * fixes for platforms other than GNU/Linux

-------------------------------------------------------------------

Fri Dec  8 15:52:17 UTC 2017 - dimstar@opensuse.org

- Explicitly buildrequires python2-xml: The build system relies on

  it. We wrongly relied on other packages pulling it in for us.

-------------------------------------------------------------------

Thu Dec  7 11:12:31 UTC 2017 - dimstar@opensuse.org

- Escape the usage of %{VERSION} when calling out to rpm.

  RPM 4.14 has %{VERSION} defined as 'the main packages version'.

-------------------------------------------------------------------

Wed Nov 29 23:45:03 UTC 2017 - wr@rosenauer.org

- update to Firefox 57.0.1

  * CVE-2017-7843: Web worker in Private Browsing mode can write

    IndexedDB data (bsc#1072034, bmo#1410106)

  * CVE-2017-7844: Visited history information leak through SVG

    image (bsc#1072036, bmo#1420001)

  * Fix a video color distortion issue on YouTube and other video

    sites with some AMD devices (bmo#1417442)

  * Fix an issue with prefs.js when the profile path has non-ascii

    characters (bmo#1420427)

-------------------------------------------------------------------

Tue Nov 21 09:00:48 UTC 2017 - christophe@krop.fr

- Add mozilla-bmo1360278.patch

  Starting with Firefox 57, the context menu appears on key press.

  This patch creates a config entry to restore the

  old behaviour. Without the patch, the mouse gesture extensions

  require 2 clicks to work (bmo#1360278).

  The new config entry is named ui.context_menus.after_mouseup

  (default : false).

-------------------------------------------------------------------

Sat Nov 18 08:35:21 UTC 2017 - wr@rosenauer.org

- Allow experimental CSD for Gtk3 (bmo#1399611) if available and enabled

  widget.allow-client-side-decoration=true

  (mozilla-bmo1399611-csd.patch)

-------------------------------------------------------------------

Wed Nov 15 06:46:06 UTC 2017 - wr@rosenauer.org

- update to Firefox 57.0 (boo#1068101)

  * Firefox Quantum

  * Photon UI

  * Unified address and search bar

  * AMD VP9 hardware video decoder support

  * Added support for Date/Time input

  * stricter security sandbox blocking filesystem reading and

    writing on Linux systems

  * middle mouse paste in the content area no longer navigates to

    URLs by default on Unix systems

  MFSA 2017-24

  * CVE-2017-7828 (bmo#1406750. bmo#1412252)

    Use-after-free of PressShell while restyling layout

  * CVE-2017-7830 (bmo#1408990)

    Cross-origin URL information leak through Resource Timing API

  * CVE-2017-7831 (bmo#1392026)

    Information disclosure of exposed properties on JavaScript proxy

    objects

  * CVE-2017-7832 (bmo#1408782)

    Domain spoofing through use of dotless 'i' character followed

    by accent markers

  * CVE-2017-7833 (bmo#1370497)

    Domain spoofing with Arabic and Indic vowel marker characters

  * CVE-2017-7834 (bmo#1358009)

    data: URLs opened in new tabs bypass CSP protections

  * CVE-2017-7835 (bmo#1402363)

    Mixed content blocking incorrectly applies with redirects

  * CVE-2017-7836 (bmo#1401339)

    Pingsender dynamically loads libcurl on Linux and OS X

  * CVE-2017-7837 (bmo#1325923)

    SVG loaded as <img> can use meta tags to set cookies

  * CVE-2017-7838 (bmo#1399540)

    Failure of individual decoding of labels in international domain

    names triggers punycode display of entire IDN

  * CVE-2017-7839 (bmo#1402896)

    Control characters before javascript: URLs defeats self-XSS

    prevention mechanism

  * CVE-2017-7840 (bmo#1366420)

    Exported bookmarks do not strip script elements from user-supplied

    tags

  * CVE-2017-7842 (bmo#1397064)

    Referrer Policy is not always respected for <link> elements

  * CVE-2017-7827

    Memory safety bugs fixed in Firefox 57

  * CVE-2017-7826

    Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5

- requires NSPR 4.17, NSS 3.33 and rustc 1.19

- rebased patches

- added mozilla-bindgen-systemlibs.patch to allow stylo build

  with system libs (bmo#1341234)

- removed mozilla-language.patch since the whole locale code

  changed in Firefox and is relying on ICU now

- removed obsolete mozilla-ucontext.patch

-------------------------------------------------------------------

Sat Oct 28 06:30:37 UTC 2017 - wr@rosenauer.org

- update to Firefox 56.0.2

  * Disable Form Autofill completely on user request (bmo#1404531)

  * Fix for video-related crashes on Windows 7 (bmo#1409141)

  * Correct detection for 64-bit GSSAPI authentication (bmo#1409275)

  * Fix for shutdown crash (bmo#1404105)

-------------------------------------------------------------------

Tue Oct 10 11:47:49 UTC 2017 - wr@rosenauer.org

- update to Firefox 56.0.1

  * Block D3D11 when using Intel drivers on Windows 7 systems with

    partial AVX support (bmo#1403353)

  -> just to sync the version number

- enable stylo for TW (requires LLVM >= 3.9)

- queue KDE filepicker requests to avoid non-opening file dialogs

  happening in certain situations (contributed by Ignaz Forster)

- the placeholder dot in KDE file dialog in case of empty filenames

  was removed, apparently not required (anymore)

  (contributed by Ignaz Forster)

-------------------------------------------------------------------

Sun Oct  1 18:25:16 UTC 2017 - stefan.bruens@rwth-aachen.de

- Correct plugin directory for aarch64 (boo#1061207). The wrapper

  script was not detecting aarch64 as a 64 bit architecture, thus

  used /usr/lib/browser-plugins/.

-------------------------------------------------------------------

Sat Sep 30 20:10:50 UTC 2017 - zaitor@opensuse.org

- Drop libgnomeui-devel, and replace it with pkgconfig(gconf-2.0),

  pkgconfig(gtk+-2.0), pkgconfig(gtk+-unix-print-2.0),

  pkgconfig(glib-2.0), pkgconfig(gobject-2.0) and

  pkgconfig(gdk-x11-2.0) BuildRequires, align with what configure

  looks for.

-------------------------------------------------------------------

Thu Sep 28 08:28:29 UTC 2017 - wr@rosenauer.org

- update to Firefox 56.0 (boo#1060445)

  * Firefox Screenshots

  * Find Options/Preferences more quickly with new search function

  * Media is no longer auto-played when opened in a background tab

  * Enable CSS Grid Layout View

  MFSA 2017-21

  * CVE-2017-7793 (bmo#1371889)

    Use-after-free with Fetch API

  * CVE-2017-7817 (bmo#1356596) (Android-only)

    Firefox for Android address bar spoofing through fullscreen mode

  * CVE-2017-7818 (bmo#1363723)

    Use-after-free during ARIA array manipulation

  * CVE-2017-7819 (bmo#1380292)

    Use-after-free while resizing images in design mode

  * CVE-2017-7824 (bmo#1398381)

    Buffer overflow when drawing and validating elements with ANGLE

  * CVE-2017-7805 (bmo#1377618) (fixed via NSS requirement)

    Use-after-free in TLS 1.2 generating handshake hashes

  * CVE-2017-7812 (bmo#1379842)

    Drag and drop of malicious page content to the tab bar can open locally stored files

  * CVE-2017-7814 (bmo#1376036)

    Blob and data URLs bypass phishing and malware protection warnings

  * CVE-2017-7813 (bmo#1383951)

    Integer truncation in the JavaScript parser

  * CVE-2017-7825 (bmo#1393624, bmo#1390980) (OSX-only)

    OS X fonts render some Tibetan and Arabic unicode characters as spaces

  * CVE-2017-7815 (bmo#1368981)

    Spoofing attack with modal dialogs on non-e10s installations

  * CVE-2017-7816 (bmo#1380597)

    WebExtensions can load about: URLs in extension UI

  * CVE-2017-7821 (bmo#1346515)

    WebExtensions can download and open non-executable files without user interaction

  * CVE-2017-7823 (bmo#1396320)

    CSP sandbox directive did not create a unique origin

  * CVE-2017-7822 (bmo#1368859)

    WebCrypto allows AES-GCM with 0-length IV

  * CVE-2017-7820 (bmo#1378207)

    Xray wrapper bypass with new tab and web console

  * CVE-2017-7811

    Memory safety bugs fixed in Firefox 56

  * CVE-2017-7810

    Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4

- requires NSPR 4.16 and NSS 3.32.1

- rebased patches

-------------------------------------------------------------------

Thu Sep 28 07:53:13 UTC 2017 - dimstar@opensuse.org

- Add alsa-devel BuildRequires: we care for ALSA support to be

  built and thus need to ensure we get the dependencies in place.

  In the past, alsa-devel was pulled in by accident: we

  buildrequire libgnome-devel. This required esound-devel and that

  in turn pulled in alsa-devel for us. libgnome is being fixed to

  no longer require esound-devel.

-------------------------------------------------------------------

Mon Sep  4 18:27:44 UTC 2017 - wr@rosenauer.org

- update to Firefox 55.0.3

  * Fix an issue with addons when using a path containing non-ascii

    characters (bmo#1389160)

  * Fix file uploads to some websites, including YouTube (bmo#1383518)

- fix Google API key build integration

- add mozilla-ucontext.patch to fix Tumbleweed build

- do not enable XINPUT2 for now (boo#1053959)

-------------------------------------------------------------------

Fri Aug 11 08:32:30 UTC 2017 - wr@rosenauer.org

- update to Firefox 55.0.1

  * Fix a regression the tab restoration process (bmo#1388160)

  * Fix a problem causing What's new pages not to be displayed (bmo#1386224)

  * Fix a rendering issue with some PKCS#11 libraries (bmo#1388370)

  * Disable the predictor prefetch (bmo#1388160)

-------------------------------------------------------------------

Sat Aug  5 13:22:16 UTC 2017 - wr@rosenauer.org

- update to Firefox 55.0 (boo#1052829)

  * Browsing sessions with a high number of tabs are now restored

    in an instant

  * Sidebar (bookmarks, history, synced tabs) can now be moved to

    the right edge of the window

  * Fine-tune your browser performance from the Preferences/Options page.

  * Make screenshots of webpages, and save them locally or upload

    them to the cloud. This feature will undergo A/B testing and

    will not be visible for some users.

  * Added Belarusian (be) locale

  * Simplify print jobs from within print preview

  * Use virtual reality devices with the web with the introduction

    of WebVR

  * Search suggestions are now enabled by default for users who

    haven't explicitly opted-out

  * Search with any installed search engine directly from the

    location bar

  * IMPORTANT: Breaking profile changes - do not downgrade Firefox

    and use a profile that has been opened with Firefox 55+.

  * The Adobe Flash plugin is now click-to-activate by default and

    only allowed on http:// and https:// URL schemes. This change

    will be rolled out progressively and so will not be visible to

    all users immediately. For more information see the Firefox

    plugin roadmap

  * Modernized application update UI to be less intrusive and more

    aligned with the rest of the browser. Only users who have not

    restarted their browser 8 days after downloading an update or

    users who opted out of automatic updates will see this change.

  * Insecure sites can no longer access the Geolocation APIs to get

    access to your physical location

  * requires NSPR 4.15 and NSS 3.31

  MFSA 2017-18

  * CVE-2017-7798 (bmo#1371586, bmo#1372112)

    XUL injection in the style editor in devtools

  * CVE-2017-7800 (bmo#1374047)

    Use-after-free in WebSockets during disconnection

  * CVE-2017-7801 (bmo#1371259)

    Use-after-free with marquee during window resizing

  * CVE-2017-7809 (bmo#1380284)

    Use-after-free while deleting attached editor DOM node

  * CVE-2017-7784 (bmo#1376087)

    Use-after-free with image observers

  * CVE-2017-7802 (bmo#1378147)