-------------------------------------------------------------------

Sun Jan 24 09:33:15 UTC 2016 - wr@rosenauer.org

- update to Firefox 44.0

  * MFSA 2016-01/CVE-2016-1930/CVE-2016-1931 boo#963633

    Miscellaneous memory safety hazards

  * MFSA 2016-02/CVE-2016-1933 (bmo#1231761) boo#963634

    Out of Memory crash when parsing GIF format images

  * MFSA 2016-03/CVE-2016-1935 (bmo#1220450) boo#963635

    Buffer overflow in WebGL after out of memory allocation

  * MFSA 2016-04/CVE-2015-7208/CVE-2016-1939 (bmo#1191423, bmo#1233784) boo#963637

    Firefox allows for control characters to be set in cookie names

  * MFSA 2016-06/CVE-2016-1937 (bmo#724353) boo#963641

    Missing delay following user click events in protocol handler dialog

  * MFSA 2016-07/CVE-2016-1938 (bmo#1190248) boo#963731

    Errors in mp_div and mp_exptmod cryptographic functions in NSS

    (fixed by requiring NSS 3.21)

  * MFSA 2016-09/CVE-2016-1942/CVE-2016-1943 (bmo#1189082, bmo#1228590)

    Addressbar spoofing attacks boo#963643

  * MFSA 2016-10/CVE-2016-1944/CVE-2016-1945/CVE-2016-1946

    (bmo#1186621, bmo#1214782, bmo#1232096) boo#963644

    Unsafe memory manipulation found through code inspection

  * MFSA 2016-11/CVE-2016-1947 (bmo#1237103) boo#963645

    Application Reputation service disabled in Firefox 43

  * requires NSPR 4.11

  * requires NSS 3.21

- prepare mozilla-kde.patch for Gtk3 builds

- rebased patches

-------------------------------------------------------------------

Mon Jan 11 08:04:24 UTC 2016 - astieger@suse.com

- Mozilla Firefox 43.0.4:

  * Re-enable SHA-1 certificates to prevent outdated

    man-in-the-middle security devices from interfering with

    properly secured SSL/TLS connections (bmo#1236975)

  * Fix for startup crash for users of a third party antivirus tool

    (bmo#1235537)

- The following change was previously in the package as a patch:

  * Multi-user GNU/Linux download folders can be created

   (bmo#1233434), removed mozilla-bmo1233434.patch

-------------------------------------------------------------------

Tue Dec 29 20:29:35 UTC 2015 - wr@rosenauer.org

- update to Firefox 43.0.3

  * requires NSS 3.20.2 to fix

    MFSA 2015-150/CVE-2015-7575 (bmo#1158489)

    MD5 signatures accepted within TLS 1.2 ServerKeyExchange in

    server signature

  * various changes to support Windows update (SHA-1 vs. SHA-2)

  * workaround Youtube user agent detection issue (bmo#1233970)

- fix file download regression for multi user systems

  (bmo#1233434) (mozilla-bmo1233434.patch)

- explicitely requires libXcomposite-devel

-------------------------------------------------------------------

Sun Dec 13 23:07:56 UTC 2015 - wr@rosenauer.org

- update to Firefox 43.0 (bnc#959277)

  * Improved API support for m4v video playback

  * Users can opt-in to receive search suggestions from the Awesome Bar

  * WebRTC streaming on multiple monitors

  * User selectable second block list for Private Browsing's Tracking

    Protection

  security fixes:

  * MFSA 2015-134/CVE-2015-7201/CVE-2015-7202

    Miscellaneous memory safety hazards

  * MFSA 2015-135/CVE-2015-7204 (bmo#1216130)

    Crash with JavaScript variable assignment with unboxed objects

  * MFSA 2015-136/CVE-2015-7207 (bmo#1185256)

    Same-origin policy violation using perfomance.getEntries and

    history navigation

  * MFSA 2015-137/CVE-2015-7208 (bmo#1191423)

    Firefox allows for control characters to be set in cookies

  * MFSA 2015-138/CVE-2015-7210 (bmo#1218326)

    Use-after-free in WebRTC when datachannel is used after being

    destroyed

  * MFSA 2015-139/CVE-2015-7212 (bmo#1222809)

    Integer overflow allocating extremely large textures

  * MFSA 2015-140/CVE-2015-7215 (bmo#1160890)

    Cross-origin information leak through web workers error events

  * MFSA 2015-141/CVE-2015-7211 (bmo#1221444)

    Hash in data URI is incorrectly parsed

  * MFSA 2015-142/CVE-2015-7218/CVE-2015-7219 (bmo#1194818, bmo#1194820)

    DOS due to malformed frames in HTTP/2

  * MFSA 2015-143/CVE-2015-7216/CVE-2015-7217 (bmo#1197059, bmo#1203078)

    Linux file chooser crashes on malformed images due to flaws in

    Jasper library

  * MFSA 2015-144/CVE-2015-7203/CVE-2015-7220/CVE-2015-7221

    (bmo#1201183, bmo#1178033, bmo#1199400)

    Buffer overflows found through code inspection

  * MFSA 2015-145/CVE-2015-7205 (bmo#1220493)

    Underflow through code inspection

  * MFSA 2015-146/CVE-2015-7213 (bmo#1206211)

    Integer overflow in MP4 playback in 64-bit versions

  * MFSA 2015-147/CVE-2015-7222 (bmo#1216748)

    Integer underflow and buffer overflow processing MP4 metadata in

    libstagefright

  * MFSA 2015-148/CVE-2015-7223 (bmo#1226423)

    Privilege escalation vulnerabilities in WebExtension APIs

  * MFSA 2015-149/CVE-2015-7214 (bmo#1228950)

    Cross-site reading attack through data and view-source URIs

- rebased patches

-------------------------------------------------------------------

Sun Nov 15 19:52:20 UTC 2015 - wr@rosenauer.org

- Add desktop menu action for private browsing window to desktop

  file (boo#954747)

- remove obsolete patch mozilla-bmo1005535.patch completely from

  source package to avoid automatic check failures

-------------------------------------------------------------------

Sat Oct 31 19:50:03 UTC 2015 - wr@rosenauer.org

- update to Firefox 42.0 (bnc#952810)

  * Private Browsing with Tracking Protection blocks certain Web

    elements that could be used to record your behavior across sites

  * Control Center that contains site security and privacy controls

  * Login Manager improvements

  * WebRTC improvements

  * Indicator added to tabs that play audio with one-click muting

  * Media Source Extension for HTML5 video available for all sites

  security fixes:

  * MFSA 2015-116/CVE-2015-4513/CVE-2015-4514

    Miscellaneous memory safety hazards

  * MFSA 2015-117/CVE-2015-4515 (bmo#1046421)

    Information disclosure through NTLM authentication

  * MFSA 2015-118/CVE-2015-4518 (bmo#1182778, bmo#1136692)

    CSP bypass due to permissive Reader mode whitelist

  * MFSA 2015-119/CVE-2015-7185 (bmo#1149000) (Android only)

    Firefox for Android addressbar can be removed after fullscreen mode

  * MFSA 2015-120/CVE-2015-7186 (bmo#1193027) (Android only)

    Reading sensitive profile files through local HTML file on Android

  * MFSA 2015-121/CVE-2015-7187 (bmo#1195735)

    disabling scripts in Add-on SDK panels has no effect

  * MFSA 2015-122/CVE-2015-7188 (bmo#1199430)

    Trailing whitespace in IP address hostnames can bypass same-origin policy

  * MFSA 2015-123/CVE-2015-7189 (bmo#1205900)

    Buffer overflow during image interactions in canvas

  * MFSA 2015-124/CVE-2015-7190 (bmo#1208520) (Android only)

    Android intents can be used on Firefox for Android to open privileged files

  * MFSA 2015-125/CVE-2015-7191 (bmo#1208956) (Android only)

    XSS attack through intents on Firefox for Android

  * MFSA 2015-126/CVE-2015-7192 (bmo#1210023) (OS X only)

    Crash when accessing HTML tables with accessibility tools on OS X

  * MFSA 2015-127/CVE-2015-7193 (bmo#1210302)

    CORS preflight is bypassed when non-standard Content-Type headers

    are received

  * MFSA 2015-128/CVE-2015-7194 (bmo#1211262)

    Memory corruption in libjar through zip files

  * MFSA 2015-129/CVE-2015-7195 (bmo#1211871)

    Certain escaped characters in host of Location-header are being

    treated as non-escaped

  * MFSA 2015-130/CVE-2015-7196 (bmo#1140616)

    JavaScript garbage collection crash with Java applet

  * MFSA 2015-131/CVE-2015-7198/CVE-2015-7199/CVE-2015-7200

    (bmo#1188010, bmo#1204061, bmo#1204155)

    Vulnerabilities found through code inspection

  * MFSA 2015-132/CVE-2015-7197 (bmo#1204269)

    Mixed content WebSocket policy bypass through workers

  * MFSA 2015-133/CVE-2015-7181/CVE-2015-7182/CVE-2015-7183

    (bmo#1202868, bmo#1205157)

    NSS and NSPR memory corruption issues

    (fixed in mozilla-nspr and mozilla-nss packages)

- requires NSPR >= 4.10.10 and NSS >= 3.19.4

- removed obsolete patches

  * mozilla-arm-disable-edsp.patch

  * mozilla-icu-strncat.patch

  * mozilla-skia-be-le.patch

  * toolkit-download-folder.patch

- fixed build with enable-libproxy (bmo#1220399)

  * mozilla-libproxy.patch

-------------------------------------------------------------------

Thu Oct 15 08:25:54 UTC 2015 - wr@rosenauer.org

- update to Firefox 41.0.2 (bnc#950686)

  * MFSA 2015-115/CVE-2015-7184 (bmo#1208339, bmo#1212669)

    Cross-origin restriction bypass using Fetch

- added explicit appdata provides (bnc#949983)

-------------------------------------------------------------------

Sun Oct  4 09:20:56 UTC 2015 - wr@rosenauer.org

- do not build with --enable-stdcxx-compat

  (this starts to fail build on various toolchain combinations

  and is not required for openSUSE builds in general

-------------------------------------------------------------------

Thu Oct  1 09:49:57 UTC 2015 - wr@rosenauer.org

- update to Firefox 41.0.1

  * Fix a startup crash related to Yandex toolbar and Adblock Plus

    (bmo#1209124)

  * Fix potential hangs with Flash plugins (bmo#1185639)

  * Fix a regression in the bookmark creation (bmo#1206376)

  * Fix a startup crash with some Intel Media Accelerator 3150

    graphic cards (bmo#1207665)

  * Fix a graphic crash, occurring occasionally on Facebook (bmo#1178601)

-------------------------------------------------------------------

Sat Sep 19 20:23:29 UTC 2015 - wr@rosenauer.org

- update to Firefox 41.0 (bnc#947003)

  * MFSA 2015-96/CVE-2015-4500/CVE-2015-4501

    Miscellaneous memory safety hazards

  * MFSA 2015-97/CVE-2015-4503 (bmo#994337)

    Memory leak in mozTCPSocket to servers

  * MFSA 2015-98/CVE-2015-4504 (bmo#1132467)

    Out of bounds read in QCMS library with ICC V4 profile attributes

  * MFSA 2015-99/CVE-2015-4476 (bmo#1162372) (Android only)

    Site attribute spoofing on Android by pasting URL with unknown scheme

  * MFSA 2015-100/CVE-2015-4505 (bmo#1177861) (Windows only)

    Arbitrary file manipulation by local user through Mozilla updater

  * MFSA 2015-101/CVE-2015-4506 (bmo#1192226)

    Buffer overflow in libvpx while parsing vp9 format video

  * MFSA 2015-102/CVE-2015-4507 (bmo#1192401)

    Crash when using debugger with SavedStacks in JavaScript

  * MFSA 2015-103/CVE-2015-4508 (bmo#1195976)

    URL spoofing in reader mode

  * MFSA 2015-104/CVE-2015-4510 (bmo#1200004)

    Use-after-free with shared workers and IndexedDB

  * MFSA 2015-105/CVE-2015-4511 (bmo#1200148)

    Buffer overflow while decoding WebM video

  * MFSA 2015-106/CVE-2015-4509 (bmo#1198435)

    Use-after-free while manipulating HTML media content

  * MFSA 2015-107/CVE-2015-4512 (bmo#1170390)

    Out-of-bounds read during 2D canvas display on Linux 16-bit

    color depth systems

  * MFSA 2015-108/CVE-2015-4502 (bmo#1105045)

    Scripted proxies can access inner window

  * MFSA 2015-109/CVE-2015-4516 (bmo#904886)

    JavaScript immutable property enforcement can be bypassed

  * MFSA 2015-110/CVE-2015-4519 (bmo#1189814)

    Dragging and dropping images exposes final URL after redirects

  * MFSA 2015-111/CVE-2015-4520 (bmo#1200856, bmo#1200869)

    Errors in the handling of CORS preflight request headers

  * MFSA 2015-112/CVE-2015-4517/CVE-2015-4521/CVE-2015-4522/

    CVE-2015-7174/CVE-2015-7175/CVE-2015-7176/CVE-2015-7177/

    CVE-2015-7180

    Vulnerabilities found through code inspection

  * MFSA 2015-113/CVE-2015-7178/CVE-2015-7179 (bmo#1189860,

    bmo#1190526) (Windows only)

    Memory safety errors in libGLES in the ANGLE graphics library

  * MFSA 2015-114 (bmo#1167498, bmo#1153672) (Windows only)

    Information disclosure via the High Resolution Time API

- rebased patches

- removed obsolete patches

  * mozilla-arm64-libjpeg-turbo.patch

------------------------------------------------------------------

Thu Aug 27 06:03:51 UTC 2015 - wr@rosenauer.org

- update to Firefox 40.0.3 (bnc#943550)

  * Disable the asynchronous plugin initialization (bmo#1198590)

  * Fix a segmentation fault in the GStreamer support (bmo#1145230)

  * Fix a regression with some Japanese fonts used in the <input>

    field (bmo#1194055)

  * On some sites, the selection in a select combox box using the

    mouse could be broken (bmo#1194733)

  security fixes

  * MFSA 2015-94/CVE-2015-4497 (bmo#1164766, bmo#1175278)

    Use-after-free when resizing canvas element during restyling

  * MFSA 2015-95/CVE-2015-4498 (bmo#1042699)

    Add-on notification bypass through data URLs

-------------------------------------------------------------------

Fri Aug  7 07:49:49 UTC 2015 - wr@rosenauer.org

- update to Firefox 40.0 (bnc#940806)

  * Added protection against unwanted software downloads

  * Suggested Tiles show sites of interest, based on categories

    from your recent browsing history

  * Hello allows adding a link to conversations to provide context

    on what the conversation will be about

  * New style for add-on manager based on the in-content

    preferences style

  * Improved scrolling, graphics, and video playback performance

    with off main thread compositing (GNU/Linux only)

  * Graphic blocklist mechanism improved: Firefox version ranges

    can be specified, limiting the number of devices blocked

  security fixes:

  * MFSA 2015-79/CVE-2015-4473/CVE-2015-4474

    Miscellaneous memory safety hazards

  * MFSA 2015-80/CVE-2015-4475 (bmo#1175396)

    Out-of-bounds read with malformed MP3 file

  * MFSA 2015-81/CVE-2015-4477 (bmo#1179484)

    Use-after-free in MediaStream playback

  * MFSA 2015-82/CVE-2015-4478 (bmo#1105914)

    Redefinition of non-configurable JavaScript object properties

  * MFSA 2015-83/CVE-2015-4479/CVE-2015-4480/CVE-2015-4493

    Overflow issues in libstagefright

  * MFSA 2015-84/CVE-2015-4481 (bmo1171518)

    Arbitrary file overwriting through Mozilla Maintenance Service

    with hard links (only affected Windows)

  * MFSA 2015-85/CVE-2015-4482 (bmo#1184500)

    Out-of-bounds write with Updater and malicious MAR file

    (does not affect openSUSE RPM packages which do not ship the

     updater)

  * MFSA 2015-86/CVE-2015-4483 (bmo#1148732)

    Feed protocol with POST bypasses mixed content protections

  * MFSA 2015-87/CVE-2015-4484 (bmo#1171540)

    Crash when using shared memory in JavaScript

  * MFSA 2015-88/CVE-2015-4491 (bmo#1184009)

    Heap overflow in gdk-pixbuf when scaling bitmap images

  * MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948, bmo#1178148)

    Buffer overflows on Libvpx when decoding WebM video

  * MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489

    Vulnerabilities found through code inspection

  * MFSA 2015-91/CVE-2015-4490 (bmo#1086999)

    Mozilla Content Security Policy allows for asterisk wildcards

    in violation of CSP specification

  * MFSA 2015-92/CVE-2015-4492 (bmo#1185820)

    Use-after-free in XMLHttpRequest with shared workers

- added mozilla-no-stdcxx-check.patch

- removed obsolete patches

  * mozilla-add-glibcxx_use_cxx11_abi.patch

  * firefox-multilocale-chrome.patch

- rebased patches

- requires version 40 of the branding package

- removed browser/searchplugins/ location as it's not valid anymore

-------------------------------------------------------------------

Fri Aug  7 07:09:39 UTC 2015 - wr@rosenauer.org

- security update to Firefox 39.0.3 (bnc#940918)

  * MFSA 2015-78/CVE-2015-4495 (bmo#1179262, bmo#1178058)

    Same origin violation and local file stealing via PDF reader

-------------------------------------------------------------------

Wed Jul  1 06:43:02 UTC 2015 - wr@rosenauer.org

- update to Firefox 39.0 (bnc#935979)

  * Share Hello URLs with social networks

  * Support for 'switch' role in ARIA 1.1 (web accessibility)

  * SafeBrowsing malware detection lookups enabled for downloads

    (Mac OS X and Linux)

  * Support for new Unicode 8.0 skin tone emoji

  * Removed support for insecure SSLv3 for network communications

  * Disable use of RC4 except for temporarily whitelisted hosts

  * NPAPI Plug-in performance improved via asynchronous initialization

  security fixes:

  * MFSA 2015-59/CVE-2015-2724/CVE-2015-2725/CVE-2015-2726

    Miscellaneous memory safety hazards

  * MFSA 2015-60/CVE-2015-2727 (bmo#1163422)

    Local files or privileged URLs in pages can be opened into new tabs

  * MFSA 2015-61/CVE-2015-2728 (bmo#1142210)

    Type confusion in Indexed Database Manager

  * MFSA 2015-62/CVE-2015-2729 (bmo#1122218)

    Out-of-bound read while computing an oscillator rendering range in Web Audio

  * MFSA 2015-63/CVE-2015-2731 (bmo#1149891)

    Use-after-free in Content Policy due to microtask execution error

  * MFSA 2015-64/CVE-2015-2730 (bmo#1125025)

    ECDSA signature validation fails to handle some signatures correctly

    (this fix is shipped by NSS 3.19.1 externally)

  * MFSA 2015-65/CVE-2015-2722/CVE-2015-2733 (bmo#1166924, bmo#1169867)

    Use-after-free in workers while using XMLHttpRequest

  * MFSA 2015-66/CVE-2015-2734/CVE-2015-2735/CVE-2015-2736/CVE-2015-2737

    CVE-2015-2738/CVE-2015-2739/CVE-2015-2740

    Vulnerabilities found through code inspection

  * MFSA 2015-67/CVE-2015-2741 (bmo#1147497)

    Key pinning is ignored when overridable errors are encountered

  * MFSA 2015-68/CVE-2015-2742 (bmo#1138669)

    OS X crash reports may contain entered key press information

    (not relevant under Linux)

  * MFSA 2015-69/CVE-2015-2743 (bmo#1163109)

    Privilege escalation in PDF.js

  * MFSA 2015-70/CVE-2015-4000 (bmo#1138554)

    NSS accepts export-length DHE keys with regular DHE cipher suites

    (this fix is shipped by NSS 3.19.1 externally)

  * MFSA 2015-71/CVE-2015-2721 (bmo#1086145)

    NSS incorrectly permits skipping of ServerKeyExchange

    (this fix is shipped by NSS 3.19.1 externally)

- dropped mozilla-prefer_plugin_pref.patch as this feature is

  likely not worth maintaining further

- rebased patches

- require NSS 3.19.2

-------------------------------------------------------------------

Thu Jun 18 10:30:18 UTC 2015 - schwab@suse.de

- mozilla-arm64-libjpeg-turbo.patch: fix libjpeg-turbo configuration

-------------------------------------------------------------------

Sun Jun  7 07:09:12 UTC 2015 - wr@rosenauer.org

- update to Firefox 38.0.6

  * fixes bmo#1171730 which is not really relevant to oS builds

- fix KDE regression from 38.0.5 builds (bsc#933439)

-------------------------------------------------------------------

Sat May 23 21:13:49 UTC 2015 - wr@rosenauer.org

- update to Firefox 38.0.5

  * Keep track of articles and videos with Pocket

  * Clean formatting for articles and blog posts with Reader View

  * Share the active tab or window in a Hello conversation

- add changes file as source for SRPM (bsc#932142)

-------------------------------------------------------------------

Fri May 15 10:40:19 UTC 2015 - normand@linux.vnet.ibm.com

- add mozilla-add-glibcxx_use_cxx11_abi.patch grabbed from

  https://bugzilla.mozilla.org/show_bug.cgi?id=1153109

-------------------------------------------------------------------

Fri May 15 07:37:46 UTC 2015 - wr@rosenauer.org

- update to Firefox 38.0.1

  stability and regression fixes

  * Systems with first generation NVidia Optimus graphics cards

    may crash on start-up

  * Users who import cookies from Google Chrome can end up with

    broken websites

  * Large animated images may fail to play and may stop other

    images from loading

-------------------------------------------------------------------

Sun May 10 07:07:49 UTC 2015 - wr@rosenauer.org

- update to Firefox 38.0 (bnc#930622)

  * New tab-based preferences

  * Ruby annotation support

  * more info: https://www.mozilla.org/en-US/firefox/38.0/releasenotes/

  security fixes:

  * MFSA 2015-46/CVE-2015-2708/CVE-2015-2709

    Miscellaneous memory safety hazards

  * MFSA 2015-47/VE-2015-0797 (bmo#1080995)

    Buffer overflow parsing H.264 video with Linux Gstreamer

  * MFSA 2015-48/CVE-2015-2710 (bmo#1149542)

    Buffer overflow with SVG content and CSS

  * MFSA 2015-49/CVE-2015-2711 (bmo#1113431)

    Referrer policy ignored when links opened by middle-click and

    context menu

  * MFSA 2015-50/CVE-2015-2712 (bmo#1152280)

    Out-of-bounds read and write in asm.js validation

  * MFSA 2015-51/CVE-2015-2713 (bmo#1153478)

    Use-after-free during text processing with vertical text enabled

  * MFSA 2015-53/CVE-2015-2715 (bmo#988698)

    Use-after-free due to Media Decoder Thread creation during shutdown

  * MFSA 2015-54/CVE-2015-2716 (bmo#1140537)

    Buffer overflow when parsing compressed XML

  * MFSA 2015-55/CVE-2015-2717 (bmo#1154683)

    Buffer overflow and out-of-bounds read while parsing MP4 video

    metadata

  * MFSA 2015-56/CVE-2015-2718 (bmo#1146724)

    Untrusted site hosting trusted page can intercept webchannel

    responses

  * MFSA 2015-57/CVE-2011-3079 (bmo#1087565)

    Privilege escalation through IPC channel messages

- requires NSS 3.18.1

- removed obsolete patches:

  * mozilla-skia-bmo1136958.patch

- remove gnomevfs build options as it is removed from sources

- rebased patches

-------------------------------------------------------------------

Fri Apr 17 16:39:20 UTC 2015 - wr@rosenauer.org

- update to Firefox 37.0.2 (bnc#928116)

  * MFSA 2015-45/CVE-2015-2706 (bmo#1141081)

    Memory corruption during failed plugin initialization

-------------------------------------------------------------------

Fri Apr  3 08:27:24 UTC 2015 - wr@rosenauer.org

- update to Firefox 37.0.1 (bnc#926166)

  * MFSA 2015-43/CVE-2015-0798 (bmo#1147597) (Android only)

    Loading privileged content through Reader mode

  * MFSA 2015-44/CVE-2015-0799 (bmo#1148328)