-------------------------------------------------------------------

Sat Jul 24 07:15:54 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 90.0.2:

  * Changed: Updates to support DoH Canada rollout (bmo#1713036)

  * Fixed: Fixed truncated output when printing (bmo#1720621)

  * Fixed: Fixed menu styling on some Gtk themes (bmo#1720441,

    bmo#1720874)

-------------------------------------------------------------------

Mon Jul 19 20:08:56 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 90.0.1 (boo#1188480):

  * Fixed: Fixed busy looping processing some HTTP3 responses

    (bmo#1720079)

  * Fixed: Fixed transient errors authenticating with some smart

    cards (bmo#1715325)

  * Fixed: Fixed a rare crash on shutdown (bmo#1707057)

  * Fixed: Fixed a race on startup that caused about:support to

    end up empty after upgrade (bmo#1717894, boo#1188330)

-------------------------------------------------------------------

Sun Jul 11 08:53:02 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 90.0

  MFSA 2021-28 (bsc#1188275)

  * CVE-2021-29970 (bmo#1709976)

    Use-after-free in accessibility features of a document

  * CVE-2021-29971 (bmo#1713638)

    Granted permissions only compared host; omitting scheme and

    port on Android

  * CVE-2021-30547 (bmo#1715766)

    Out of bounds write in ANGLE

  * CVE-2021-29972 (bmo#1696816)

    Use of out-of-date library included use-after-free

    vulnerability

  * CVE-2021-29973 (bmo#1701932)

    Password autofill on HTTP websites was enabled without user

    interaction on Android

  * CVE-2021-29974 (bmo#1704843)

    HSTS errors could be overridden when network partitioning was

    enabled

  * CVE-2021-29975 (bmo#1713259)

    Text message could be overlaid on top of another website

  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,

    bmo#1711576, bmo#1714391)

    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12

  * CVE-2021-29977 (bmo#1665836, bmo#1686138, bmo#1704316,

    bmo#1706314, bmo#1709931, bmo#1712084, bmo#1712357,

    bmo#1714066)

    Memory safety bugs fixed in Firefox 90

- requires

  NSPR 4.31

  NSS 3.66

- Gtk2 support removed (was only for Flash plugin before)

-------------------------------------------------------------------

Wed Jun 23 16:54:20 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 89.0.2 (boo#1187648):

  * Fix occasional hangs with Software WebRender on Linux (bmo#1708224)

-------------------------------------------------------------------

Sat Jun 19 09:00:20 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 89.0.1 (boo#1187475):

  * Updated translations, including full Spanish (Mexico)

    localization and other improvements (bmo#1714946)

  * Fix various font related regressions (bmo#1694174)

  * Linux: Fix performance and stability regressions with

    WebRender (bmo#1715895, bmo#1715902)

  * Enterprise: Fix for the `DisableDeveloperTools` policy not

    having effect anymore (bmo#1715777)

  * Linux: Fix broken scrollbars on some GTK themes (bmo#1714103)

  * Various stability fixes

-------------------------------------------------------------------

Sat May 29 20:55:56 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 89.0

  * UI redesign

  * The Event Timing API is now supported

  * The CSS forced-colors media query is now supported

  MFSA 2021-23 (bsc#1186696)

  * CVE-2021-29965 (bmo#1709257)

    Password Manager on Firefox for Android susceptible to domain

    spoofing

  * CVE-2021-29960 (bmo#1675965)

    Filenames printed from private browsing mode incorrectly

    retained in preferences

  * CVE-2021-29961 (bmo#1700235)

    Firefox UI spoof using `<select>` elements and CSS scaling

  * CVE-2021-29963 (bmo#1705068)

    Shared cookies for search suggestions in private browsing mode

  * CVE-2021-29964 (bmo#1706501)

    Out of bounds-read when parsing a `WM_COPYDATA` message

  * CVE-2021-29959 (bmo#1395819)

    Devices could be re-enabled without additional permission prompt

  * CVE-2021-29962 (bmo#1701673)

    No rate-limiting for popups on Firefox for Android

  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,

    bmo#1704722, bmo#1706041)

    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11

  * CVE-2021-29966 (bmo#1660307, bmo#1686154, bmo#1702948, bmo#1708124)

    Memory safety bugs fixed in Firefox 89

- require

  NSS >= 3.64

  rust-cbindgen >= 0.19.0

- do not rely on nodejs10 packagename anymore

- updated mozilla.keyring

- switched TW/x86_64 to clang as the last platform due to

  https://bugs.gentoo.org/792705

- but LTO with clang is broken in TW so disable LTO for it

  https://bugs.llvm.org/show_bug.cgi?id=47872

-------------------------------------------------------------------

Thu May  6 13:40:10 UTC 2021 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Relax RAM and disk constraints for aarch64

-------------------------------------------------------------------

Wed May  5 15:13:20 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 88.0.1

  * Fixed: Resolved an issue caused by a recent Widevine plugin

    update which prevented some purchased video content from

    playing correctly (bmo#1705138)

  * Fixed: Fixed corruption of videos playing on Twitter or

    WebRTC calls on some Gen6 Intel graphics chipsets

    (bmo#1708937)

  * Fixed: Fixed menulists in Preferences being unreadable for

    users with High Contrast Mode enabled (bmo#1706496)

  MFSA 2021-20 (bsc#1185633)

  * CVE-2021-29952 (bmo#1704227)

    Race condition in Web Render Components

- devel package: move macros to /usr/lib/rpm/macros.d (boo#1185658)

-------------------------------------------------------------------

Sun May  2 12:03:26 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- add compatibility for libavcodec58_134

-------------------------------------------------------------------

Sun Apr 18 09:01:32 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 88.0

  * New: PDF forms now support JavaScript embedded in PDF files.

    Some PDF forms use JavaScript for validation and other

    interactive features

  * New: Print updates: Margin units are now localized

  * New: Smooth pinch-zooming using a touchpad is now supported

    on Linux

  * New: To protect against cross-site privacy leaks, Firefox now

    isolates window.name data to the website that created it.

    Learn more

  * Changed: Firefox will not prompt for access to your

    microphone or camera if you’ve already granted access to the

    same device on the same site in the same tab within the past

    50 seconds. This new grace period reduces the number of times

    you’re prompted to grant device access

  * Changed: The ‘Take a Screenshot’ feature was removed from the

    Page Actions menu in the url bar. To take a screenshot,

    right-click to open the context menu. You can also add a

    screenshots shortcut directly to your toolbar via the

    Customize menu. Open the Firefox menu and select Customize…

  * Changed: FTP support has been disabled, and its full removal

    is planned for an upcoming release. Addressing this security

    risk reduces the likelihood of an attack while also removing

    support for a non-encrypted protocol

  * Developer: Introduced a new toggle button in the Network

    panel for switching between JSON formatted HTTP response and

    raw data (as received over the wire).

    !enter image description here

  * Enterprise: Various bug fixes and new policies have been

    implemented in the latest version of Firefox. You can see

    more details in the Firefox for Enterprise 88 Release Notes.

  * Fixed: Screen readers no longer incorrectly read content that

    websites have visually hidden, as in the case of articles in

    the Google Help panel

  MFSA 2021-16 (bsc#1184960)

  * CVE-2021-23994 (bmo#1699077)

    Out of bound write due to lazy initialization

  * CVE-2021-23995 (bmo#1699835)

    Use-after-free in Responsive Design Mode

  * CVE-2021-23996 (bmo#1701834)

    Content rendered outside of webpage viewport

  * CVE-2021-23997 (bmo#1701942)

    Use-after-free when freeing fonts from cache

  * CVE-2021-23998 (bmo#1667456)

    Secure Lock icon could have been spoofed

  * CVE-2021-23999 (bmo#1691153)

    Blob URLs may have been granted additional privileges

  * CVE-2021-24000 (bmo#1694698)

    requestPointerLock() could be applied to a tab different from

    the visible tab

  * CVE-2021-24001 (bmo#1694727)

    Testing code could have enabled session history manipulations

    by a compromised content process

  * CVE-2021-24002 (bmo#1702374)

    Arbitrary FTP command execution on FTP servers using an

    encoded URL

  * CVE-2021-29945 (bmo#1700690)

    Incorrect size computation in WebAssembly JIT could lead to

    null-reads

  * CVE-2021-29944 (bmo#1697604)

    HTML injection vulnerability in Firefox for Android's Reader View

  * CVE-2021-29946 (bmo#1698503)

    Port blocking could be bypassed

  * CVE-2021-29947 (bmo#1651449, bmo#1674142, bmo#1693476,

    bmo#1696886, bmo#1700091)

    Memory safety bugs fixed in Firefox 88

- requires

  * NSPR 4.30

  * NSS 3.63.1

- align wayland support logic

-------------------------------------------------------------------

Sat Mar 27 10:40:46 UTC 2021 - Manfred Hollstein <manfred.h@gmx.net>

- Switch to clang_build globally; just on TW/x86_64 it does not work

  due to unreolved externals `__rust_probestack' - disable clang_build

  then.

- useccache: Add conditionals to enable/disable ccache.

-------------------------------------------------------------------

Tue Mar 23 16:42:19 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 87.0

  * requires NSS 3.62

  * removed obsolete BigEndian ICU build workaround

  * rebased patches

  MFSA 2021-10 (bsc#1183942)

  * CVE-2021-23981 (bmo#1692832)

    Texture upload into an unbound backing buffer resulted in an

    out-of-bound read

  * CVE-2021-23982 (bmo#1677046)

    Internal network hosts could have been probed by a malicious

    webpage

  * CVE-2021-23983 (bmo#1692684)

    Transitions for invalid ::marker properties resulted in memory

    corruption

  * CVE-2021-23984 (bmo#1693664)

    Malicious extensions could have spoofed popup information

  * CVE-2021-23985 (bmo#1659129)

    Devtools remote debugging feature could have been enabled

    without indication to the user

  * CVE-2021-23986 (bmo#1692623)

    A malicious extension could have performed credential-less

    same origin policy violations

  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,

    bmo#1690718)

    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9

  * CVE-2021-23988 (bmo#1684994, bmo#1686653)

    Memory safety bugs fixed in Firefox 87

-------------------------------------------------------------------

Tue Mar 16 14:26:35 UTC 2021 - Martin Liška <mliska@suse.cz>

- Set memory limits for DWZ to 4x.

-------------------------------------------------------------------

Sat Mar 13 08:23:06 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 86.0.1

  * Fixed: Fixed an issue on Apple Silicon machines that caused

    Firefox to be unresponsive after system sleep (bmo#1682713)

  * Fixed: Fixed an issue causing windows to gain or lose focus

    unexpectedly (bmo#1694927)

  * Fixed: Fixed truncation of date and time widgets due to

    incorrect width calculation (bmo#1695578)

  * Fixed: Fixed an issue causing unexpected behavior with

    extensions managing tab groups (bmo#1694699)

  * Fixed: Fixed a frequent Linux crash on browser launch

    (bmo#1694670)

-------------------------------------------------------------------

Sun Feb 21 18:14:12 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 86.0

  * requires NSS >= 3.61

  * requires rust-cbindgen >= 0.16.0

  * Firefox now supports simultaneously watching multiple videos in

    Picture-in-Picture.

  * Total Cookie Protection to Strict Mode

  * https://www.mozilla.org/en-US/firefox/86.0/releasenotes

  MSFA 2021-07 (bsc#1182614)

  * CVE-2021-23969 (bmo#1542194)

    Content Security Policy violation report could have contained

    the destination of a redirect

  * CVE-2021-23970 (bmo#1681724)

    Multithreaded WASM triggered assertions validating separation

    of script domains

  * CVE-2021-23968 (bmo#1687342)

    Content Security Policy violation report could have contained

    the destination of a redirect

  * CVE-2021-23974 (bmo#1528997, bmo#1683627)

    noscript elements could have led to an HTML Sanitizer bypass

  * CVE-2021-23971 (bmo#1678545)

    A website's Referrer-Policy could have been be overridden,

    potentially resulting in the full URL being sent as a Referrer

  * CVE-2021-23976 (bmo#1684627)

    Local spoofing of web manifests for arbitrary pages in

    Firefox for Android

  * CVE-2021-23977 (bmo#1684761)

    Malicious application could read sensitive data from Firefox

    for Android's application directories

  * CVE-2021-23972 (bmo#1683536)

    HTTP Auth phishing warning was omitted when a redirect is

    cached

  * CVE-2021-23975 (bmo#1685145)

    about:memory Measure function caused an incorrect pointer

    operation

  * CVE-2021-23973 (bmo#1690976)

    MediaError message property could have leaked information

    about cross-origin resources

  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597, bmo#786797)

    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8

  * CVE-2021-23979 (bmo#1663222, bmo#1666607, bmo#1672120, bmo#1678463,

    bmo#1678927, bmo#1679560, bmo#1681297, bmo#1681684, bmo#1683490,

    bmo#1684377, bmo#1684902)

    Memory safety bugs fixed in Firefox 86

- updated create-tar.sh (bsc#1182357)

- removed obsolete mozilla-bmo1554971.patch

- remove buildsymbols subpackage

  * we haven't done anything with it for years

  * mozilla is collecting those from our debuginfo packages

  * would require a local dump_syms tool

-------------------------------------------------------------------

Wed Feb 17 18:40:41 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 85.0.2

  * Fixed: Fixed a deadlock during startup (bmo#1679933)

-------------------------------------------------------------------

Wed Feb 17 11:19:01 UTC 2021 - Michel Normand <normand@linux.vnet.ibm.com>

- Use %limit_build macros for PowerPC to avoid oom build failure

-------------------------------------------------------------------

Tue Feb  9 09:05:26 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 85.0.1

  MFSA 2021-06 (bsc#1181848)

  * MOZ-2021-0001 (bmo#1676636)

    Buffer overflow in depth pitch calculations for compressed

    textures

  * Fixed: Avoid printing an extra blank page at the end of some

    documents (bmo#1689789).

  * Fixed: Fixed a browser crash in case of unexpected Cache API

    state (bmo#1684838).

-------------------------------------------------------------------

Sun Jan 24 11:53:58 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 85.0

  * Adobe Flash is completely history

  * supercookie protection

  * new bookmark handling and features

  MFSA 2021-03 (bsc#1181414)

  * CVE-2021-23953 (bmo#1683940)

    Cross-origin information leakage via redirected PDF requests

  * CVE-2021-23954 (bmo#1684020)

    Type confusion when using logical assignment operators in

    JavaScript switch statements

  * CVE-2021-23955 (bmo#1684837)

    Clickjacking across tabs through misusing requestPointerLock

  * CVE-2021-23956 (bmo#1338637)

    File picker dialog could have been used to disclose a

    complete directory

  * CVE-2021-23957 (bmo#1584582)

    Iframe sandbox could have been bypassed on Android via the

    intent URL scheme

  * CVE-2021-23958 (bmo#1642747)

    Screen sharing permission leaked across tabs

  * CVE-2021-23959 (bmo#1659035)

    Cross-Site Scripting in error pages on Firefox for Android

  * CVE-2021-23960 (bmo#1675755)

    Use-after-poison for incorrectly redeclared JavaScript

    variables during GC

  * CVE-2021-23961 (bmo#1677940)

    More internal network hosts could have been probed by a

    malicious webpage

  * CVE-2021-23962 (bmo#1677194)

    Use-after-poison in

    <code>nsTreeBodyFrame::RowCountChanged</code>

  * CVE-2021-23963 (bmo#1680793)

    Permission prompt inaccessible after asking for additional

    permissions

  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526, bmo#1674278,

    bmo#1674835, bmo#1675097, bmo#1675844, bmo#1675868, bmo#1677590,

    bmo#1677888, bmo#1680410, bmo#1681268, bmo#1682068, bmo#1682938,

    bmo#1683736, bmo#1685260, bmo#1685925)

    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7

  * CVE-2021-23965 (bmo#1670378, bmo#1673555, bmo#1676812, bmo#1678582,

    bmo#1684497)

    Memory safety bugs fixed in Firefox 85

- requires NSS 3.60.1

- requires rust 1.47

- remove obsolete mozilla-pipewire-0-3.patch

-------------------------------------------------------------------

Mon Jan 11 18:02:01 UTC 2021 - Matthias Mailänder <mailaender@opensuse.org>

- Fix AppStream screenshot links

-------------------------------------------------------------------

Thu Jan  7 17:11:43 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 84.0.2

  MFSA 2021-01 (bsc#1180623)

  * CVE-2020-16044 (bmo#1683964)

    Use-after-free write when handling a malicious COOKIE-ECHO

    SCTP chunk

-------------------------------------------------------------------

Sun Dec 27 09:52:50 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 84.0.1

  * Fixed problems loading secure websites and crashes for users

    with certain third-party PKCS11 modules and smartcards installed

    (bmo#1682881) (fixed in NSS 3.59.1)

  * Fixed a bug causing some Unity JS games to not load on Apple

    Silicon devices due to improper detection of the OS version

    (bmo#1680516)

- requires NSS 3.59.1

-------------------------------------------------------------------

Sun Dec 13 18:18:58 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 84.0

  * Firefox 84 is the final release to support Adobe Flash

  * WebRender is enabled by default when run on GNOME-based X11

    Linux desktops

  MFSA 2020-54 (bsc#1180039))

  * CVE-2020-16042 (bmo#1679003)

    Operations on a BigInt could have caused uninitialized memory

    to be exposed

  * CVE-2020-26971 (bmo#1663466)

    Heap buffer overflow in WebGL

  * CVE-2020-26972 (bmo#1671382)

    Use-After-Free in WebGL

  * CVE-2020-26973 (bmo#1680084)

    CSS Sanitizer performed incorrect sanitization

  * CVE-2020-26974 (bmo#1681022)

    Incorrect cast of StyleGenericFlexBasis resulted in a heap

    use-after-free

  * CVE-2020-26975 (bmo#1661071)

    Malicious applications on Android could have induced Firefox

    for Android into sending arbitrary attacker-specified headers

  * CVE-2020-26976 (bmo#1674343)

    HTTPS pages could have been intercepted by a registered

    service worker when they should not have been

  * CVE-2020-26977 (bmo#1676311)