-------------------------------------------------------------------

Tue Apr 12 19:30:30 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 99.0.1

  * Fixed an issue with text rendering in Bengali (bmo#1763368)

  * Fixed a selection issue in the Download panel with drag and

    drop (bmo#1762723)

  * Fixed: Fixed an issue preventing Zoom gallery mode for users

    who go to zoom.us URLs instead of subdomain.zoom.us URLs

    (bmo#1763801)

-------------------------------------------------------------------

Mon Apr  4 07:34:36 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 99.0

  * You can now toggle Narrate in ReaderMode with the keyboard

    shortcut "n."

  * You can find added support for search—with or without

    diacritics—in the PDF viewer.

  * The Linux sandbox has been strengthened: processes exposed to web

    content no longer have access to the X Window system (X11).

  * Firefox now supports credit card autofill and capture in

    Germany and France.

  MFSA 2022-13 (bsc#1197903)

  * CVE-2022-1097 (bmo#1745667)

    Use-after-free in NSSToken objects

  * CVE-2022-28281 (bmo#1755621)

    Out of bounds write due to unexpected WebAuthN Extensions

  * CVE-2022-28282 (bmo#1751609)

    Use-after-free in DocumentL10n::TranslateDocument

  * CVE-2022-28283 (bmo#1754066)

    Missing security checks for fetching sourceMapURL

  * CVE-2022-28284 (bmo#1754522)

    Script could be executed via svg's use element

  * CVE-2022-28285 (bmo#1756957)

    Incorrect AliasSet used in JIT Codegen

  * CVE-2022-28286 (bmo#1735265)

    iframe contents could be rendered outside the border

  * CVE-2022-28287 (bmo#1741515)

    Text Selection could crash Firefox

  * CVE-2022-24713 (bmo#1758509)

    Denial of Service via complex regular expressions

  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,

    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)

    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8

  * CVE-2022-28288 (bmo#1746415, bmo#1746495, bmo#1746500,

    bmo#1747282, bmo#1748759, bmo#1749056, bmo#1749786,

    bmo#1751679, bmo#1752120, bmo#1756010, bmo#1756017,

    bmo#1757213, bmo#1757258, bmo#1757427)

    Memory safety bugs fixed in Firefox 99

- requires NSS >= 3.76.1

- remove obsolete patch

  * mozilla-bmo1756347.patch

  * mozilla-bmo1757571.patch

- update create-tar.sh

-------------------------------------------------------------------

Thu Mar 24 21:49:57 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- MozillaFirefox 98.0.2:

  * Fixed: Fixed an issue preventing users from typing in Address

    Bar after opening new tab and pressing cmd + enter

    (bmo#1757376)

  * Fixed: Fixed an issue causing some users to crash in out-of-

    memory conditions (bmo#1757618)

  * Fixed: Fixed an issue in session history which caused some

    sites to fail to load (bmo#1758664)

  * Fixed: Fixed an add-on specific compatibility issue

    (bmo#1759162)

-------------------------------------------------------------------

Wed Mar 23 15:14:22 UTC 2022 - Simon Vogl <simon.vogl@gmx.net>

- Change mozilla-kde.patch to follow the GNOME registry

  behavior for new MIME types to avoid opening downloaded files

  without any inquiries (bsc#1197319)

-------------------------------------------------------------------

Tue Mar 22 12:22:51 UTC 2022 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Add patch to fix start-up on aarch64:

  * mozilla-bmo1757571.patch

-------------------------------------------------------------------

Thu Mar 17 14:52:39 UTC 2022 - Dirk Müller <dmueller@suse.com>

- exclude slow cpus for building

-------------------------------------------------------------------

Thu Mar 17 09:18:01 UTC 2022 - Martin Sirringhaus <martin.sirringhaus@suse.com>

- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,

  faster buildhosts, as the others struggle to build FF.

-------------------------------------------------------------------

Mon Mar 14 22:48:42 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 98.0.1:

  * Yandex and Mail.ru have been removed as optional search

    providers in the drop-down search menu in Firefox

-------------------------------------------------------------------

Tue Mar  8 10:27:16 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 98.0

  * Firefox has a new optimized download flow

  * other changes as documented here

    https://www.mozilla.org/en-US/firefox/98.0/releasenotes

  MFSA 2022-10 (bsc#1196900)

  * CVE-2022-26383 (bmo#1742421)

    Browser window spoof using fullscreen mode

  * CVE-2022-26384 (bmo#1744352)

    iframe allow-scripts sandbox bypass

  * CVE-2022-26387 (bmo#1752979)

    Time-of-check time-of-use bug when verifying add-on signatures

  * CVE-2022-26381 (bmo#1736243)

    Use-after-free in text reflows

  * CVE-2022-26382 (bmo#1741888)

    Autofill Text could be exfiltrated via side-channel attacks

  * CVE-2022-26385 (bmo#1747526)

    Use-after-free in thread shutdown

  * CVE-2022-0843 (bmo#1746523, bmo#1749062, bmo#1749164, bmo#1749214,

    bmo#1749610, bmo#1750032, bmo#1752100, bmo#1752405, bmo#1753612,

    bmo#1754508)

    Memory safety bugs fixed in Firefox 98

- requires NSS 3.75

- add mozilla-bmo1756347.patch to fix i586 build

-------------------------------------------------------------------

Fri Feb 18 20:38:22 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 97.0.1

  * Fixed: Fixed an issue where TikTok videos would fail to load

    when selected from a user's profile page (bmo#1750973)

  * Fixed: Fixed an issue which led to Picture-in-Picture mode

    being unable to be toggled on Hulu (bmo#1753401)

  * Fixed: Works around problems with WebRoot SecureAnywhere

    antivirus rendering Firefox unusable in some situations

    (bmo#1752466)

  * Fixed: Fixed an issue causing users to see the Restore

    Session screen unexpectedly when starting Firefox

    (bmo#1749996)

-------------------------------------------------------------------

Mon Feb 14 19:31:29 UTC 2022 - Luciano Santos <luc14n0@opensuse.org>

- Remove bashisms ("source" and "function" keywords) from

  mozilla.sh.in to ally with the #!/bin/sh shebang. If the end user

  has either dash-sh package or busybox-sh to handle Bourn Shell

  scripts rather than having bash-sh package, the script would

  fail. Using "." instead of "source" and "create_langpack_link()"

  function definition is enough to keep both sides sane,

  behavior-wise.

-------------------------------------------------------------------

Tue Feb  8 08:40:45 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 97.0

  MFSA 2022-04 (bsc#1195682)

  * CVE-2022-22753 (bmo#1732435)

    Privilege Escalation to SYSTEM on Windows via Maintenance Service

  * CVE-2022-22754 (bmo#1750565)

    Extensions could have bypassed permission confirmation during update

  * CVE-2022-22755 (bmo#1309630)

    XSL could have allowed JavaScript execution after a tab was closed

  * CVE-2022-22756 (bmo#1317873)

    Drag and dropping an image could have resulted in the dropped

    object being an executable

  * CVE-2022-22757 (bmo#1720098)

    Remote Agent did not prevent local websites from connecting

  * CVE-2022-22758 (bmo#1728742)

    tel: links could have sent USSD codes to the dialer on

    Firefox for Android

  * CVE-2022-22759 (bmo#1739957)

    Sandboxed iframes could have executed script if the parent

    appended elements

  * CVE-2022-22760 (bmo#1740985, bmo#1748503)

    Cross-Origin responses could be distinguished between script

    and non-script content-types

  * CVE-2022-22761 (bmo#1745566)

    frame-ancestors Content Security Policy directive was not

    enforced for framed extension pages

  * CVE-2022-22762 (bmo#1743931)

    JavaScript Dialogs could have been displayed over other

    domains on Firefox for Android

  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,

    bmo#1748210, bmo#1748279)

    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6

  * CVE-2022-0511 (bmo#1713579, bmo#1735448, bmo#1743821, bmo#1746313,

    bmo#1746314, bmo#1746316, bmo#1746321, bmo#1746322, bmo#1746323,

    bmo#1746412, bmo#1746430, bmo#1746451, bmo#1746488, bmo#1746875,

    bmo#1746898, bmo#1746905, bmo#1746907, bmo#1746917, bmo#1747128,

    bmo#1747137, bmo#1747331, bmo#1747346, bmo#1747439, bmo#1747457,

    bmo#1747870, bmo#1749051, bmo#1749274, bmo#1749831)

    Memory safety bugs fixed in Firefox 97

- requires NSS 3.74

- requires rust 1.57

-------------------------------------------------------------------

Mon Feb  7 22:21:29 UTC 2022 - Dirk Müller <dmueller@suse.com>

- remove memoryperjob and use %limit instead. this allows to

  adapt to more worker types, and lowers the time the package

  is stuck in "scheduling". raising memory above 8 to lower

  risk for LTO jobs to run OOM

- add hack to disable -Wl,--gc-section which avoids a binutils

  segfault on x86

- change mozilla-reduce-rust-debuginfo.patch: use -g1 everywhere

-------------------------------------------------------------------

Sun Jan 30 23:58:34 UTC 2022 - Dirk Müller <dmueller@suse.com>

- disable ccache, this adds about 1 minute of build time and

  over 2 GB of disk space usage without benefit on OBS builds

- build with rust-simd like upstream does

- use -g1 for debuginfo generation as this is what upstream

  does as well and it saves ~ 2GB of writes

- use %limit on x86_64 to scale down to less capable workers

- disable install stripping so that debuginfo is useful

- use autopatch

- cleanup constraints to specify only jobs, physicalmemory

  and memoryperjob to be more flexible on which host to build

  on

-------------------------------------------------------------------

Fri Jan 28 15:26:45 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 96.0.3 (bsc#1195230)

  * Fixed an issue that allowed unexpected data to be submitted in

    some of our search telemetry (bmo#1752317)

-------------------------------------------------------------------

Mon Jan 24 07:42:03 UTC 2022 - Martin Liška <mliska@suse.cz>

- Enable -fimplicit-constexpr for GCC 12+.

-------------------------------------------------------------------

Thu Jan 20 23:21:44 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 96.0.2

  * Fix an issue that caused tab height to display inconsistently

    on Linux when audio was played (bmo#1714276)

  * Fix an issue that caused Lastpass dropdowns to appear blank in

    Private Browsing mode (bmo#1748158)

  * Fix a crash encountered when resizing a Facebook app

    (bmo#1746084)

-------------------------------------------------------------------

Fri Jan 14 16:56:42 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 96.0.1

  * Fixed: Improvements to make the parsing of content-length

    headers more robust (bmo#1749957, boo#1194677)

-------------------------------------------------------------------

Sat Jan  8 10:32:46 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 96.0

  * https://www.mozilla.org/en-US/firefox/96.0/releasenotes

  MFSA 2022-01 (bsc#1194547)

  * CVE-2022-22746 (bmo#1735071)

    Calling into reportValidity could have lead to fullscreen

    window spoof

  * CVE-2022-22743 (bmo#1739220)

    Browser window spoof using fullscreen mode

  * CVE-2022-22742 (bmo#1739923)

    Out-of-bounds memory access when inserting text in edit mode

  * CVE-2022-22741 (bmo#1740389)

    Browser window spoof using fullscreen mode

  * CVE-2022-22740 (bmo#1742334)

    Use-after-free of ChannelEventQueue::mOwner

  * CVE-2022-22738 (bmo#1742382)

    Heap-buffer-overflow in blendGaussianBlur

  * CVE-2022-22737 (bmo#1745874)

    Race condition when playing audio files

  * CVE-2021-4140 (bmo#1746720)

    Iframe sandbox bypass with XSLT

  * CVE-2022-22750 (bmo#1566608)

    IPC passing of resource handles could have lead to sandbox

    bypass

  * CVE-2022-22749 (bmo#1705094)

    Lack of URL restrictions when scanning QR codes

  * CVE-2022-22748 (bmo#1705211)

    Spoofed origin on external protocol launch dialog

  * CVE-2022-22745 (bmo#1735856)

    Leaking cross-origin URLs through securitypolicyviolation

    event

  * CVE-2022-22744 (bmo#1737252)

    The 'Copy as curl' feature in DevTools did not fully escape

    website-controlled data, potentially leading to command

    injection

  * CVE-2022-22747 (bmo#1735028)

    Crash when handling empty pkcs7 sequence

  * CVE-2022-22736 (bmo#1742692)

    Potential local privilege escalation when loading modules

    from the install directory.

  * CVE-2022-22739 (bmo#1744158)

    Missing throttling on external protocol launch dialog

  * CVE-2022-22751 (bmo#1664149, bmo#1737816, bmo#1739366,

    bmo#1740274, bmo#1740797, bmo#1741201, bmo#1741869,

    bmo#1743221, bmo#1743515, bmo#1745373, bmo#1746011)

    Memory safety bugs fixed in Firefox 96 and Firefox ESR 91.5

  * CVE-2022-22752 (bmo#1740534, bmo#1741210, bmo#1742770)

    Memory safety bugs fixed in Firefox 96

- removed obsolete patches

  * mozilla-bmo1745560.patch

  * mozilla-bmo1744896.patch

  * mozilla-sandbox-fips.patch

- requires

  NSPR >= 4.33

  NSS  >= 3.73.1

-------------------------------------------------------------------

Tue Dec 28 17:45:28 UTC 2021 - Bjørn Lie <bjorn.lie@gmail.com>

- Add upstream patches:

  * mozilla-bmo1745560.patch: Fix build against wayland 1.20.

  * mozilla-bmo1744896.patch: Create WaylandVsyncSource on window

    creation

-------------------------------------------------------------------

Mon Dec 20 21:57:30 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 95.0.2

  * Addresses frequent crashes experienced by users with C/E/Z-Series

    "Bobcat" CPUs running on Windows 7, 8, and 8.1.

- updated constraints for ppc and x86-64

-------------------------------------------------------------------

Fri Dec 17 13:49:16 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 95.0.1 (bsc#1193845)

  * Fixed frequent

    MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING error

    messages when trying to connect to various microsoft.com

    domains (bmo#1745600)

  * Fix for a WebRender crash on some Linux/X11 systems (bmo#1741956)

  * Fix for a frequent Windows shutdown crash (bmo#1738984)

  * Fix websites contrast issues for some Linux users with

    Dark mode set at OS level (bmo#1740518)

-------------------------------------------------------------------

Sat Dec  4 12:07:21 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 95.0

  * You can now move the Picture-in-Picture toggle button to the

    opposite side of the video. Simply look for the new context menu

    option Move Picture-in-Picture Toggle to Left (Right) Side.

  * To better protect Firefox users against side-channel attacks such

    as Spectre, Site Isolation is now enabled for all Firefox 95 users.

  * https://www.mozilla.org/en-US/firefox/95.0/releasenotes

  MFSA 2021-52 (bsc#1193485)

  * CVE-2021-43536 (bmo#1730120)

    URL leakage when navigating while executing asynchronous

    function

  * CVE-2021-43537 (bmo#1738237)

    Heap buffer overflow when using structured clone

  * CVE-2021-43538 (bmo#1739091)

    Missing fullscreen and pointer lock notification when

    requesting both

  * CVE-2021-43539 (bmo#1739683)

    GC rooting failure when calling wasm instance methods

  * MOZ-2021-0010 (bmo#1735852)

    Use-after-free in fullscreen objects on MacOS

  * CVE-2021-43540 (bmo#1636629)

    WebExtensions could have installed persistent ServiceWorkers

  * CVE-2021-43541 (bmo#1696685)

    External protocol handler parameters were unescaped

  * CVE-2021-43542 (bmo#1723281)

    XMLHttpRequest error codes could have leaked the existence of

    an external protocol handler

  * CVE-2021-43543 (bmo#1738418)

    Bypass of CSP sandbox directive when embedding

  * CVE-2021-43544 (bmo#1739934)

    Receiving a malicious URL as text through a SEND intent could

    have led to XSS

  * CVE-2021-43545 (bmo#1720926)

    Denial of Service when using the Location API in a loop

  * CVE-2021-43546 (bmo#1737751)

    Cursor spoofing could overlay user interface when native

    cursor is zoomed

  * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751,

    bmo#1737009, bmo#1739372, bmo#1739421)

    Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4