-------------------------------------------------------------------

Thu Jan  4 12:23:41 UTC 2018 - wr@rosenauer.org

- update to Firefox 57.0.4

  MFSA 2018-1: Speculative execution side-channel attack ("Spectre")

  (boo#1074723)

-------------------------------------------------------------------

Wed Jan  3 08:29:38 UTC 2018 - wr@rosenauer.org

- fixed regression introduced Oct 10th which made Firefox crash

  when cancelling the KDE file dialog (boo#1069962)

-------------------------------------------------------------------

Fri Dec 29 19:52:34 UTC 2017 - astieger@suse.com

- Mozilla Firefox 57.0.3:

  * Fix a crash reporting issue that inadvertently sends background

    tab crash reports to Mozilla without user opt-in (bmo#1427111,

    bsc#1074235)

- Includes changes from 57.0.2:

  * fixes for platforms other than GNU/Linux

-------------------------------------------------------------------

Fri Dec  8 15:52:17 UTC 2017 - dimstar@opensuse.org

- Explicitly buildrequires python2-xml: The build system relies on

  it. We wrongly relied on other packages pulling it in for us.

-------------------------------------------------------------------

Thu Dec  7 11:12:31 UTC 2017 - dimstar@opensuse.org

- Escape the usage of %{VERSION} when calling out to rpm.

  RPM 4.14 has %{VERSION} defined as 'the main packages version'.

-------------------------------------------------------------------

Wed Nov 29 23:45:03 UTC 2017 - wr@rosenauer.org

- update to Firefox 57.0.1

  * CVE-2017-7843: Web worker in Private Browsing mode can write

    IndexedDB data (bsc#1072034, bmo#1410106)

  * CVE-2017-7844: Visited history information leak through SVG

    image (bsc#1072036, bmo#1420001)

  * Fix a video color distortion issue on YouTube and other video

    sites with some AMD devices (bmo#1417442)

  * Fix an issue with prefs.js when the profile path has non-ascii

    characters (bmo#1420427)

-------------------------------------------------------------------

Tue Nov 21 09:00:48 UTC 2017 - christophe@krop.fr

- Add mozilla-bmo1360278.patch

  Starting with Firefox 57, the context menu appears on key press.

  This patch creates a config entry to restore the

  old behaviour. Without the patch, the mouse gesture extensions

  require 2 clicks to work (bmo#1360278).

  The new config entry is named ui.context_menus.after_mouseup

  (default : false).

-------------------------------------------------------------------

Sat Nov 18 08:35:21 UTC 2017 - wr@rosenauer.org

- Allow experimental CSD for Gtk3 (bmo#1399611) if available and enabled

  widget.allow-client-side-decoration=true

  (mozilla-bmo1399611-csd.patch)

-------------------------------------------------------------------

Wed Nov 15 06:46:06 UTC 2017 - wr@rosenauer.org

- update to Firefox 57.0 (boo#1068101)

  * Firefox Quantum

  * Photon UI

  * Unified address and search bar

  * AMD VP9 hardware video decoder support

  * Added support for Date/Time input

  * stricter security sandbox blocking filesystem reading and

    writing on Linux systems

  * middle mouse paste in the content area no longer navigates to

    URLs by default on Unix systems

  MFSA 2017-24

  * CVE-2017-7828 (bmo#1406750. bmo#1412252)

    Use-after-free of PressShell while restyling layout

  * CVE-2017-7830 (bmo#1408990)

    Cross-origin URL information leak through Resource Timing API

  * CVE-2017-7831 (bmo#1392026)

    Information disclosure of exposed properties on JavaScript proxy

    objects

  * CVE-2017-7832 (bmo#1408782)

    Domain spoofing through use of dotless 'i' character followed

    by accent markers

  * CVE-2017-7833 (bmo#1370497)

    Domain spoofing with Arabic and Indic vowel marker characters

  * CVE-2017-7834 (bmo#1358009)

    data: URLs opened in new tabs bypass CSP protections

  * CVE-2017-7835 (bmo#1402363)

    Mixed content blocking incorrectly applies with redirects

  * CVE-2017-7836 (bmo#1401339)

    Pingsender dynamically loads libcurl on Linux and OS X

  * CVE-2017-7837 (bmo#1325923)

    SVG loaded as <img> can use meta tags to set cookies

  * CVE-2017-7838 (bmo#1399540)

    Failure of individual decoding of labels in international domain

    names triggers punycode display of entire IDN

  * CVE-2017-7839 (bmo#1402896)

    Control characters before javascript: URLs defeats self-XSS

    prevention mechanism

  * CVE-2017-7840 (bmo#1366420)

    Exported bookmarks do not strip script elements from user-supplied

    tags

  * CVE-2017-7842 (bmo#1397064)

    Referrer Policy is not always respected for <link> elements

  * CVE-2017-7827

    Memory safety bugs fixed in Firefox 57

  * CVE-2017-7826

    Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5

- requires NSPR 4.17, NSS 3.33 and rustc 1.19

- rebased patches

- added mozilla-bindgen-systemlibs.patch to allow stylo build

  with system libs (bmo#1341234)

- removed mozilla-language.patch since the whole locale code

  changed in Firefox and is relying on ICU now

- removed obsolete mozilla-ucontext.patch

-------------------------------------------------------------------

Sat Oct 28 06:30:37 UTC 2017 - wr@rosenauer.org

- update to Firefox 56.0.2

  * Disable Form Autofill completely on user request (bmo#1404531)

  * Fix for video-related crashes on Windows 7 (bmo#1409141)

  * Correct detection for 64-bit GSSAPI authentication (bmo#1409275)

  * Fix for shutdown crash (bmo#1404105)

-------------------------------------------------------------------

Tue Oct 10 11:47:49 UTC 2017 - wr@rosenauer.org

- update to Firefox 56.0.1

  * Block D3D11 when using Intel drivers on Windows 7 systems with

    partial AVX support (bmo#1403353)

  -> just to sync the version number

- enable stylo for TW (requires LLVM >= 3.9)

- queue KDE filepicker requests to avoid non-opening file dialogs

  happening in certain situations (contributed by Ignaz Forster)

- the placeholder dot in KDE file dialog in case of empty filenames

  was removed, apparently not required (anymore)

  (contributed by Ignaz Forster)

-------------------------------------------------------------------

Sun Oct  1 18:25:16 UTC 2017 - stefan.bruens@rwth-aachen.de

- Correct plugin directory for aarch64 (boo#1061207). The wrapper

  script was not detecting aarch64 as a 64 bit architecture, thus

  used /usr/lib/browser-plugins/.

-------------------------------------------------------------------

Sat Sep 30 20:10:50 UTC 2017 - zaitor@opensuse.org

- Drop libgnomeui-devel, and replace it with pkgconfig(gconf-2.0),

  pkgconfig(gtk+-2.0), pkgconfig(gtk+-unix-print-2.0),

  pkgconfig(glib-2.0), pkgconfig(gobject-2.0) and

  pkgconfig(gdk-x11-2.0) BuildRequires, align with what configure

  looks for.

-------------------------------------------------------------------

Thu Sep 28 08:28:29 UTC 2017 - wr@rosenauer.org

- update to Firefox 56.0 (boo#1060445)

  * Firefox Screenshots

  * Find Options/Preferences more quickly with new search function

  * Media is no longer auto-played when opened in a background tab

  * Enable CSS Grid Layout View

  MFSA 2017-21

  * CVE-2017-7793 (bmo#1371889)

    Use-after-free with Fetch API

  * CVE-2017-7817 (bmo#1356596) (Android-only)

    Firefox for Android address bar spoofing through fullscreen mode

  * CVE-2017-7818 (bmo#1363723)

    Use-after-free during ARIA array manipulation

  * CVE-2017-7819 (bmo#1380292)

    Use-after-free while resizing images in design mode

  * CVE-2017-7824 (bmo#1398381)

    Buffer overflow when drawing and validating elements with ANGLE

  * CVE-2017-7805 (bmo#1377618) (fixed via NSS requirement)

    Use-after-free in TLS 1.2 generating handshake hashes

  * CVE-2017-7812 (bmo#1379842)

    Drag and drop of malicious page content to the tab bar can open locally stored files

  * CVE-2017-7814 (bmo#1376036)

    Blob and data URLs bypass phishing and malware protection warnings

  * CVE-2017-7813 (bmo#1383951)

    Integer truncation in the JavaScript parser

  * CVE-2017-7825 (bmo#1393624, bmo#1390980) (OSX-only)

    OS X fonts render some Tibetan and Arabic unicode characters as spaces

  * CVE-2017-7815 (bmo#1368981)

    Spoofing attack with modal dialogs on non-e10s installations

  * CVE-2017-7816 (bmo#1380597)

    WebExtensions can load about: URLs in extension UI

  * CVE-2017-7821 (bmo#1346515)

    WebExtensions can download and open non-executable files without user interaction

  * CVE-2017-7823 (bmo#1396320)

    CSP sandbox directive did not create a unique origin

  * CVE-2017-7822 (bmo#1368859)

    WebCrypto allows AES-GCM with 0-length IV

  * CVE-2017-7820 (bmo#1378207)

    Xray wrapper bypass with new tab and web console

  * CVE-2017-7811

    Memory safety bugs fixed in Firefox 56

  * CVE-2017-7810

    Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4

- requires NSPR 4.16 and NSS 3.32.1

- rebased patches

-------------------------------------------------------------------

Thu Sep 28 07:53:13 UTC 2017 - dimstar@opensuse.org

- Add alsa-devel BuildRequires: we care for ALSA support to be

  built and thus need to ensure we get the dependencies in place.

  In the past, alsa-devel was pulled in by accident: we

  buildrequire libgnome-devel. This required esound-devel and that

  in turn pulled in alsa-devel for us. libgnome is being fixed to

  no longer require esound-devel.

-------------------------------------------------------------------

Mon Sep  4 18:27:44 UTC 2017 - wr@rosenauer.org

- update to Firefox 55.0.3

  * Fix an issue with addons when using a path containing non-ascii

    characters (bmo#1389160)

  * Fix file uploads to some websites, including YouTube (bmo#1383518)

- fix Google API key build integration

- add mozilla-ucontext.patch to fix Tumbleweed build

- do not enable XINPUT2 for now (boo#1053959)

-------------------------------------------------------------------

Fri Aug 11 08:32:30 UTC 2017 - wr@rosenauer.org

- update to Firefox 55.0.1

  * Fix a regression the tab restoration process (bmo#1388160)

  * Fix a problem causing What's new pages not to be displayed (bmo#1386224)

  * Fix a rendering issue with some PKCS#11 libraries (bmo#1388370)

  * Disable the predictor prefetch (bmo#1388160)

-------------------------------------------------------------------

Sat Aug  5 13:22:16 UTC 2017 - wr@rosenauer.org

- update to Firefox 55.0 (boo#1052829)

  * Browsing sessions with a high number of tabs are now restored

    in an instant

  * Sidebar (bookmarks, history, synced tabs) can now be moved to

    the right edge of the window

  * Fine-tune your browser performance from the Preferences/Options page.

  * Make screenshots of webpages, and save them locally or upload

    them to the cloud. This feature will undergo A/B testing and

    will not be visible for some users.

  * Added Belarusian (be) locale

  * Simplify print jobs from within print preview

  * Use virtual reality devices with the web with the introduction

    of WebVR

  * Search suggestions are now enabled by default for users who

    haven't explicitly opted-out

  * Search with any installed search engine directly from the

    location bar

  * IMPORTANT: Breaking profile changes - do not downgrade Firefox

    and use a profile that has been opened with Firefox 55+.

  * The Adobe Flash plugin is now click-to-activate by default and

    only allowed on http:// and https:// URL schemes. This change

    will be rolled out progressively and so will not be visible to

    all users immediately. For more information see the Firefox

    plugin roadmap

  * Modernized application update UI to be less intrusive and more

    aligned with the rest of the browser. Only users who have not

    restarted their browser 8 days after downloading an update or

    users who opted out of automatic updates will see this change.

  * Insecure sites can no longer access the Geolocation APIs to get

    access to your physical location

  * requires NSPR 4.15 and NSS 3.31

  MFSA 2017-18

  * CVE-2017-7798 (bmo#1371586, bmo#1372112)

    XUL injection in the style editor in devtools

  * CVE-2017-7800 (bmo#1374047)

    Use-after-free in WebSockets during disconnection

  * CVE-2017-7801 (bmo#1371259)

    Use-after-free with marquee during window resizing

  * CVE-2017-7809 (bmo#1380284)

    Use-after-free while deleting attached editor DOM node

  * CVE-2017-7784 (bmo#1376087)

    Use-after-free with image observers

  * CVE-2017-7802 (bmo#1378147)

    Use-after-free resizing image elements

  * CVE-2017-7785 (bmo#1356985)

    Buffer overflow manipulating ARIA attributes in DOM

  * CVE-2017-7786 (bmo#1365189)

    Buffer overflow while painting non-displayable SVG

  * CVE-2017-7806 (bmo#1378113)

    Use-after-free in layer manager with SVG

  * CVE-2017-7753 (bmo#1353312)

    Out-of-bounds read with cached style data and pseudo-elements#

  * CVE-2017-7787 (bmo#1322896)

    Same-origin policy bypass with iframes through page reloads

  * CVE-2017-7807 (bmo#1376459)

    Domain hijacking through AppCache fallback

  * CVE-2017-7792 (bmo#1368652)

    Buffer overflow viewing certificates with an extremely long OID

  * CVE-2017-7804 (bmo#1372849)

    Memory protection bypass through WindowsDllDetourPatcher

  * CVE-2017-7791 (bmo#1365875)

    Spoofing following page navigation with data: protocol and modal alerts

  * CVE-2017-7808 (bmo#1367531)

    CSP information leak with frame-ancestors containing paths

  * CVE-2017-7782 (bmo#1344034)

    WindowsDllDetourPatcher allocates memory without DEP protections

  * CVE-2017-7781 (bmo#1352039)

    Elliptic curve point addition error when using mixed Jacobian-affine coordinates

  * CVE-2017-7794 (bmo#1374281)

    Linux file truncation via sandbox broker

  * CVE-2017-7803 (bmo#1377426)

    CSP containing 'sandbox' improperly applied

  * CVE-2017-7799 (bmo#1372509)

    Self-XSS XUL injection in about:webrtc

  * CVE-2017-7783 (bmo#1360842)

    DOS attack through long username in URL

  * CVE-2017-7788 (bmo#1073952)

    Sandboxed about:srcdoc iframes do not inherit CSP directives

  * CVE-2017-7789 (bmo#1074642)

    Failure to enable HSTS when two STS headers are sent for a connection

  * CVE-2017-7790 (bmo#1350460) (Windows-only)

    Windows crash reporter reads extra memory for some non-null-terminated registry values

  * CVE-2017-7796 (bmo#1234401) (Windows-only)

    Windows updater can delete any file named update.log

  * CVE-2017-7797 (bmo#1334776)

    Response header name interning leaks across origins

  * CVE-2017-7780

    Memory safety bugs fixed in Firefox 55

  * CVE-2017-7779

    Memory safety bugs fixed in Firefox 55 and Firefox ESR 52.3

- updated mozilla-kde.patch:

  * removed "downloadfinished" alert as Firefox reimplemented the

    whole thing (TODO: check if there is another function we should

    hook in)

-------------------------------------------------------------------

Tue Jul  4 20:08:47 UTC 2017 - wr@rosenauer.org

- update to Firefox 54.0.1

  * Fix a display issue of tab title (bmo#1357656)

  * Fix a display issue of opening new tab (bmo#1371995)

  * Fix a display issue when opening multiple tabs (bmo#1371962)

  * Fix a tab display issue when downloading files (bmo#1373109)

  * Fix a PDF printing issue (bmo#1366744)

  * Fix a Netflix issue on Linux (bmo#1375708)

-------------------------------------------------------------------

Thu Jun 15 13:56:05 UTC 2017 - wr@rosenauer.org

- update to Firefox 54.0

  * Clearer and more detailed information for download items in the

    download panel

  * Added Burmese (my) locale

  * Bookmarks created on mobile devices are now shown in

    "Mobile Bookmarks” folder in the drop down list from the toolbar

    and Bookmarks option in the menu bar in Desktop Firefox

  * added support for multiple content processes (e10s-multi)

- requires NSPR 4.14 and NSS 3.30.2

- requires rust 1.15.1

- removed mozilla-shared-nss-db.patch as it seems to be a rather

  unused feature

-------------------------------------------------------------------

Thu Jun  1 04:25:05 UTC 2017 - kah0922@gmail.com

- remove -fno-inline-small-functions and explicitely optimize with

  -O2 for openSUSE > 13.2/Leap 42 to work with gcc7 (boo#1040105)

-------------------------------------------------------------------

Wed Apr 26 12:37:38 UTC 2017 - wr@rosenauer.org

- switch to Mozilla's geolocation service (boo#1026989)

- removed mozilla-preferences.patch obsoleted by overriding via

  firefox.js

- fixed KDE integration to avoid crash caused by filepicker

  (boo#1015998)

-------------------------------------------------------------------

Mon Apr 17 12:52:10 UTC 2017 - wr@rosenauer.org

- update to Firefox 53.0

  * requires NSS 3.29.5

  * Lightweight themes are now applied in private browsing windows

  * Reader Mode now displays estimated reading time for the page

  * Two new 'compact' themes available in Firefox, dark and light,

    based on the Firefox Developer Edition theme

  * Ended Firefox Linux support for processors older than Pentium 4

    and AMD Opteron

  * Refresh of the media controls user interface

  * Shortened titles on tabs are faded out instead of using ellipsis

    for improved readability

  * Media playback on new tabs is blocked until the tab is visible

  * Permission notifications have a cleaner design and cannot be

    easily missed

  MFSA 2017-10

  * CVE-2017-5456 (bmo#1344415)

    Sandbox escape allowing local file system access

  * CVE-2017-5442 (bmo#1347979)

    Use-after-free during style changes

  * CVE-2017-5443 (bmo#1342661)

    Out-of-bounds write during BinHex decoding

  * CVE-2017-5429 (bmo#1341096, bmo#1342823, bmo#1343261, bmo#1348894,

     bmo#1348941, bmo#1349340, bmo#1350844, bmo#1352926, bmo#1353088)

    Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and

    Firefox ESR 52.1

  * CVE-2017-5464 (bmo#1347075)

    Memory corruption with accessibility and DOM manipulation

  * CVE-2017-5465 (bmo#1347617)

    Out-of-bounds read in ConvolvePixel

  * CVE-2017-5466 (bmo#1353975)

    Origin confusion when reloading isolated data:text/html URL

  * CVE-2017-5467 (bmo#1347262)

    Memory corruption when drawing Skia content

  * CVE-2017-5460 (bmo#1343642)

    Use-after-free in frame selection

  * CVE-2017-5461 (bmo#1344380)

    Out-of-bounds write in Base64 encoding in NSS

  * CVE-2017-5448 (bmo#1346648)

    Out-of-bounds write in ClearKeyDecryptor

  * CVE-2017-5449 (bmo#1340127)

    Crash during bidirectional unicode manipulation with animation

  * CVE-2017-5446 (bmo#1343505)

    Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data

  * CVE-2017-5447 (bmo#1343552)

    Out-of-bounds read during glyph processing

  * CVE-2017-5444 (bmo#1344461)

    Buffer overflow while parsing application/http-index-format content

  * CVE-2017-5445 (bmo#1344467)

    Uninitialized values used while parsing application/http-index-format

    content

  * CVE-2017-5468 (bmo#1329521)

    Incorrect ownership model for Private Browsing information

  * CVE-2017-5469 (bmo#1292534)

    Potential Buffer overflow in flex-generated code

  * CVE-2017-5440 (bmo#1336832)

    Use-after-free in txExecutionState destructor during XSLT processing

  * CVE-2017-5441 (bmo#1343795)

    Use-after-free with selection during scroll events

  * CVE-2017-5439 (bmo#1336830)

    Use-after-free in nsTArray Length() during XSLT processing

  * CVE-2017-5438 (bmo#1336828)

    Use-after-free in nsAutoPtr during XSLT processing

  * CVE-2017-5437 (bmo#1343453)

    Vulnerabilities in Libevent library

  * CVE-2017-5436 (bmo#1345461)

    Out-of-bounds write with malicious font in Graphite 2

  * CVE-2017-5435 (bmo#1350683)

    Use-after-free during transaction processing in the editor

  * CVE-2017-5434 (bmo#1349946)

    Use-after-free during focus handling

  * CVE-2017-5433 (bmo#1347168)

    Use-after-free in SMIL animation functions

  * CVE-2017-5432 (bmo#1346654)

    Use-after-free in text input selection

  * CVE-2017-5430 (bmo#1329796, bmo#1337418, bmo#1339722, bmo#1340482,

     bmo#1342101, bmo#1344081, bmo#1344305, bmo#1344686,

     bmo#1346140, bmo#1346419, bmo#1348143, bmo#1349621,

     bmo#1349719, bmo#1353476)

    Memory safety bugs fixed in Firefox 53 and Firefox ESR 52.1

  * CVE-2017-5459 (bmo#1333858)

    Buffer overflow in WebGL

  * CVE-2017-5458 (bmo#1229426)

    Drag and drop of javascript: URLs can allow for self-XSS

  * CVE-2017-5455 (bmo#1341191)

    Sandbox escape through internal feed reader APIs

  * CVE-2017-5454 (bmo#1349276)

    Sandbox escape allowing file system read access through file picker

  * CVE-2017-5451 (bmo#1273537)

    Addressbar spoofing with onblur event

  * CVE-2017-5453 (bmo#1321247)

    HTML injection into RSS Reader feed preview page through

    TITLE element

  * CVE-2017-5462 (bmo#1345089)

    DRBG flaw in NSS

- removed browser(npapi) provides as these plugins are deprecated

- switch used compiler to gcc5 (FF requires gcc >= 4.9 now) for

  Leap 42

- Gtk2 is not longer an option; switched to Gtk3

- apply MOZ_USE_XINPUT2=1 for better touchpad and touchscreen support

  (boo#1032003)

-------------------------------------------------------------------

Mon Apr  3 06:16:26 UTC 2017 - wr@rosenauer.org