-------------------------------------------------------------------

Fri Sep 29 06:50:26 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 118.0.1

  MFSA 2023-44 (bsc#1215814)

  * CVE-2023-5217 (bmo#1855550),

    Heap buffer overflow in libvpx

-------------------------------------------------------------------

Mon Sep 25 06:35:49 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 118.0

  MFSA 2023-41 (bsc#1215575)

  * CVE-2023-5168 (bmo#1846683)

    Out-of-bounds write in FilterNodeD2D1

  * CVE-2023-5169 (bmo#1846685)

    Out-of-bounds write in PathOps

  * CVE-2023-5170 (bmo#1846686)

    Memory leak from a privileged process

  * CVE-2023-5171 (bmo#1851599)

    Use-after-free in Ion Compiler

  * CVE-2023-5172 (bmo#1852218)

    Memory Corruption in Ion Hints

  * CVE-2023-5173 (bmo#1823172)

    Out-of-bounds write in HTTP Alternate Services

  * CVE-2023-5174 (bmo#1848454)

    Double-free in process spawning on Windows

  * CVE-2023-5175 (bmo#1849704)

    Use-after-free of ImageBitmap during process shutdown

  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824, bmo#1843962,

    bmo#1848890, bmo#1850180, bmo#1850983, bmo#1851195)

    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,

    and Thunderbird 115.3

- requires NSS 3.93

- add mozilla-bmo1822730.patch

- deactivated KDE integration temporarily

-------------------------------------------------------------------

Tue Sep 12 17:04:01 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 117.0.1

  * Fix a bug causing extensions using an event page for long-

    running tasks to be terminated while running, causing

    unexpected behavior changes (bmo#1851373)

  * Temporarily revert an intentional behavior change preventing

    Javascript from changing URL.protocol (bmo#1850954).

  * Fix audio worklets not working for sites using WebAssembly

    exception handling (bmo#1851468)

  * Fix the Reopen all tabs option in the Recently closed tabs

    menu sometimes failing to open all tabs (bmo#1850856)

  * Fix the bookmarks menu sometimes remaining partially visible

    when minimizing Firefox (bmo#1843700)

  * Fix an issue causing incorrect time zones to be detected on

    some sites (bmo#1848615)

  * MFSA 2023-40 CVE-2023-4863 (boo#1215231)

    Heap buffer overflow in WebP

-------------------------------------------------------------------

Sun Aug 27 08:51:28 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 117.0

  https://www.mozilla.org/en-US/firefox/117.0/releasenotes

  MFSA 2023-34 (bsc#1214606)

  * CVE-2023-4573 (bmo#1846687)

    Memory corruption in IPC CanvasTranslator

  * CVE-2023-4574 (bmo#1846688)

    Memory corruption in IPC ColorPickerShownCallback

  * CVE-2023-4575 (bmo#1846689)

    Memory corruption in IPC FilePickerShownCallback

  * CVE-2023-4576 (bmo#1846694)

    Integer Overflow in RecordedSourceSurfaceCreation

  * CVE-2023-4577 (bmo#1847397)

    Memory corruption in JIT UpdateRegExpStatics

  * CVE-2023-4578 (bmo#1839007)

    Error reporting methods in SpiderMonkey could have triggered

    an Out of Memory Exception

  * CVE-2023-4579 (bmo#1842766)

    Persisted search terms were formatted as URLs

  * CVE-2023-4580 (bmo#1843046)

    Push notifications saved to disk unencrypted

  * CVE-2023-4581 (bmo#1843758)

    XLL file extensions were downloadable without warnings

  * CVE-2023-4582 (bmo#1773874)

    Buffer Overflow in WebGL glGetProgramiv

  * CVE-2023-4583 (bmo#1842030)

    Browsing Context potentially not cleared when closing Private

    Window

  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,

    bmo#1846526, bmo#1847529)

    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,

    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2

  * CVE-2023-4585 (bmo#1751583, bmo#1841082, bmo#1847904, bmo#1848999)

    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,

    and Thunderbird 115.2

- requires

  NSS = 3.92

  rustc = 1.71

-------------------------------------------------------------------

Thu Aug 17 18:20:18 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 116.0.3

  * Fixed an issue for OPFS users that broke access to files that

    were locally cached in a previous version

    (bmo#1847989, bmo#1847619)

  * Fixed an issue that was breaking screensharing for some users

    on Wayland (bmo#1841851)

  * Fixed an issue where a fullscreen notification was persistently

    being shown to a user, even after disabling it (bmo#1847901)

  * Fixed an issue where Firefox would hang when doing a Google

    search (bmo#1847066)

-------------------------------------------------------------------

Tue Aug 15 09:51:15 UTC 2023 - Adam Majer <adam.majer@suse.de>

- After further testing on memory consumption during linking, it's

  safe to remove most of the memory reducing options for ix86 linker.

  A combination of these actually resulted in the OOM condition.

  It's even possible to add basic debugging info while keeping

  linker memory consumption at about 2GB

-------------------------------------------------------------------

Thu Aug 10 16:32:02 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 116.0.2

  * fixes for other platforms

-------------------------------------------------------------------

Wed Aug  9 09:52:36 UTC 2023 - Adam Majer <adam.majer@suse.de>

- Workarold ld bug causing OOM when linking on 32-bit

- Remove -j1 limit on x86. The build runs on 64-bit kernel with a

  32-bit userland. This means there is plenty of memory available

  but userland is limited to just under 4GB per process.

-------------------------------------------------------------------

Sat Aug  5 17:46:22 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 116.0.1

  * fixes for other platforms

-------------------------------------------------------------------

Sat Aug  5 10:04:18 UTC 2023 - Andreas Schwab <schwab@suse.de>

- ship vaapitest binary for supported archs

-------------------------------------------------------------------

Fri Aug  4 09:55:05 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- re-enable ppc64le

- ship v4l2test binary for supported archs

- drop obsolete mozilla-bmo1775202.patch

-------------------------------------------------------------------

Sun Jul 30 19:55:49 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 116.0

  * https://www.mozilla.org/en-US/firefox/116.0/releasenotes/

  MFSA 2023-29 (bsc#1213746)

  * CVE-2023-4045 (bmo#1833876)

    Offscreen Canvas could have bypassed cross-origin restrictions

  * CVE-2023-4046 (bmo#1837686)

    Incorrect value used during WASM compilation

  * CVE-2023-4047 (bmo#1839073)

    Potential permissions request bypass via clickjacking

  * CVE-2023-4048 (bmo#1841368)

    Crash in DOMParser due to out-of-memory conditions

  * CVE-2023-4049 (bmo#1842658)

    Fix potential race conditions when releasing platform objects

  * CVE-2023-4050 (bmo#1843038)

    Stack buffer overflow in StorageManager

  * CVE-2023-4051 (bmo#1821884)

    Full screen notification obscured by file open dialog

  * CVE-2023-4052 (bmo#1824420)

    File deletion and privilege escalation through Firefox uninstaller

  * CVE-2023-4053 (bmo#1839079)

    Full screen notification obscured by external program

  * CVE-2023-4054 (bmo#1840777)

    Lack of warning when opening appref-ms files

  * CVE-2023-4055 (bmo#1782561)

    Cookie jar overflow caused unexpected cookie jar state

  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,

    bmo#1842325, bmo#1843847)

    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,

    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14

  * CVE-2023-4057 (bmo#1841682)

    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,

    and Thunderbird 115.1

  * CVE-2023-4058 (bmo#1819160, bmo#1828024)

    Memory safety bugs fixed in Firefox 116

- require NSS 3.91

- remove obsolete mozilla-fix-top-level-asm.patch

- re-enable LTO

-------------------------------------------------------------------

Fri Jul 28 20:56:00 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 115.0.3

  * fixes for other platforms

- remove bashisms from firefox startup script (boo#1213657)

-------------------------------------------------------------------

Thu Jul 13 13:30:20 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 115.0.2

  * Fixed a bug with displaying a caret in the text editor on some websites

    (bmo#1840804)

  * Fixed a bug with broken audio rendering on some websites (bmo#1841982)

  * Fixed a bug with patternTransform translate using the wrong units

    (bmo#1840746)

  MFSA 2023-26 (bsc#1213230)

  * CVE-2023-3600 (bmo#1839703)

    Use-after-free in workers

-------------------------------------------------------------------

Fri Jul  7 19:39:30 UTC 2023 - Andreas Stieger <Andreas.Stieger@gmx.de>

- Mozilla Firefox 115.0.1

  * fixes for other platforms

-------------------------------------------------------------------

Sun Jul  2 16:00:53 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 115.0

  * Support for importing payment methods saved in Chrome-based browser

  * Hardware video decoding is now enabled for Intel GPUs on Linux

  * The Tab Manager dropdown now features close buttons, so tabs

    can be closed more quickly

  * Streamlined the user interface for importing data in from other browsers

  * Users without platform support for H264 video decoding can now

    fallback to Cisco's OpenH264 plugin for playback.

  * Undo and redo are now available in Password fields

  * Changed: On Linux, middle clicks on the new tab button will

    now open the xclipboard contents in the new tab. If the

    xclipboard content is a URL then that URL is opened, any

    other text is opened with your default search provider.

  * Changed: For users with a Firefox Colorways built-in theme,

    the theme will be automatically migrated to the same theme

    hosted on addons.mozilla.org for Firefox profiles that have

    disabled add-ons auto-updates. This will allow users to keep

    their Colorways theme when they are later removed from

    Firefox installer files.

  * Changed: Certain Firefox users may come across a message in

    the extensions panel indicating that their add-ons are not

    allowed on the site currently open. We have introduced a new

    back-end feature to only allow some extensions monitored by

    Mozilla to run on specific websites for various reasons,

    including security concerns.

  * HTML5: The builtin editor now behaves similarly to other

    browsers with `contenteditable` and `designMode` when

    splitting a node, e.g. typing Enter to split a paragraph, and

    also when joining two nodes, e.g. typing Backspace at the

    start of a paragraph to join the paragraph and the previous

    one.

    When a node is split, the builtin editor creates a new node

    after the original one instead of before, i.e. creates the

    right node instead of the left node.

    Similarly, when two nodes are joined, the builtin editor

    deletes the latter node and moves its children to the end of

    the preceding node instead of deleting the former node and

    moving its child to the start of the following node.

  * HTML5: WebRTC application developers can now specify a target

    in milliseconds of media for the jitter buffer to hold.

    Altering the target value allows applications to control the

    tradeoff between playout delay and the risk of running out of

    audio or video frames due to network jitter.

  * HTML5: Change array by copy provides additional methods on

    `Array.prototype` and `TypedArray.prototype` to enable

    changes on the array by returning a new copy of it with the

    change.

  * HTML5: The animation-composition property is now supported,

    allowing a declarative way to define the composite operation

    used when multiple animations affect the same property

    simultaneously.

  * HTML5: Added the URL.canParse() function to allow easy and

    fast checking if URLs are valid and parseable.

  * HTML5: IndexedDB is now also supported in private browsing

    without memory limits thanks to encrypted storage on disk.

    The temporary keys to decrypt the information are hold in RAM

    only and all stored information is purged at the normal end

    of a private browsing session from disk.

  * HTML5: Supports conditions are now supported in CSS import

    rules @import supports(...)

  * Developer: In web development, we rely on third-party

    libraries which you may not be interested in while debugging.

    These can be ignored. Ignoring them means that breakpoints

    will not get hit and they are skipped during stepping.

    You can now choose to **Hide ignore-listed sources** in the

    Developer Tools source tree

  * Developer: We have introduced a new option,

    `devtools.f12_enabled`, that can be utilized to prevent the

    accidental use of the F12 key, which opens the DevTools

    toolbox (bug).

  * Enterprise: You can find information about policy updates and

    enterprise specific bug fixes in the Firefox for Enterprise

    115 Release Notes.

  MFSA 2023-22 (bsc#1212438)

  * CVE-2023-3482 (bmo#1839464)

    Block all cookies bypass for localstorage

  * CVE-2023-37201 (bmo#1826002)

    Use-after-free in WebRTC certificate generation

  * CVE-2023-37202 (bmo#1834711)

    Potential use-after-free from compartment mismatch in SpiderMonkey

  * CVE-2023-37203 (bmo#291640)

    Drag and Drop API may provide access to local system files

  * CVE-2023-37204 (bmo#1832195)

    Fullscreen notification obscured via option element

  * CVE-2023-37205 (bmo#1704420)

    URL spoofing in address bar using RTL characters

  * CVE-2023-37206 (bmo#1813299)

    Insufficient validation of symlinks in the FileSystem API

  * CVE-2023-37207 (bmo#1816287)

    Fullscreen notification obscured

  * CVE-2023-37208 (bmo#1837675)

    Lack of warning when opening Diagcab files

  * CVE-2023-37209 (bmo#1837993)

    Use-after-free in `NotifyOnHistoryReload`

  * CVE-2023-37210 (bmo#1821886)

    Full-screen mode exit prevention

  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,

    bmo#1836550, bmo#1837450)

    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,

    and Thunderbird 102.13

  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206, bmo#1827076,

    bmo#1828690, bmo#1833503, bmo#1835710, bmo#1838587)

    Memory safety bugs fixed in Firefox 115

- Requires NSS 3.90

- Add patches:

  mozilla-rust-disable-future-incompat.patch

  mozilla-bmo1775202.patch

  mozilla-partial-revert-1768632.patch

- removed obsolete mozilla-buildfixes.patch

-------------------------------------------------------------------

Tue Jun 20 19:49:51 UTC 2023 - Andreas Stieger <Andreas.Stieger@gmx.de>

- Mozilla Firefox 114.0.2:

  * Several crash fixes

  * Web Extensions: Fixes for 114 regressions in Native Messaging

    support

-------------------------------------------------------------------

Tue Jun 20 06:30:02 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- do not enable LTO as it caused crashes now (boo#1212101)

-------------------------------------------------------------------

Sat Jun 10 14:48:07 UTC 2023 - Andreas Stieger <Andreas.Stieger@gmx.de>

- Mozilla Firefox 114.0.1

  * Fix a startup crash (bmo#1837201, boo#1212101)

-------------------------------------------------------------------

Fri Jun  9 11:05:47 UTC 2023 - Martin Sirringhaus <martin.sirringhaus@suse.com>

- Only install vaapitest for wayland-enabled builds, where it gets built

- Rebase mozilla-silence-no-return-type.patch

- Rebase s390x-patches, and remove obsolete patches:

  mozilla-bmo1005535.patch mozilla-s390x-skia-gradient.patch

-------------------------------------------------------------------

Mon Jun  5 21:22:19 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 114.0

  MFSA 2023-20 (bsc#1211922)

  * CVE-2023-34414 (bmo#1695986)

    Click-jacking certificate exceptions through rendering lag

  * CVE-2023-34415 (bmo#1811999)

    Site-isolation bypass on sites that allow open redirects to

    data: urls

  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,

    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,

    bmo#1830206, bmo#1830795, bmo#1833339)

    Memory safety bugs fixed in Firefox 114 and Firefox ESR

    102.12

  * CVE-2023-34417 (bmo#1746447, bmo#1820903, bmo#1832832)

    Memory safety bugs fixed in Firefox 114

  * New: Added UI to manage the DNS over HTTPS exception list.

    (bmo#1596847)

  * New: Bookmarks can now be searched from the Bookmarks menu.

    The Bookmarks menu is accessible by adding the *Bookmarks

    menu* button to the toolbar. (bmo#1736937)

  * New: Restrict searches to your local browsing history by

    selecting *Search history* from the History, Library or

    Application menu buttons. (bmo#1736939)

  * New: Mac users can now capture video from their cameras in

    all supported native resolutions. This enables resolutions

    higher than 1280x720. (bmo#1806604)

  * New: It is now possible to reorder the extensions listed in

    the extensions panel. (bmo#1805924)

  * New: Users on macOS, Linux, and Windows 7 can now use FIDO2 /

    WebAuthn authenticators over USB. Some advanced features,

    such as fully passwordless logins, require a PIN to be set on

    the authenticator. (bmo#1814487)

  * New: Pocket Recommended content can now be seen in France,

    Italy, and Spain. (bmo#None)

  * Changed: DNS over HTTPS settings are now part of  the

    *Privacy & Security* section of the *Settings* page and allow

    the user to choose from all the supported modes.

    (bmo#1610741)

  * HTML5: DOM: Added support for ES Modules on DedicatedWorker

    and SharedWorker

  * HTML5: WebTransport is now enabled by default and will be

    going to release with 114. As the original Explainer  notes,

    it enables multiple use-cases that are hard or impossible to

    handle without it, especially for Gaming and live streaming.

    It covers cases that are problematic for alternative

    mechanisms, such as WebSockets.

    Built on top of HTTP3 (HTTP2 support will be coming later).

    The current implementation in Firefox is passing 505 out of

    565 Web-Platform Tests.

  * HTML5: CSS: The `infinity` and `NaN` constants are now

    supported inside the `calc()` function. (bmo#1830759)

  * Developer: The *Copy as cURL* feature, available in the

    Network panel, has been enhanced. It now supports the

    -`-compressed` argument. (bmo#1776120)

  * Developer: The Accessibility Inspector has been improved to

    accurately recognize all the ARIA roles like `banner`,

    `main`, `navigation`, and `contentinfo`, etc. This

    enhancement is particularly beneficial for web developers

    working with ARIA roles to improve web accessibility.

    (bmo#1572512)

  * Developer: Firefox now provides support for the CSS Cascading

    Level 4 `supports()` syntax for `@import` rules. This allows

    for the importation of other stylesheets based on support-

    dependency. In addition, the Inspector panel now accurately

    displays the conditions at the top of the imported rule.

- requires NSS 3.89.1

-------------------------------------------------------------------

Wed May 24 19:26:35 UTC 2023 - Andreas Stieger <Andreas.Stieger@gmx.de>

- Mozilla Firefox 113.0.2 (boo#1211696)

  * Fixed: Fixed a bug which could cause Firefox to freeze on

    some pages when loading them with the Developer Tools Web

    Console open (bmo#1828026)

  * Fixed: Fixed a bug which would cause the bookmarks and

    history sidebars to not properly react to the browser window

    being vertically resized (bmo#1831535)

-------------------------------------------------------------------

Sat May 13 20:56:05 UTC 2023 - Andreas Stieger <Andreas.Stieger@gmx.de>

- Mozilla Firefox 113.0.1

  * UI fixes for other platforms

- upstream signing key updated

-------------------------------------------------------------------

Tue May  9 21:12:38 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 113.0

  * https://www.mozilla.org/en-US/firefox/113.0/releasenotes

  MFSA 2023-16 (bsc#1211175)

  * CVE-2023-32205 (bmo#1753339, bmo#1753341)

    Browser prompts could have been obscured by popups

  * CVE-2023-32206 (bmo#1824892)

    Crash in RLBox Expat driver

  * CVE-2023-32207 (bmo#1826116)

    Potential permissions request bypass via clickjacking

  * CVE-2023-32208 (bmo#1646034)

    Leak of script base URL in service workers via import()

  * CVE-2023-32209 (bmo#1767194)

    Persistent DoS via favicon image

  * CVE-2023-32210 (bmo#1776755)

    Incorrect principal object ordering

  * CVE-2023-32211 (bmo#1823379)

    Content process crash due to invalid wasm code

  * CVE-2023-32212 (bmo#1826622)

    Potential spoof due to obscured address bar

  * CVE-2023-32213 (bmo#1826666)

    Potential memory corruption in FileReader::DoReadData()

  * MFSA-TMP-2023-0002 (bmo#1814560, bmo#1814790, bmo#1819796)

    Race condition in dav1d decoding

  * CVE-2023-32214 (bmo#1828716)

    Potential DoS via exposed protocol handlers

  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856, bmo#1820210,

    bmo#1821480, bmo#1827019, bmo#1827024, bmo#1827144, bmo#1827359,

    bmo#1830186)

    Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11

  * CVE-2023-32216 (bmo#1746479, bmo#1806852, bmo#1815987,

    bmo#1820359, bmo#1823568, bmo#1824803, bmo#1824834, bmo#1825170,