-------------------------------------------------------------------

Mon Dec  2 08:24:05 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 71.0

  * Improvements to Lockwise, our integrated password manager

  * More information about Enhanced Tracking Protection in action

  * Native MP3 decoding on Windows, Linux, and macOS

  * Configuration page (about:config) reimplemented in HTML

  * New kiosk mode functionality, which allows maximum screen space

    for customer-facing displays

  MFSA 2019-36

  * CVE-2019-11756 (bmo#1508776)

    Use-after-free of SFTKSession object

  * CVE-2019-17008 (bmo#1546331)

    Use-after-free in worker destruction

  * CVE-2019-13722 (bmo#1580156) (Windows only)

    Stack corruption due to incorrect number of arguments in WebRTC code

  * CVE-2019-17014 (bmo#1322864)

    Dragging and dropping a cross-origin resource, incorrectly loaded

    as an image, could result in information disclosure

  * CVE-2019-17010 (bmo#1581084)

    Use-after-free when performing device orientation checks

  * CVE-2019-17005 (bmo#1584170)

    Buffer overflow in plain text serializer

  * CVE-2019-17011 (bmo#1591334)

    Use-after-free when retrieving a document in antitracking

  * CVE-2019-17012 (bmo#1449736, bmo#1533957, bmo#1560667, bmo#1567209

    bmo#1580288, bmo#1585760, bmo#1592502)

    Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3

  * CVE-2019-17013 (bmo#1298509, bmo#1472328, bmo#1577439, bmo#1577937

    bmo#1580320, bmo#1584195, bmo#1585106, bmo#1586293, bmo#1593865

    bmo#1594181)

    Memory safety bugs fixed in Firefox 71

- requires

  NSPR >= 4.23

  NSS >= 3.47.1

  rust/cargo >= 1.37

- reactivate webrtc for platforms where it was disabled

- updated create-tar.sh to cover buildid and origin repo information

  -> removed obsolete source-stamp.txt

- removed obsolete patches

  mozilla-bmo1511604.patch

  mozilla-openaes-decl.patch

- changed locale building procedure

  * removed obsolete compare-locales.tar.xz

- added mozilla-bmo849632.patch to fix big endian issues in skia

  used for WebGL

-------------------------------------------------------------------

Fri Nov  1 14:16:39 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 70.0.1

  * Fix for an issue that caused some websites or page elements using

    dynamic JavaScript to fail to load. (bmo#1592136)

  * Title bar no longer shows in full screen view (bmo#1588747)

- added mozilla-bmo1504834-part4.patch to fix some visual issues on

  big endian platforms

-------------------------------------------------------------------

Sun Oct 20 20:19:31 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 70.0

  * more privacy protections from Enhanced Tracking Protection

  * Firefox Lockwise passwordmanager

  * Improvements to core engine components, for better browsing on more sites

  * Improved privacy and security indicators

  MFSA 2019-34

  * CVE-2018-6156 (bmo#1480088)

    Heap buffer overflow in FEC processing in WebRTC

  * CVE-2019-15903 (bmo#1584907)

    Heap overflow in expat library in XML_GetCurrentLineNumber

  * CVE-2019-11757 (bmo#1577107)

    Use-after-free when creating index updates in IndexedDB

  * CVE-2019-11759 (bmo#1577953)

    Stack buffer overflow in HKDF output

  * CVE-2019-11760 (bmo#1577719)

    Stack buffer overflow in WebRTC networking

  * CVE-2019-11761 (bmo#1561502)

    Unintended access to a privileged JSONView object

  * CVE-2019-11762 (bmo#1582857)

    document.domain-based origin isolation has same-origin-property violation

  * CVE-2019-11763 (bmo#1584216)

    Incorrect HTML parsing results in XSS bypass technique

  * CVE-2019-11765 (bmo#1562582)

    Incorrect permissions could be granted to a website

  * CVE-2019-17000 (bmo#1441468)

    CSP bypass using object tag with data: URI

  * CVE-2019-17001 (bmo#1587976)

    CSP bypass using object tag when script-src 'none' is specified

  * CVE-2019-17002 (bmo#1561056)

    upgrade-insecure-requests was not being honored for links dragged and dropped

  * CVE-2019-11764 (bmo#1558522, bmo#1577061, bmo#1548044, bmo#1571223,

    bmo#1573048, bmo#1578933, bmo#1575217, bmo#1583684, bmo#1586845, bmo#1581950,

    bmo#1583463, bmo#1586599)

    Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2

- requires

    rust/cargo >= 1.36

    NSPR >= 4.22

    NSS >= 3.46.1

    rust-cbindgen >= 0.9.1

- removed obsolete patches

    mozilla-bmo1573381.patch

    mozilla-nestegg-big-endian.patch

-------------------------------------------------------------------

Sun Oct 13 08:58:12 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 69.0.3

  * Fixed Yahoo mail users being prompted to download files when

    clicking on emails (bmo#1582848)

- devel package build can easily be disabled now

-------------------------------------------------------------------

Thu Oct  3 08:40:05 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 69.0.2

  * Fixed a crash when editing files on Office 365 websites (bmo#1579858)

  * Fixed a Linux-only crash when changing the playback speed while

    watching YouTube videos (bmo#1582222)

- updated supported locale list

- Allow to build without profile guided optimizations (boo#1040589)

  (contributed by Bernhard Wiedemann)

- Make build verbose (contributed by Martin Liška)

- remove obsolete kde.js setting (boo#1151186) and related patch

  firefox-add-kde.js-in-order-to-survive-PGO-build.patch

- update create-tar.sh to latest revision and adjusted tar_stamps

- add mozilla-fix-top-level-asm.patch to fix LTO build (w/o PGO)

- extension preferences moved from branding package to core package

  (packaging but not branding specific)

-------------------------------------------------------------------

Thu Sep 19 13:31:16 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 69.0.1

  * Fixed external programs launching in the background when clicking

    a link from inside Firefox to launch them (bmo#1570845)

  * Usability improvements to the Add-ons Manager for users with

    screen readers (bmo#1567600)

  * Fixed the Captive Portal notification bar not being dismissable

    in some situations after login is complete (bmo#1578633)

  * Fixed the maximum size of fonts in Reader Mode when zoomed (bmo#1578454)

  * Fixed missing stacks in the Developer Tools Performance section

    (bmo#1578354)

  MFSA 2019-31

  * CVE-2019-11754 (bmo#1580506)

    Pointer Lock is enabled with no user notification

- disable DOH by default

-------------------------------------------------------------------

Thu Sep  5 13:02:39 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 69.0

  * Enhanced Tracking Protection (ETP) for stronger privacy protections

  * Block Autoplay feature is enhanced to give users the option to block

    any video

  * Users in the US or using the en-US browser, can get a new “New Tab”

    page experience connecting to the best of Pocket's content.

  * Support for the Web Authentication HmacSecret extension via

    Windows Hello introduced.

  * Support for receiving multiple video codecs with this release makes

    it easier for WebRTC conferencing services to mix video from

    different clients.

  MFSA 2019-25 (boo#1149324)

  * CVE-2019-11741 (bmo#1539595)

    Isolate addons.mozilla.org and accounts.firefox.com

  * CVE-2019-5849 (bmo#1555838)

    Out-of-bounds read in Skia

  * CVE-2019-11737 (bmo#1388015)

    Content security policy directives ignore port and path if host is a wildcard

  * CVE-2019-11734 (bmo#1352875,bmo#1536227,bmo#1557208,bmo#1560641)

    Memory safety bugs fixed in Firefox 69

  * CVE-2019-11735 (bmo#1561404,bmo#1561484,bmo#1568047,bmo#1561912,

    bmo#1565744,bmo#1568858,bmo#1570358)

    Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1

  * CVE-2019-11740 (bmo#1563133,bmo#1573160)

    Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9

- requires

  * rust/cargo >= 1.35

  * rust-cbindgen >= 0.9.0

  * mozilla-nss >= 3.45

- rebased patches

-------------------------------------------------------------------

Wed Sep  4 15:38:40 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- added a bunch of patches mainly for big endian platforms

  * mozilla-bmo1504834-part1.patch

  * mozilla-bmo1504834-part2.patch

  * mozilla-bmo1504834-part3.patch

  * mozilla-bmo1511604.patch

  * mozilla-bmo1554971.patch

  * mozilla-bmo1573381.patch

  * mozilla-nestegg-big-endian.patch

  * mozilla-bmo1512162.patch

-------------------------------------------------------------------

Fri Aug 30 20:49:11 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 68.1.0

  MFSA 2019-26

  * CVE-2019-11751 (bmo#1572838; Windows only)

    Malicious code execution through command line parameters

  * CVE-2019-11746 (bmo#1564449)

    Use-after-free while manipulating video

  * CVE-2019-11744 (bmo#1562033)

    XSS by breaking out of title and textarea elements using innerHTML

  * CVE-2019-11742 (bmo#1559715)

    Same-origin policy violation with SVG filters and canvas to steal

    cross-origin images

  * CVE-2019-11736 (bmo#1551913, bmo#1552206; Windows only))

    File manipulation and privilege escalation in Mozilla Maintenance Service

  * CVE-2019-11753 (bmo#1574980; Windows only)

    Privilege escalation with Mozilla Maintenance Service in custom

    Firefox installation location

  * CVE-2019-11752 (bmo#1501152)

    Use-after-free while extracting a key value in IndexedDB

  * CVE-2019-9812 (bmo#1538008, bmo#1538015)

    Sandbox escape through Firefox Sync

  * CVE-2019-11743 (bmo#1560495)

    Cross-origin access to unload event attributes

  * CVE-2019-11748 (bmo#1564588)

    Persistence of WebRTC permissions in a third party context

  * CVE-2019-11749 (bmo#1565374)

    Camera information available without prompting using getUserMedia

  * CVE-2019-11750 (bmo#1568397)

    Type confusion in Spidermonkey

  * CVE-2019-11738 (bmo#1452037)

    Content security policy bypass through hash-based sources in directives

  * CVE-2019-11747 (bmo#1564481)

    'Forget about this site' removes sites from pre-loaded HSTS list

  * CVE-2019-11735i (bmo#1561404,bmo#1561484,bmo#1568047,bmo#1561912,

    bmo#1565744,bmo#1568858,bmo#1570358)

    Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1

  * CVE-2019-11740 (bmo#1563133,bmo#1573160)

    Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9

- switched package to ESR branch

- added mozilla-bmo1568145.patch to make builds reproducible

- removed upstreamed patch mozilla-gcc-internal-compiler-error.patch

-------------------------------------------------------------------

Sun Aug 18 17:29:25 UTC 2019 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 68.0.2:

  * Fixed a bug causing some special characters to be cut off from

    the end of the search terms when searching from the URL bar

    (bmo#1560228)

  * Allow fonts to be loaded via file:// URLs when opening a page

    locally (bmo#1565942)

  * Printing emails from the Outlook web app no longer prints only

    the header and footer (bmo#1567105)

  * Fixed a bug causing some images not to be displayed on reload,

    including on Google Maps (bmo# 1565542)

  * Fixed an error when starting external applications configured

    as URI handlers (bmo#1567614)

  MFSA 2019-24 (boo#1145665)

  * CVE-2019-11733: Stored passwords in 'Saved Logins' can be

    copied without master password entry (bmo#1565780)

- drop fix-build-after-y2038-changes-in-glibc.patch, upstream

-------------------------------------------------------------------

Fri Aug 16 16:49:24 UTC 2019 - Jonathan Brielmaier <jbrielmaier@suse.de>

- Fix crash when typing in the URL bar on ppc64le (bmo#1512162).

  The upstream patch doesn't resolve the issue on TW, but compiling

  with -O1 does. Do this until we have a proper fix.

-------------------------------------------------------------------

Thu Aug  1 14:25:02 UTC 2019 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Update build constraints to fix arm builds

-------------------------------------------------------------------

Fri Jul 19 08:11:27 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 68.0.1

  * Fixed missing Full Screen button when watching videos in full

    screen mode on HBO GO (bmo#1562837)

  * Fixed a bug causing incorrect messages to appear for some

    locales when sites try to request the use of the Storage

    Access API (bmo#1558503)

  * Users in Russian regions may have their default search engine

    changed (bmo#1565315)

  * Built-in search engines in some locales do not function

    correctly (bmo#1565779)

  * SupportMenu policy doesn't always work (bmo#1553290)

  * Allow the privacy.file_unique_origin pref to be controlled by

    policy (bmo#1563759)

-------------------------------------------------------------------

Thu Jul 11 10:51:39 UTC 2019 - Jiri Slaby <jslaby@suse.com>

- add fix-build-after-y2038-changes-in-glibc.patch

-------------------------------------------------------------------

Wed Jul 10 13:47:41 UTC 2019 - Bernhard Wiedemann <bwiedemann@suse.com>

- Generate langpacks sequentially to avoid file corruption

  from racy file writes (boo#1137970)

-------------------------------------------------------------------

Mon Jul  8 13:30:35 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 68.0

  * Dark mode in reader view

  * Improved extension security and discovery

  * Cryptomining and fingerprinting protections are added to strict

    content blocking settings in Privacy & Security preferences

  * Camera and microphone access now require an HTTPS connection

  MFSA 2019-21 (bsc#1140868)

  * CVE-2019-9811 (bmo#1538007, bmo#1539598, bmo#1563327)

    Sandbox escape via installation of malicious languagepack

  * CVE-2019-11711 (bmo#1552541)

    Script injection within domain through inner window reuse

  * CVE-2019-11712 (bmo#1543804)

    Cross-origin POST requests can be made with NPAPI plugins by

    following 308 redirects

  * CVE-2019-11713 (bmo#1528481)

    Use-after-free with HTTP/2 cached stream

  * CVE-2019-11714 (bmo#1542593)

    NeckoChild can trigger crash when accessed off of main thread

  * CVE-2019-11729 (bmo#1515342)

    Empty or malformed p256-ECDH public keys may trigger a segmentation fault

  * CVE-2019-11715 (bmo#1555523)

    HTML parsing error can contribute to content XSS

  * CVE-2019-11716 (bmo#1552632)

    globalThis not enumerable until accessed

  * CVE-2019-11717 (bmo#1548306)

    Caret character improperly escaped in origins

  * CVE-2019-11718 (bmo#1408349)

    Activity Stream writes unsanitized content to innerHTML

  * CVE-2019-11719 (bmo#1540541)

    Out-of-bounds read when importing curve25519 private key

  * CVE-2019-11720 (bmo#1556230)

    Character encoding XSS vulnerability

  * CVE-2019-11721 (bmo#1256009)

    Domain spoofing through unicode latin 'kra' character

  * CVE-2019-11730 (bmo#1558299)

    Same-origin policy treats all files in a directory as having the

    same-origin

  * CVE-2019-11723 (bmo#1528335)

    Cookie leakage during add-on fetching across private browsing boundaries

  * CVE-2019-11724 (bmo#1512511)

    Retired site input.mozilla.org has remote troubleshooting permissions

  * CVE-2019-11725 (bmo#1483510)

    Websocket resources bypass safebrowsing protections

  * CVE-2019-11727 (bmo#1552208)

    PKCS#1 v1.5 signatures can be used for TLS 1.3

  * CVE-2019-11728 (bmo#1552993)

    Port scanning through Alt-Svc header

  * CVE-2019-11710 (bmo#1549768, bmo#1548611, bmo#1533842, bmo#1537692,

    bmo#1540590, bmo#1551907, bmo#1510345, bmo#1535482, bmo#1535848,

    bmo#1547472, bmo#1547760, bmo#1507696, bmo#1544180)

    Memory safety bugs fixed in Firefox 68

  * CVE-2019-11709 (bmo#1547266, bmo#1540759, bmo#1548822, bmo#1550498

    bmo#1515052, bmo#1539219, bmo#1547757, bmo#1550498, bmo#1533522)

    Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8

- requires

  * NSS 3.44.1

  * rust/cargo 1.34

  * rust-cbindgen 0.8.7

- rebased patches

  * mozilla-aarch64-startup-crash.patch

  * mozilla-kde.patch

  * mozilla-nongnome-proxies.patch

  * firefox-kde.patch

- use new create-tar.sh and add tar_stamps for package definitions

- added patches imported from SLE flavour

  * mozilla-gcc-internal-compiler-error.patch

  * mozilla-bmo1005535.patch

  * mozilla-ppc-altivec_static_inline.patch

  * mozilla-reduce-rust-debuginfo.patch

  * mozilla-s390-bigendian.patch

  * mozilla-s390-context.patch

-------------------------------------------------------------------

Mon Jul  2 14:15:17 UTC 2019 - Martin Liška <mliska@suse.cz>

- Enable PGO for x86_64.

  * added firefox-add-kde.js-in-order-to-survive-PGO-build.patch

-------------------------------------------------------------------

Thu Jun 20 06:20:59 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 67.0.4

  MFSA 2019-19 (boo#1138872)

  * CVE-2019-11708 (bmo#1559858)

    sandbox escape using Prompt:Open

-------------------------------------------------------------------

Tue Jun 18 18:36:15 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 67.0.3

  MFSA 2019-18 (boo#1138614)

  * CVE-2019-11707 (bmo#1544386)

    Type confusion in Array.pop

-------------------------------------------------------------------

Thu Jun 12 14:56:32 UTC 2019 - Manfred Hollstein <manfred.h@gmx.net>

- Mozilla Firefox 67.0.2

  * Fixed: Fix JavaScript error ("TypeError: data is null in

    PrivacyFilter.jsm") in console which may significantly degrade

    sessionstore reliability and performance (bmo#1553413)

  * Fixed: Proxy authentication dialog box repeatedly pops up

    asking to authenticate after upgrading to Firefox 67 (bmo#1548804)

  * Fixed: Pearson MyCloud breaks if FIDO U2F is not Chrome's

    implementation (bmo#1551282)

  * Fixed: Starting in safe mode on Linux or macOS causes Firefox

    to think on the subsequent launch that the profile is too

    recent to be used with this version of Firefox (bmo#1556612)

  * Fixed: Linux distribution users can't easily install/use

    additional/different languages using the built-in preferences

    UI (bmo#1554744)

  * Fixed: Developer tools users can't copy the href/src content

    from various HTML tags via the context menu in the Inspector

    markup view (bmo#1552275)

  * Fixed: Custom home page is broken with clearing data on shutdown

    settings applied (bmo#1554167)

  * Fixed: Performance-regression for eclipse RAP based applications

    (bmo#1555962)

  * Fixed: macOS 10.15 crash fix (bmo#1556076)

  * Fixed: Can't start two downloads in parallel via <a download>

    anymore (bmo#1542912)

-------------------------------------------------------------------

Thu Jun  6 06:49:51 UTC 2019 - Manfred Hollstein <manfred.h@gmx.net>

- Mozilla Firefox 67.0.1

  * enable enhanced tracking protection by default for new users

  * upgrade of Facebook container to version 2.0

  * new version of Firefox Lockwise (password management)

  * new version of Firefox Monitor

  * Firefox Send improvements

-------------------------------------------------------------------

Sun May 19 20:40:30 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 67.0

  * Firefox 67 will be able to run different Firefox installs side by side

    https://blog.nightly.mozilla.org/2019/01/14/moving-to-a-profile-per-install-architecture/

  * Tabs can now be pinned from the Page Actions menu in the address bar

  * Users can block known cryptominers and fingerprinters in the

    Custom settings or their Content Blocking preferences

  * The Import Data from Another Browser feature is now also available

    from the File menu

  * Firefox will now protect you against running older versions which

    can lead to data corruption and stability issues

  * Easier access to your list of saved logins from the main menu and

    login autocomplete

  * We’ve added a toolbar menu for your Firefox Account to provide more

    transparency for when you are synced, sharing data across devices

    and with Firefox. Personalize the appearance of the menu with your

    own avatar

  * Enable FIDO U2F API, and permit registrations for Google Accounts

  * Enabled AV1 support on Linux

  MFSA 2019-13 (boo#1135824)

  * CVE-2019-9815 (bmo#1546544)

    Disable hyperthreading on content JavaScript threads on macOS

  * CVE-2019-9816 (bmo#1536768)

    Type confusion with object groups and UnboxedObjects

  * CVE-2019-9817 (bmo#1540221)

    Stealing of cross-domain images using canvas

  * CVE-2019-9818 (bmo#1542581) (Windows only)

    Use-after-free in crash generation server

  * CVE-2019-9819 (bmo#1532553)

    Compartment mismatch with fetch API

  * CVE-2019-9820 (bmo#1536405)

    Use-after-free of ChromeEventHandler by DocShell

  * CVE-2019-9821 (bmo#1539125)

    Use-after-free in AssertWorkerThread

  * CVE-2019-11691 (bmo#1542465)

    Use-after-free in XMLHttpRequest

  * CVE-2019-11692 (bmo#1544670)

    Use-after-free removing listeners in the event listener manager

  * CVE-2019-11693 (bmo#1532525)

    Buffer overflow in WebGL bufferdata on Linux

  * CVE-2019-7317 (bmo#1542829)

    Use-after-free in png_image_free of libpng library

  * CVE-2019-11694 (bmo#1534196) (Windows only)

    Uninitialized memory memory leakage in Windows sandbox

  * CVE-2019-11695 (bmo#1445844)

    Custom cursor can render over user interface outside of web content

  * CVE-2019-11696 (bmo#1392955)

    Java web start .JNLP files are not recognized as executable files

    for download prompts

  * CVE-2019-11697 (bmo#1440079)

    Pressing key combinations can bypass installation prompt delays and

    install extensions

  * CVE-2019-11698 (bmo#1543191)

    Theft of user history data through drag and drop of hyperlinks

    to and from bookmarks