-------------------------------------------------------------------

Fri Dec  8 15:55:00 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 120.0.1 (boo#1217910)

  * Fixed a bug that was causing persistent startup slowdowns

    (bmo#1867095)

  * Fixed an issue that was causing 100% CPU usage on sites such as

    Google Maps. (bmo#1866409)

  * Fixed an issue that was causing YouTube videos to show a green

    screen when hardware acceleration was enabled. (bmo#1865928)

  * Fixed an issue where the status bar was still visible when

    viewing fullscreen video. (bmo#1853896)

  * Fixed a startup crash affecting Linux users on some aarch64

    systems with page sizes other than 4KB. (bmo#1866025)

-------------------------------------------------------------------

Wed Nov 22 06:57:37 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 120.0

  https://www.mozilla.org/en-US/firefox/120.0/releasenotes

  MFSA 2023-49 (bsc#1217230)

  * CVE-2023-6204 (bmo#1841050)

    Out-of-bound memory access in WebGL2 blitFramebuffer

  * CVE-2023-6205 (bmo#1854076)

    Use-after-free in MessagePort::Entangled

  * CVE-2023-6206 (bmo#1857430)

    Clickjacking permission prompts using the fullscreen

    transition

  * CVE-2023-6207 (bmo#1861344)

    Use-after-free in ReadableByteStreamQueueEntry::Buffer

  * CVE-2023-6208 (bmo#1855345)

    Using Selection API would copy contents into X11 primary

    selection.

  * CVE-2023-6209 (bmo#1858570)

    Incorrect parsing of relative URLs starting with "///"

  * CVE-2023-6210 (bmo#1801501)

    Mixed-content resources not blocked in a javascript: pop-up

  * CVE-2023-6211 (bmo#1850200)

    Clickjacking to load insecure pages in HTTPS-only mode

  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,

    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,

    bmo#1862782)

    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,

    and Thunderbird 115.5

  * CVE-2023-6213 (bmo#1849265, bmo#1851118, bmo#1854911)

    Memory safety bugs fixed in Firefox 120

- rebased patches

-------------------------------------------------------------------

Wed Nov  8 20:27:15 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 119.0.1

  * Fixed a bug causing colors in the <select> HTML element to not

    be applied to dropdown menu arrows (bmo#1861253)

  * Fixed a bug with the <input> HTML element state not changing

    when dynamically updating the `disabled` attribute on an

    ancestor <fieldset> (bmo#1861027)

  * Fixed a bug causing elements with the indeterminate CSS

    selector in a radio group to not update (bmo#1861346)

-------------------------------------------------------------------

Thu Oct 26 10:31:03 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 119.0

  https://www.mozilla.org/en-US/firefox/119.0/releasenotes

  MFSA 2023-45 (bsc#1216338)

  * CVE-2023-5721 (bmo#1830820)

    Queued up rendering could have allowed websites to clickjack

  * CVE-2023-5722 (bmo#1738426)

    Cross-Origin size and header leakage

  * CVE-2023-5723 (bmo#1802057)

    Invalid cookie characters could have led to unexpected errors

  * CVE-2023-5724 (bmo#1836705)

    Large WebGL draw could have led to a crash

  * CVE-2023-5725 (bmo#1845739)

    WebExtensions could open arbitrary URLs

  * CVE-2023-5726 (bmo#1846205)

    Full screen notification obscured by file open dialog on macOS

  * CVE-2023-5727 (bmo#1847180)

    Download Protections were bypassed by .msix, .msixbundle,

    .appx, and .appxbundle files on Windows

  * CVE-2023-5728 (bmo#1852729)

    Improper object tracking during GC in the JavaScript engine

    could have led to a crash.

  * CVE-2023-5729 (bmo#1823720)

    Fullscreen notification dialog could have been obscured by

    WebAuthn prompts

  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694, bmo#1848833,

    bmo#1850191, bmo#1850259, bmo#1852596, bmo#1853201, bmo#1854002,

    bmo#1855306, bmo#1855640, bmo#1856695)

    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,

    and Thunderbird 115.4.1

  * CVE-2023-5731 (bmo#1690111, bmo#1721904, bmo#1851803, bmo#1854068)

    Memory safety bugs fixed in Firefox 119

- requires NSS 3.94

-------------------------------------------------------------------

Wed Oct 11 18:28:09 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 118.0.2

  * Fix games not loading on betsoft.com (bmo#1856145)

  * Fix printing issues for some SVG images (bmo#1853727)

  * Fix CORS XHR with authentication no longer working (bmo#1855650)

  * Fix h264 WebRTC video not working in some contexts (bmo#1855636)

  * Fix Firefox Translations not working on some pages

    (bmo#1841656, bmo#1855307)

  * Stability fixes (bmo#1851991, bmo#1799326, bmo#1856637)

-------------------------------------------------------------------

Sat Sep 30 19:51:56 UTC 2023 - Björn Bidar <bjorn.bidar@thaodan.de>

- Activate KDE integration again, included rebased and updated

  patches, firefox-kde.patch and mozilla-kde.patch, (upstream

  removed special files handling for preferences but that has no

  effect since we haven't shipped obsolete kde.js for a while)

  (boo#1216027)

-------------------------------------------------------------------

Fri Sep 29 06:50:26 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 118.0.1

  MFSA 2023-44 (bsc#1215814)

  * CVE-2023-5217 (bmo#1855550),

    Heap buffer overflow in libvpx

-------------------------------------------------------------------

Mon Sep 25 06:35:49 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 118.0

  MFSA 2023-41 (bsc#1215575)

  * CVE-2023-5168 (bmo#1846683)

    Out-of-bounds write in FilterNodeD2D1

  * CVE-2023-5169 (bmo#1846685)

    Out-of-bounds write in PathOps

  * CVE-2023-5170 (bmo#1846686)

    Memory leak from a privileged process

  * CVE-2023-5171 (bmo#1851599)

    Use-after-free in Ion Compiler

  * CVE-2023-5172 (bmo#1852218)

    Memory Corruption in Ion Hints

  * CVE-2023-5173 (bmo#1823172)

    Out-of-bounds write in HTTP Alternate Services

  * CVE-2023-5174 (bmo#1848454)

    Double-free in process spawning on Windows

  * CVE-2023-5175 (bmo#1849704)

    Use-after-free of ImageBitmap during process shutdown

  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824, bmo#1843962,

    bmo#1848890, bmo#1850180, bmo#1850983, bmo#1851195)

    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,

    and Thunderbird 115.3

- requires NSS 3.93

- add mozilla-bmo1822730.patch

- deactivated KDE integration temporarily

  (removed mozilla-kde.patch and firefox-kde.patch for now)

-------------------------------------------------------------------

Tue Sep 12 17:04:01 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 117.0.1

  * Fix a bug causing extensions using an event page for long-

    running tasks to be terminated while running, causing

    unexpected behavior changes (bmo#1851373)

  * Temporarily revert an intentional behavior change preventing

    Javascript from changing URL.protocol (bmo#1850954).

  * Fix audio worklets not working for sites using WebAssembly

    exception handling (bmo#1851468)

  * Fix the Reopen all tabs option in the Recently closed tabs

    menu sometimes failing to open all tabs (bmo#1850856)

  * Fix the bookmarks menu sometimes remaining partially visible

    when minimizing Firefox (bmo#1843700)

  * Fix an issue causing incorrect time zones to be detected on

    some sites (bmo#1848615)

  * MFSA 2023-40 CVE-2023-4863 (boo#1215231)

    Heap buffer overflow in WebP

-------------------------------------------------------------------

Sun Aug 27 08:51:28 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 117.0

  https://www.mozilla.org/en-US/firefox/117.0/releasenotes

  MFSA 2023-34 (bsc#1214606)

  * CVE-2023-4573 (bmo#1846687)

    Memory corruption in IPC CanvasTranslator

  * CVE-2023-4574 (bmo#1846688)

    Memory corruption in IPC ColorPickerShownCallback

  * CVE-2023-4575 (bmo#1846689)

    Memory corruption in IPC FilePickerShownCallback

  * CVE-2023-4576 (bmo#1846694)

    Integer Overflow in RecordedSourceSurfaceCreation

  * CVE-2023-4577 (bmo#1847397)

    Memory corruption in JIT UpdateRegExpStatics

  * CVE-2023-4578 (bmo#1839007)

    Error reporting methods in SpiderMonkey could have triggered

    an Out of Memory Exception

  * CVE-2023-4579 (bmo#1842766)

    Persisted search terms were formatted as URLs

  * CVE-2023-4580 (bmo#1843046)

    Push notifications saved to disk unencrypted

  * CVE-2023-4581 (bmo#1843758)

    XLL file extensions were downloadable without warnings

  * CVE-2023-4582 (bmo#1773874)

    Buffer Overflow in WebGL glGetProgramiv

  * CVE-2023-4583 (bmo#1842030)

    Browsing Context potentially not cleared when closing Private

    Window

  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,

    bmo#1846526, bmo#1847529)

    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,

    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2

  * CVE-2023-4585 (bmo#1751583, bmo#1841082, bmo#1847904, bmo#1848999)

    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,

    and Thunderbird 115.2

- requires

  NSS = 3.92

  rustc = 1.71

-------------------------------------------------------------------

Thu Aug 17 18:20:18 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 116.0.3

  * Fixed an issue for OPFS users that broke access to files that

    were locally cached in a previous version

    (bmo#1847989, bmo#1847619)

  * Fixed an issue that was breaking screensharing for some users

    on Wayland (bmo#1841851)

  * Fixed an issue where a fullscreen notification was persistently

    being shown to a user, even after disabling it (bmo#1847901)

  * Fixed an issue where Firefox would hang when doing a Google

    search (bmo#1847066)

-------------------------------------------------------------------

Tue Aug 15 09:51:15 UTC 2023 - Adam Majer <adam.majer@suse.de>

- After further testing on memory consumption during linking, it's

  safe to remove most of the memory reducing options for ix86 linker.

  A combination of these actually resulted in the OOM condition.

  It's even possible to add basic debugging info while keeping

  linker memory consumption at about 2GB

-------------------------------------------------------------------

Thu Aug 10 16:32:02 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 116.0.2

  * fixes for other platforms

-------------------------------------------------------------------

Wed Aug  9 09:52:36 UTC 2023 - Adam Majer <adam.majer@suse.de>

- Workarold ld bug causing OOM when linking on 32-bit

- Remove -j1 limit on x86. The build runs on 64-bit kernel with a

  32-bit userland. This means there is plenty of memory available

  but userland is limited to just under 4GB per process.

-------------------------------------------------------------------

Sat Aug  5 17:46:22 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 116.0.1

  * fixes for other platforms

-------------------------------------------------------------------

Sat Aug  5 10:04:18 UTC 2023 - Andreas Schwab <schwab@suse.de>

- ship vaapitest binary for supported archs

-------------------------------------------------------------------

Fri Aug  4 09:55:05 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- re-enable ppc64le

- ship v4l2test binary for supported archs

- drop obsolete mozilla-bmo1775202.patch

-------------------------------------------------------------------

Sun Jul 30 19:55:49 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 116.0

  * https://www.mozilla.org/en-US/firefox/116.0/releasenotes/

  MFSA 2023-29 (bsc#1213746)

  * CVE-2023-4045 (bmo#1833876)

    Offscreen Canvas could have bypassed cross-origin restrictions

  * CVE-2023-4046 (bmo#1837686)

    Incorrect value used during WASM compilation

  * CVE-2023-4047 (bmo#1839073)

    Potential permissions request bypass via clickjacking

  * CVE-2023-4048 (bmo#1841368)

    Crash in DOMParser due to out-of-memory conditions

  * CVE-2023-4049 (bmo#1842658)

    Fix potential race conditions when releasing platform objects

  * CVE-2023-4050 (bmo#1843038)

    Stack buffer overflow in StorageManager

  * CVE-2023-4051 (bmo#1821884)

    Full screen notification obscured by file open dialog

  * CVE-2023-4052 (bmo#1824420)

    File deletion and privilege escalation through Firefox uninstaller

  * CVE-2023-4053 (bmo#1839079)

    Full screen notification obscured by external program

  * CVE-2023-4054 (bmo#1840777)

    Lack of warning when opening appref-ms files

  * CVE-2023-4055 (bmo#1782561)

    Cookie jar overflow caused unexpected cookie jar state

  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,

    bmo#1842325, bmo#1843847)

    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,

    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14

  * CVE-2023-4057 (bmo#1841682)

    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,

    and Thunderbird 115.1

  * CVE-2023-4058 (bmo#1819160, bmo#1828024)

    Memory safety bugs fixed in Firefox 116

- require NSS 3.91

- remove obsolete mozilla-fix-top-level-asm.patch

- re-enable LTO

-------------------------------------------------------------------

Fri Jul 28 20:56:00 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 115.0.3

  * fixes for other platforms

- remove bashisms from firefox startup script (boo#1213657)

-------------------------------------------------------------------

Thu Jul 13 13:30:20 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 115.0.2

  * Fixed a bug with displaying a caret in the text editor on some websites

    (bmo#1840804)

  * Fixed a bug with broken audio rendering on some websites (bmo#1841982)

  * Fixed a bug with patternTransform translate using the wrong units

    (bmo#1840746)

  MFSA 2023-26 (bsc#1213230)

  * CVE-2023-3600 (bmo#1839703)

    Use-after-free in workers

-------------------------------------------------------------------

Fri Jul  7 19:39:30 UTC 2023 - Andreas Stieger <Andreas.Stieger@gmx.de>

- Mozilla Firefox 115.0.1

  * fixes for other platforms

-------------------------------------------------------------------

Sun Jul  2 16:00:53 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 115.0

  * Support for importing payment methods saved in Chrome-based browser

  * Hardware video decoding is now enabled for Intel GPUs on Linux

  * The Tab Manager dropdown now features close buttons, so tabs

    can be closed more quickly

  * Streamlined the user interface for importing data in from other browsers

  * Users without platform support for H264 video decoding can now

    fallback to Cisco's OpenH264 plugin for playback.

  * Undo and redo are now available in Password fields

  * Changed: On Linux, middle clicks on the new tab button will

    now open the xclipboard contents in the new tab. If the

    xclipboard content is a URL then that URL is opened, any

    other text is opened with your default search provider.

  * Changed: For users with a Firefox Colorways built-in theme,

    the theme will be automatically migrated to the same theme

    hosted on addons.mozilla.org for Firefox profiles that have

    disabled add-ons auto-updates. This will allow users to keep

    their Colorways theme when they are later removed from

    Firefox installer files.

  * Changed: Certain Firefox users may come across a message in

    the extensions panel indicating that their add-ons are not

    allowed on the site currently open. We have introduced a new

    back-end feature to only allow some extensions monitored by

    Mozilla to run on specific websites for various reasons,

    including security concerns.

  * HTML5: The builtin editor now behaves similarly to other

    browsers with `contenteditable` and `designMode` when

    splitting a node, e.g. typing Enter to split a paragraph, and

    also when joining two nodes, e.g. typing Backspace at the

    start of a paragraph to join the paragraph and the previous

    one.

    When a node is split, the builtin editor creates a new node

    after the original one instead of before, i.e. creates the

    right node instead of the left node.

    Similarly, when two nodes are joined, the builtin editor

    deletes the latter node and moves its children to the end of

    the preceding node instead of deleting the former node and

    moving its child to the start of the following node.

  * HTML5: WebRTC application developers can now specify a target

    in milliseconds of media for the jitter buffer to hold.

    Altering the target value allows applications to control the

    tradeoff between playout delay and the risk of running out of

    audio or video frames due to network jitter.

  * HTML5: Change array by copy provides additional methods on

    `Array.prototype` and `TypedArray.prototype` to enable

    changes on the array by returning a new copy of it with the

    change.

  * HTML5: The animation-composition property is now supported,

    allowing a declarative way to define the composite operation

    used when multiple animations affect the same property

    simultaneously.

  * HTML5: Added the URL.canParse() function to allow easy and

    fast checking if URLs are valid and parseable.

  * HTML5: IndexedDB is now also supported in private browsing

    without memory limits thanks to encrypted storage on disk.

    The temporary keys to decrypt the information are hold in RAM

    only and all stored information is purged at the normal end

    of a private browsing session from disk.

  * HTML5: Supports conditions are now supported in CSS import

    rules @import supports(...)

  * Developer: In web development, we rely on third-party

    libraries which you may not be interested in while debugging.

    These can be ignored. Ignoring them means that breakpoints

    will not get hit and they are skipped during stepping.

    You can now choose to **Hide ignore-listed sources** in the

    Developer Tools source tree

  * Developer: We have introduced a new option,

    `devtools.f12_enabled`, that can be utilized to prevent the

    accidental use of the F12 key, which opens the DevTools

    toolbox (bug).

  * Enterprise: You can find information about policy updates and

    enterprise specific bug fixes in the Firefox for Enterprise

    115 Release Notes.

  MFSA 2023-22 (bsc#1212438)

  * CVE-2023-3482 (bmo#1839464)

    Block all cookies bypass for localstorage

  * CVE-2023-37201 (bmo#1826002)

    Use-after-free in WebRTC certificate generation

  * CVE-2023-37202 (bmo#1834711)

    Potential use-after-free from compartment mismatch in SpiderMonkey

  * CVE-2023-37203 (bmo#291640)

    Drag and Drop API may provide access to local system files

  * CVE-2023-37204 (bmo#1832195)

    Fullscreen notification obscured via option element

  * CVE-2023-37205 (bmo#1704420)

    URL spoofing in address bar using RTL characters

  * CVE-2023-37206 (bmo#1813299)

    Insufficient validation of symlinks in the FileSystem API

  * CVE-2023-37207 (bmo#1816287)