-------------------------------------------------------------------

Sun Apr 18 09:42:40 CEST 2010 - wr@rosenauer.org

- security update to 3.6.4 (Lorentz)

  * enable crashreporter also for x86-64

  * Flash runs in a separate process to avoid crashing Firefox

    (ix86 only; x86-64 still uses nspluginwrapper)

-------------------------------------------------------------------

Thu Apr  1 11:15:38 UTC 2010 - wr@rosenauer.org

- security update to 3.6.3

  * MFSA 2010-25/CVE-2010-1121 (bmo#555109)

    Re-use of freed object due to scope confusion

-------------------------------------------------------------------

Thu Mar 18 06:43:33 CET 2010 - wr@rosenauer.org

- security update to version 3.6.2 (bnc#586567)

  * MFSA 2010-08/CVE-2010-1028

    WOFF heap corruption due to integer overflow

  * MFSA 2010-09/CVE-2010-0164 (bmo#547143)

    Deleted frame reuse in multipart/x-mixed-replace image

  * MFSA 2010-10/CVE-2010-0170 (bmo#541530)

    XSS via plugins and unprotected Location object

  * MFSA 2010-11/CVE-2010-0165/CVE-2010-0166/CVE-2010-0167

    Crashes with evidence of memory corruption

  * MFSA 2010-12/CVE-2010-0171 (bmo#531364)

    XSS using addEventListener and setTimeout on a wrapped object

  * MFSA 2010-13/CVE-2010-0168 (bmo#540642)

    Content policy bypass with image preloading

  * MFSA 2010-14/CVE-2010-0169 (bmo#535806)

    Browser chrome defacement via cached XUL stylesheets

  * MFSA 2010-15/CVE-2010-0172 (bmo#537862)

    Asynchronous Auth Prompt attaches to wrong window

  * MFSA 2010-16/CVE-2010-0173/CVE-2010-0174

    Crashes with evidence of memory corruption

  * MFSA 2010-18/CVE-2010-0176 (bmo#538308)

    Dangling pointer vulnerability in nsTreeContentView

  * MFSA 2010-19/CVE-2010-0177 (bmo#538310)

    Dangling pointer vulnerability in nsPluginArray

  * MFSA 2010-20/CVE-2010-0178 (bmo#546909)

    Chrome privilege escalation via forced URL drag and drop

  * MFSA 2010-22/CVE-2009-3555 (bmo#545755)

    Update NSS to support TLS renegotiation indication

  * MFSA 2010-23/CVE-2010-0181 (bmo#452093)

    Image src redirect to mailto: URL opens email editor

  * MFSA 2010-24/CVE-2010-0182 (bmo#490790)

    XMLDocument::load() doesn't check nsIContentPolicy

-------------------------------------------------------------------

Mon Jan 18 09:42:50 CET 2010 - wr@rosenauer.org

- update to 3.6rc2 (already named 3.6.0)

- removed obsolete orbit-devel build requirement

-------------------------------------------------------------------

Wed Jan  6 17:15:40 CET 2010 - wr@rosenauer.org

- major update to 3.6rc1

-------------------------------------------------------------------

Fri Dec 25 09:39:42 CET 2009 - wr@rosenauer.org

- update to version 3.5.7 (bnc#568011)

  * DNS resolution in MakeSN of nsAuthSSPI causing issues for

    proxy servers that support NTLM auth (bmo#535193)

- added missing lockdown preferences (bnc#567131)

-------------------------------------------------------------------

Thu Dec 17 20:06:38 CET 2009 - wr@rosenauer.org

- readded firefox-ui-lockdown.patch (bnc#546158)

-------------------------------------------------------------------

Thu Dec  3 21:53:59 CET 2009 - wr@rosenauer.org

- security update to version 3.5.6 (bnc#559807)

  * MFSA 2009-65/CVE-2009-3979/CVE-2009-3980/CVE-2009-3982

    Crashes with evidence of memory corruption (rv:1.9.1.6)

  * MFSA 2009-66/CVE-2009-3388 (bmo#504843,bmo#523816)

    Memory safety fixes in liboggplay media library

  * MFSA 2009-67/CVE-2009-3389 (bmo#515882,bmo#504613)

    Integer overflow, crash in libtheora video library

  * MFSA 2009-68/CVE-2009-3983 (bmo#487872)

    NTLM reflection vulnerability

  * MFSA 2009-69/CVE-2009-3984/CVE-2009-3985 (bmo#521461,bmo#514232)

    Location bar spoofing vulnerabilities

  * MFSA 2009-70/VE-2009-3986 (bmo#522430)

    Privilege escalation via chrome window.opener

- fixed firefox-browser-css.patch (bnc#561027)

-------------------------------------------------------------------

Mon Nov 23 22:31:21 CET 2009 - wr@rosenauer.org

- rebased patches for fuzz=0

-------------------------------------------------------------------

Thu Nov  5 19:49:33 UTC 2009 - wr@rosenauer.org

- update to version 3.5.5 (bnc#553172)

-------------------------------------------------------------------

Sat Oct 17 23:19:23 CEST 2009 - wr@rosenauer.org

- security update to version 3.5.4 (bnc#545277)

  * MFSA 2009-52/CVE-2009-3370 (bmo#511615)

    Form history vulnerable to stealing

  * MFSA 2009-53/CVE-2009-3274 (bmo#514823)

    Local downloaded file tampering

  * MFSA 2009-54/CVE-2009-3371 (bmo#514554)

    Crash with recursive web-worker calls

  * MFSA 2009-55/CVE-2009-3372 (bmo#500644)

    Crash in proxy auto-configuration regexp parsing

  * MFSA 2009-56/CVE-2009-3373 (bmo#511689)

    Heap buffer overflow in GIF color map parser

  * MFSA 2009-57/CVE-2009-3374 (bmo#505988)

    Chrome privilege escalation in XPCVariant::VariantDataToJS()

  * MFSA 2009-59/CVE-2009-1563 (bmo#516396, bmo#516862)

    Heap buffer overflow in string to number conversion

  * MFSA 2009-61/CVE-2009-3375 (bmo#503226)

    Cross-origin data theft through document.getSelection()

  * MFSA 2009-62/CVE-2009-3376 (bmo#511521)

    Download filename spoofing with RTL override

  * MFSA 2009-63/CVE-2009-3377/CVE-2009-3379/CVE-2009-3378

    Upgrade media libraries to fix memory safety bugs

  * MFSA 2009-64/CVE-2009-3380/CVE-2009-3381/CVE-2009-3383

    Crashes with evidence of memory corruption

- removed upstreamed patch

  * firefox-bug506901.patch 

-------------------------------------------------------------------

Wed Oct  7 20:11:24 CEST 2009 - llunak@novell.com

- fix KDE button order in one more place (bnc#170055)

-------------------------------------------------------------------

Fri Oct  2 20:26:49 CEST 2009 - wr@rosenauer.org

- improve UI colors to be usable with dark themes at all 

  (firefox-browser-css.patch) (bnc#503351)

- extend list of supported architectures as ABI identifier

  (mozilla-abi.patch) (bnc#543460)

-------------------------------------------------------------------

Mon Sep 14 00:07:55 CEST 2009 - wr@rosenauer.org

- added KDE integration patch from llunak@novell.com  

  (firefox-kde.patch)  

  * support for knotify, making -kde4-addon obsolete  

  * KDE-specific support functional (bnc#170055)

- do not build libnkgnomevfs (bmo#512671) (firefox-no-gnomevfs)

-------------------------------------------------------------------

Thu Sep 10 09:34:26 CEST 2009 - wr@rosenauer.org

- security update to version 3.5.3 (bnc#534458)

  * MFSA 2009-47/CVE-2009-3069/CVE-2009-3070/CVE-2009-3071/

    CVE-2009-3072/CVE-2009-3073/CVE-2009-3074/CVE-2009-3075

    Crashes with evidence of memory corruption

  * MFSA 2009-49/CVE-2009-3077 (bmo#506871)

    TreeColumns dangling pointer vulnerability

  * MFSA 2009-50/CVE-2009-3078 (bmo#453827)

    Location bar spoofing via tall line-height Unicode characters

  * MFSA 2009-51/CVE-2009-3079 (bmo#454363)

    Chrome privilege escalation with FeedWriter

-------------------------------------------------------------------

Wed Aug 19 22:14:07 CEST 2009 - wr@rosenauer.org

- renamed patch firefox-contextmenu-gnome to firefox-cross-desktop

  as it contains more tweaks to handle non-Gnome environments and

  especially KDE integration: 

  * added the ability to set the KDE default browser 

    (still part of bnc#170055)

-------------------------------------------------------------------

Sat Aug  8 00:14:18 CEST 2009 - wr@rosenauer.org

- split -translations package into -common and -other

  (bnc#529180)

- remove "set as background" from context menu if not running in

  Gnome (part of bnc#170055)

-------------------------------------------------------------------

Fri Jul 31 09:01:57 CEST 2009 - wr@rosenauer.org

- security update to version 3.5.2

  * MFSA 2009-38/CVE-2009-2470 (bmo#459524)

    Data corruption with SOCKS5 reply containing DNS name longer

    than 15 characters

  * MFSA 2009-44/CVE-2009-2654 (bmo#451898)

    Location bar and SSL indicator spoofing via window.open() on

    invalid URL

  * MFSA 2009-45

    Crashes with evidence of memory corruption

  * MFSA 2009-46 (bmo#498897)

    Chrome privilege escalation due to incorrectly cached wrapper

  * various other stability fixes

- export MOZ_APP_LAUNCHER in the startscript (bmo#453689)

-------------------------------------------------------------------

Tue Jul 28 14:54:46 CEST 2009 - wr@rosenauer.org

- fixed %exclude usage

- fixed preferences' advanced pane for fresh profiles (bmo#506901)

-------------------------------------------------------------------

Wed Jul 15 20:13:19 CEST 2009 - wr@rosenauer.org

- security update to version 3.5.1

  * MFSA 2009-41

    Corrupt JIT state after deep return from native function

-------------------------------------------------------------------

Mon Jul  6 12:33:47 CEST 2009 - wr@rosenauer.org

- added mozilla-linkorder.patch to fix build with --as-needed

-------------------------------------------------------------------

Tue Jun 30 08:52:00 CEST 2009 - wr@rosenauer.org

- update to final version 3.5 (20090623)

-------------------------------------------------------------------

Tue Jun 23 09:39:50 CEST 2009 - wr@rosenauer.org

- fixed build by linking to a real file

-------------------------------------------------------------------

Thu Jun 18 10:19:40 CEST 2009 - wr@rosenauer.org

- update to version 3.5rc2 (20090617)

- BuildRequire mozilla-xulrunner191 = 1.9.1.0

-------------------------------------------------------------------

Sat Jun  6 15:59:02 CEST 2009 - wr@rosenauer.org

- update to version 3.5b99 (20090604)

- BuildRequire mozilla-xulrunner191 = 1.9.1b99

-------------------------------------------------------------------

Wed May 27 08:03:16 CEST 2009 - wr@rosenauer.org

- fixed typos in improved xulrunner dependencies

-------------------------------------------------------------------

Mon May 11 18:25:12 CEST 2009 - wr@rosenauer.org

- use non-localized Downloads folder (bnc#501724)

-------------------------------------------------------------------

Mon May  4 07:57:50 CEST 2009 - wr@rosenauer.org

- update to new major version 3.5b4

  * based on Gecko 1.9.1 (mozilla-xulrunner191)

  * Private Browsing Mode

  * TraceMonkey JavaScript engine

  * Geolocation support

  * native JSON and web worker threads support

  * speculative parsing for faster content rendering

  * Some HTML5 support

- updated firefox.schemas

- improved firefox-no-update.patch

-------------------------------------------------------------------

Tue Apr 28 10:47:54 CEST 2009 - wr@rosenauer.org

- security update to 3.0.10

  * MFSA 2009-23/CVE-2009-1313 (bmo#489647)

      Crash in nsTextFrame::ClearTextRun()

-------------------------------------------------------------------

Thu Apr 16 13:52:21 CEST 2009 - wr@rosenauer.org

- security update to 3.0.9 (bnc#495473)

  * MFSA 2009-14/CVE-2009-1302/CVE-2009-1303/CVE-2009-1304/CVE-2009-1305

      Crashes with evidence of memory corruption (rv:1.9.0.9)

  * MFSA 2009-15/CVE-2009-0652 (bmo#479336)

      URL spoofing with box drawing character

  * MFSA 2009-16/CVE-2009-1306 (bmo#474536)

      jar: scheme ignores the content-disposition: header on the

      inner URI

  * MFSA 2009-17/CVE-2009-1307 (bmo#481342)

      Same-origin violations when Adobe Flash loaded via

      view-source: scheme

  * MFSA 2009-18/CVE-2009-1308 (bmo#481558)

      XSS hazard using third-party stylesheets and XBL bindings

  * MFSA 2009-19/CVE-2009-1309 (bmo#482206,478433)

      Same-origin violations in XMLHttpRequest and

      XPCNativeWrapper.toString

  * MFSA 2009-20/CVE-2009-1310 (bmo#483086)

      Malicious search plugins can inject code into arbitrary sites

  * MFSA 2009-21/CVE-2009-1311 (bmo#471962)

      POST data sent to wrong site when saving web page with

      embedded frame

  * MFSA 2009-22/CVE-2009-1312 (bmo#475636)

      Firefox allows Refresh header to redirect to javascript: URIs

-------------------------------------------------------------------

Fri Mar 27 09:43:43 CET 2009 - wr@rosenauer.org

- security update to 1.9.0.8 (bnc#488955,489411)

  * MFSA 2009-12/CVE-2009-1169 (bmo#460090,485217)

      Crash and remote code execution in XSL transformation

  * MFSA 2009-13/CVE-2009-1044 (bmo#484320)

      Arbitrary code execution via XUL tree moveToEdgeShift

- allow RPM provides for stuff besides shared libraries

  (e.g. mime-types)

-------------------------------------------------------------------

Sun Mar  1 11:08:58 CET 2009 - wr@rosenauer.org

- security update to 3.0.7 (bnc#478625)

  * MFSA 2009-07 - Crashes with evidence of memory corruption

    CVE-2009-0771 - Layout Engine Crashes

    CVE-2009-0772 - Layout Engine Crashes

    CVE-2009-0773 - crashes in the JavaScript engine

    CVE-2009-0774 - Layout Engine Crashes

  * MFSA 2009-08/CVE-2009-0775 - (bmo#474456)

    Mozilla Firefox XUL Linked Clones Double Free Vulnerability

  * MFSA 2009-09/CVE-2009-0776 (bmo#414540)

    XML data theft via RDFXMLDataSource and cross-domain redirect

  * MFSA 2009-10/CVE-2009-0040 (bmo#478901)

    Upgrade PNG library to fix memory safety hazards

  * MFSA 2009-11/CVE-2009-0777 (bmo#452979)

    URL spoofing with invisible control characters

-------------------------------------------------------------------

Wed Feb  4 18:58:59 EST 2009 - hfiguiere@suse.de

- Review and approve changes.

-------------------------------------------------------------------

Wed Jan 28 13:48:00 CET 2009 - wr@rosenauer.org

- security update to 3.0.6 (bnc#470074)

  * MFSA 2009-06/CVE-2009-0358: Directives to not cache pages ignored

    (bmo#441751)

  * MFSA 2009-05/CVE-2009-0357: XMLHttpRequest allows reading 

    HTTPOnly cookies (bmo#380418)

  * MFSA 2009-04/CVE-2009-0356: Chrome privilege escalation via 

    local .desktop files (bmo#460425)

  * MFSA 2009-03/CVE-2009-0355: Local file stealing with SessionStore