-------------------------------------------------------------------

Sun May 19 20:40:30 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 67.0

  * Firefox 67 will be able to run different Firefox installs side by side

    https://blog.nightly.mozilla.org/2019/01/14/moving-to-a-profile-per-install-architecture/

  * Tabs can now be pinned from the Page Actions menu in the address bar

  * Users can block known cryptominers and fingerprinters in the

    Custom settings or their Content Blocking preferences

  * The Import Data from Another Browser feature is now also available

    from the File menu

  * Firefox will now protect you against running older versions which

    can lead to data corruption and stability issues

  * Easier access to your list of saved logins from the main menu and

    login autocomplete

  * We’ve added a toolbar menu for your Firefox Account to provide more

    transparency for when you are synced, sharing data across devices

    and with Firefox. Personalize the appearance of the menu with your

    own avatar

  * Enable FIDO U2F API, and permit registrations for Google Accounts

  * Enabled AV1 support on Linux

  * CVE-2019-9815 (bmo#1546544)

    Disable hyperthreading on content JavaScript threads on macOS

  * CVE-2019-9816 (bmo#1536768)

    Type confusion with object groups and UnboxedObjects

  * CVE-2019-9817 (bmo#1540221)

    Stealing of cross-domain images using canvas

  * CVE-2019-9818 (bmo#1542581) (Windows only)

    Use-after-free in crash generation server

  * CVE-2019-9819 (bmo#1532553)

    Compartment mismatch with fetch API

  * CVE-2019-9820 (bmo#1536405)

    Use-after-free of ChromeEventHandler by DocShell

  * CVE-2019-9821 (bmo#1539125)

    Use-after-free in AssertWorkerThread

  * CVE-2019-11691 (bmo#1542465)

    Use-after-free in XMLHttpRequest

  * CVE-2019-11692 (bmo#1544670)

    Use-after-free removing listeners in the event listener manager

  * CVE-2019-11693 (bmo#1532525)

    Buffer overflow in WebGL bufferdata on Linux

  * CVE-2019-7317 (bmo#1542829)

    Use-after-free in png_image_free of libpng library

  * CVE-2019-11694 (bmo#1534196) (Windows only)

    Uninitialized memory memory leakage in Windows sandbox

  * CVE-2019-11695 (bmo#1445844)

    Custom cursor can render over user interface outside of web content

  * CVE-2019-11696 (bmo#1392955)

    Java web start .JNLP files are not recognized as executable files

    for download prompts

  * CVE-2019-11697 (bmo#1440079)

    Pressing key combinations can bypass installation prompt delays and

    install extensions

  * CVE-2019-11698 (bmo#1543191)

    Theft of user history data through drag and drop of hyperlinks

    to and from bookmarks

  * CVE-2019-11700 (bmo#1549833) (Windows only)

    res: protocol can be used to open known local files

  * CVE-2019-11699 (bmo#1528939)

    Incorrect domain name highlighting during page navigation

  * CVE-2019-11701 (bmo#1518627)

    webcal: protocol default handler loads vulnerable web page

  * CVE-2019-9814 (bmo#1527592, bmo#1534536, bmo#1520132, bmo#1543159,

    bmo#1539393, bmo#1459932, bmo#1459182, bmo#1516425)

    Memory safety bugs fixed in Firefox 67

  * CVE-2019-9800 (bmo#1540166, bmo#1534593, bmo#1546327, bmo#1540136,

    bmo#1538736, bmo#1538042, bmo#1535612, bmo#1499719, bmo#1499108,

    bmo#1538619, bmo#1535194, bmo#1516325, bmo#1542324, bmo#1542097,

    bmo#1532465, bmo#1533554, bmo#1541580)

    Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7

- requires

  * rust/cargo >= 1.32

  * mozilla-nspr >= 4.21

  * mozilla-nss >= 3.43

  * rust-cbindgen >= 0.8.2

- rebased patches

- KDE integration for default browser detection is broken in this revision

-------------------------------------------------------------------

Fri May 17 12:04:49 UTC 2019 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Fix armv7 build with:

  * mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch

-------------------------------------------------------------------

Fri May 10 10:30:05 UTC 2019 - Manfred Hollstein <manfred.h@gmx.net>

- Mozilla Firefox 66.0.5

  * Fixed: Further improvements to re-enable web extensions which

    had been disabled for users with a master password set (bmo#1549249)

-------------------------------------------------------------------

Sun May  5 20:21:02 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 66.0.4 (boo#1134126)

  * fix extension certificate chain

    https://blog.mozilla.org/addons/2019/05/04/update-regarding-add-ons-in-firefox/

-------------------------------------------------------------------

Thu Apr 11 09:16:17 UTC 2019 - Manfred Hollstein <manfred.h@gmx.net>

- Mozilla Firefox 66.0.3

  * Fixed: Address bar on tablets running Windows 10 now behaves

    correctly (bmo#1498973)

  * Fixed: Performance issues with some HTML5 games (bmo#1537609)

  * Fixed a bug with keypress events in IBM cloud applications

    (bmo#1538970)

  * Fix for keypress events in some Microsoft cloud applications

    (bmo#1539618)

  * Changed: Updated Baidu search plugin

-------------------------------------------------------------------

Thu Mar 28 19:01:41 UTC 2019 - Manfred Hollstein <manfred.h@gmx.net>

- Mozilla Firefox 66.0.2

  * Fixed Web compatibility issues with Office 365, iCloud and

    IBM WebMail caused by recent changes to the handling of

    keyboard events (bmo#1538966)

  * Crash fixes (bmo#1521370, bmo#1539118)

-------------------------------------------------------------------

Thu Mar 28 09:58:36 UTC 2019 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Add patch to fix aarch64 build:

  * mozilla-fix-aarch64-libopus.patch (bmo#1539737)

-------------------------------------------------------------------

Fri Mar 22 22:22:08 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 66.0.1

  MFSA 2019-09 (bsc#1130262)

  * CVE-2019-9810 (bmo#1537924)

    IonMonkey MArraySlice has incorrect alias information

  * CVE-2019-9813 (bmo#1538006)

    Ionmonkey type confusion with __proto__ mutations

-------------------------------------------------------------------

Sun Mar 17 10:08:51 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 66.0

  * Increased content processes to 8

  * Added capability to search through open tabs from the tab overflow menu

  * New backend for the storage.local WebExtensions API, providing

    I/O performance improvements when the extension updates a small

    subset of the stored data

  * WebExtension keyboard shortcuts can now be managed or overridden

    from about:addons

  * Improved scrolling behavior: Firefox will now attempt to keep content

    from jumping around while a page is loading by supporting scroll

    anchoring

  * New about:privatebrowsing with search

  * A certificate error page now notifies the user of the name of the

    certificate issuer that breaks HTTPs connections on intercepted

    connections to help troubleshooting possible anti-virus software

    issues.

  * Fixed an performance issue some Linux users experienced with the

    Downloads panel (bmo#1517101)

  * Firefox now blocks all autoplay media with sound by default. Users

    can add individual sites to an exceptions list or turn the blocking

    off.

  * System title bar is hidden by default to match Gnome guideline

  MFSA 2019-07 (bsc#1129821)

  * CVE-2019-9790 (bmo#1525145)

    Use-after-free when removing in-use DOM elements

  * CVE-2019-9791 (bmo#1530958)

    Type inference is incorrect for constructors entered through on-stack

    replacement with IonMonkey

  * CVE-2019-9792 (bmo#1532599)

    IonMonkey leaks JS_OPTIMIZED_OUT magic value to script

  * CVE-2019-9793 (bmo#1528829)

    Improper bounds checks when Spectre mitigations are disabled

  * CVE-2019-9794 (bmo#1530103) (Windows only)

    Command line arguments not discarded during execution

  * CVE-2019-9795 (bmo#1514682)

    Type-confusion in IonMonkey JIT compiler

  * CVE-2019-9796 (bmo#1531277)

    Use-after-free with SMIL animation controller

  * CVE-2019-9797 (bmo#1528909)

    Cross-origin theft of images with createImageBitmap

  * CVE-2019-9798 (bmo#1527534) (Android only)

    Library is loaded from world writable APITRACE_LIB location

  * CVE-2019-9799 (bmo#1505678)

    Information disclosure via IPC channel messages

  * CVE-2019-9801 (bmo#1527717) (Windows only)

    Windows programs that are not 'URL Handlers' are exposed to web content

  * CVE-2019-9802 (bmo#1415508)

    Chrome process information leak

  * CVE-2019-9803 (bmo#1515863, bmo#1437009)

    Upgrade-Insecure-Requests incorrectly enforced for same-origin navigation

  * CVE-2019-9804 (bmo#1518026) (MacOS only)

    Code execution through 'Copy as cURL' in Firefox Developer Tools on macOS

  * CVE-2019-9805 (bmo#1521360)

    Potential use of uninitialized memory in Prio

  * CVE-2019-9806 (bmo#1525267)

    Denial of service through successive FTP authorization prompts

  * CVE-2019-9807 (bmo#1362050)

    Text sent through FTP connection can be incorporated into alert messages

  * CVE-2019-9809 (bmo#1282430, bmo#1523249)

    Denial of service through FTP modal alert error messages

  * CVE-2019-9808 (bmo#1434634)

    WebRTC permissions can display incorrect origin with data: and blob: URLs

  * CVE-2019-9789 bmo#1520483, bmo#1522987, bmo#1528199, bmo#1519337,

    bmo#1525549, bmo#1516179, bmo#1518524, bmo#1518331, bmo#1526579,

    bmo#1512567, bmo#1524335, bmo#1448505, bmo#1518821

    Memory safety bugs fixed in Firefox 66

  * CVE-2019-9788 bmo#1518001, bmo#1521304, bmo#1521214, bmo#1506665,

    bmo#1516834, bmo#1518774, bmo#1524755, bmo#1523362, bmo#1524214, bmo#1529203

    Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6

- updated build/runtime requirements

  * mozilla-nss >= 3.42.1

  * cargo/rust >= 1.31

  * rust-cbindgen >= 0.6.8

  * nasm >= 2.13 (new)

- removed obsolete patch

  * mozilla-bmo256180.patch

-------------------------------------------------------------------

Tue Mar  5 10:17:01 UTC 2019 - Stephan Kulow <coolo@suse.com>

- Do not hardcode nodejs8 but leave the prefer to the distribution

  (Tumbleweed staging wants to switch to nodejs10)

-------------------------------------------------------------------

Fri Feb 15 13:45:57 UTC 2019 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Update _constraints to avoid 'no space left' error seen on aarch64

-------------------------------------------------------------------

Wed Feb 13 07:17:28 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 65.0.1

  * Fixed accidental requests to addons.mozilla.org when an addon

    recommendation doorhanger is shown (bmo#1526387)

  * Improved playback of interactive Netflix videos (bmo#1524500)

  * Fixed incorrect sizing of the "Clear Recent History" window in

    some situations (bmo#1523696)

  * Fixed audio & video delays while making WebRTC calls

    (bmo#1521577, bmo#1523817)

  * Fixed video sizing problems during some WebRTC calls (bmo#1520200)

  * Fixed looping CONNECT requests when using WebSockets over HTTP/2

    from behind a proxy server (bmo#1523427)

  * Fixed the "Enter" key not working on password entry fields for

    certain Linux distributions (bmo#1523635)

  MFSA 2019-04 (bsc#1125330)

  * CVE-2018-18356 bmo#1525817

    Use-after-free in Skia

  * CVE-2019-5785 bmo#1525433

    Integer overflow in Skia

  * CVE-2018-18511 bmo#1526218

    Cross-origin theft of images with ImageBitmapRenderingContext

-------------------------------------------------------------------

Wed Feb 13 06:12:43 UTC 2019 - Martin Liška <mliska@suse.cz>

- Enable LTO only for latest new toolchain (boo#1125038) for x86_64

  (with increased memory constraints)

-------------------------------------------------------------------

Sat Jan 26 22:37:01 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 65.0

  * Enhanced tracking protection

  * allow switching of UI locales within preferences

  * support for the WebP image format

  * "top"-like about:performance

  MFSA 2019-01 (bsc#1122983)

  * CVE-2018-18500 bmo#1510114

    Use-after-free parsing HTML5 stream

  * CVE-2018-18503 bmo#1509442

    Memory corruption with Audio Buffer

  * CVE-2018-18504 bmo#1496413

    Memory corruption and out-of-bounds read of texture client

  * CVE-2018-18505 bmo#1497749

    Privilege escalation through IPC channel messages

  * CVE-2018-18506 bmo#1503393

    Proxy Auto-Configuration file can define localhost access to be proxied

  * CVE-2018-18502 bmo#1499426 bmo#1480090 bmo#1472990 bmo#1514762

    bmo#1501482 bmo#1505887 bmo#1508102 bmo#1508618 bmo#1511580

    bmo#1493497 bmo#1510145 bmo#1516289 bmo#1506798 bmo#1512758

    Memory safety bugs fixed in Firefox 65

  * CVE-2018-18501 bmo#1512450 bmo#1517542 bmo#1513201 bmo#1460619

    bmo#1502871 bmo#1516738 bmo#1516514

    Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5

- requires

  NSS 3.41

  rust/carge 1.30

  rust-cbindgen 0.6.7

- rebased patches

- remove workaround for build memory consumption on i586; other

  mitigations meanwhile introduced (mainly parallelity) will be

  sufficient

  mozilla-reduce-files-per-UnifiedBindings.patch

-------------------------------------------------------------------

Tue Jan 15 14:32:03 UTC 2019 - Martin Liška <mliska@suse.cz>

- Increase disk constraint.

-------------------------------------------------------------------

Mon Jan 14 12:12:12 UTC 2019 - Martin Liška <mliska@suse.cz>

- Remove -v from mach build in order to work-around bmo#1500436.

-------------------------------------------------------------------

Fri Jan 11 15:07:14 UTC 2019 - Martin Liška <mliska@suse.cz>

- Set %clang_build to false on all architectures

- Do not use -fno-delete-null-pointer-checks and -fno-strict-aliasing:

  it should not be needed anymore

- Do not overwrite enable-optimize and when possible

  enable --enable-debug-symbols.

- Add -v to mach in order to make build verbose.

-------------------------------------------------------------------

Wed Jan  9 22:40:14 UTC 2019 - astieger@suse.com

- Mozilla Firefox 64.0.2:

  * Update the Japanese translation for missing strings (bmo#1513259)

  * Properly restore column sizes in developer tools inspector (bmo#1503175)

  * Fixed video stuttering on Youtube (bmo#1513511)

  * Fix updates for some lightweight themes (bmo#1508777)

-------------------------------------------------------------------

Tue Dec 18 14:46:41 UTC 2018 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Enable build_hardened for all architectures

- Switch back aarch64 to clang as '-fPIC' fixes bmo#1513605

- Remove obolete '--enable-pie' as -pie is always enabled for

  gcc and clang

-------------------------------------------------------------------

Wed Dec 12 17:33:29 UTC 2018 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Switch aarch64 builds back to gcc, not clang (bmo#1513605)

- Switch %arm builds back to gcc, not clang to avoid OOM

- Fix build flags when clang is not used

- Fix flags for clang ppc64 builds

-------------------------------------------------------------------

Tue Dec 11 08:45:56 UTC 2018 - Wolfgang Rosenauer <wr@rosenauer.org>

- update to Firefox 64.0

  * Better recommendations: You may see suggestions in regular browsing

    mode for new and relevant Firefox features, services, and extensions

    based on how you use the web (for US users only)

  * Enhanced tab management: You can now select multiple tabs from the

    tab bar and close, move, bookmark, or pin them quickly and easily

  * Easier performance management: The new Task Manager page found at

    about:performance lets you see how much energy each open tab consumes

    and provides access to close tabs to conserve power

  * Improved performance for Mac and Linux users, by enabling link time

    optimization (Clang LTO).

  * Added option to remove add-ons using the context menu on their

    toolbar buttons

  * RSS feed preview and live bookmarks are available only via add-ons

  * TLS certificates issued by Symantec are no longer trusted by Firefox.

    Website operators are strongly encouraged to replace any remaining

    Symantec TLS certificates as soon as possible

  MFSA 2018-29 (bsc#1119105)

  * CVE-2018-12407 bmo#1505973

    Buffer overflow with ANGLE library when using VertexBuffer11 module

  * CVE-2018-17466 bmo#1488295

    Buffer overflow and out-of-bounds read in ANGLE library with

    TextureStorage11

  * CVE-2018-18492 bmo#1499861

    Use-after-free with select element

  * CVE-2018-18493 bmo#1504452

    Buffer overflow in accelerated 2D canvas with Skia

  * CVE-2018-18494 bmo#1487964

    Same-origin policy violation using location attribute and

    performance.getEntries to steal cross-origin URLs

  * CVE-2018-18495 bmo#1427585

    WebExtension content scripts can be loaded in about: pages

  * CVE-2018-18496 bmo#1422231 (Windows only)

    Embedded feed preview page can be abused for clickjacking

  * CVE-2018-18497 bmo#1488180

    WebExtensions can load arbitrary URLs through pipe separators

  * CVE-2018-18498 bmo#1500011

    Integer overflow when calculating buffer sizes for images

  * CVE-2018-12406 bmo#1456947 bmo#1475669 bmo#1504816 bmo#1502886

    bmo#1500064 bmo#1500310 bmo#1500696 bmo#1498765 bmo#1499198 bmo#1434490

    bmo#1481745 bmo#1458129

    Memory safety bugs fixed in Firefox 64

  * CVE-2018-12405 bmo#1494752 bmo#1503326 bmo#1505181 bmo#1500759

    bmo#1504365 bmo#1506640 bmo#1503082 bmo#1502013 bmo#1510471

    Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4

- requires

  * rust/cargo >= 1.29

  * mozilla-nss >= 3.40.1

  * rust-cbindgen >= 0.6.4

- rebased patches

- removed obsolete patch

  * mozilla-bmo1491289.patch

- now uses clang primarily for compilation

-------------------------------------------------------------------

Wed Nov 28 11:07:18 UTC 2018 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Remove --disable-elf-hack when not available: on aarch64 and ppc64*

-------------------------------------------------------------------

Mon Nov 26 09:46:02 UTC 2018 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Clean-up %arm build

-------------------------------------------------------------------

Sun Nov 18 11:01:21 UTC 2018 - manfred.h@gmx.net

- update to Firefox 63.0.3

  * Games using WebGL (created in Unity) get stuck after very short

    time of gameplay (bmo#1502748)

  * Slow page loading for some users with specific proxy configurations

    (bmo#1495024)

  * Disable HTTP response throttling by default for causing bugs with

    videos in background tabs (bmo#1503354)

  * Opening magnet links no longer works (bmo#1498934)

  * Crash fixes (bmo#1498510, bmo#1503424)

- removed mozilla-newer-cbindgen.patch; no longer needed

-------------------------------------------------------------------

Thu Nov  8 14:59:13 UTC 2018 - wr@rosenauer.org

- update to Firefox 63.0.1

  * Snippets are not loaded due to missing element (bmo#1503047)

  * Print preview always shows 30& scale when it is actually

    Shrink To Fit (bmo#1501952)

  * Dialog displayed when closing multiple windows shows unreplaced

    %1$S placeholder in Japanese and potentially other locales

    (bmo#1500823)

-------------------------------------------------------------------

Mon Oct 29 14:07:51 UTC 2018 - wr@rosenauer.org

- update to Firefox 63.0