-------------------------------------------------------------------

Sun May  7 19:47:00 UTC 2023 - Aaron Puchert <aaronpuchert@alice-dsl.net>

- Fix i586 build by reducing debug info to -g1. (boo#1210168)

-------------------------------------------------------------------

Tue Apr 25 16:01:07 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 112.0.2

  * Fix a high memory usage issue with animated images in minimized

    (or completely covered) windows, especially when using animated

    themes (bmo#1828587)

  * Fix an issue where Linux users with bitmap fonts installed may

    have had entire sections of text invisible to them on some

    sites (bmo#1827950)

-------------------------------------------------------------------

Fri Apr 21 09:48:25 UTC 2023 - Manfred Hollstein <manfred.h@gmx.net>

- Include Leap 15.5 in check for which python version is required.

-------------------------------------------------------------------

Thu Apr 20 13:24:13 UTC 2023 - Andreas Stieger <Andreas.Stieger@gmx.de>

- Mozilla Firefox 112.0.1

  * Fix a bug where cookie dates appear to be set in the far

    future after updating Firefox. This may have caused cookies to

    be unintentionally purged (bmo#1827669)

-------------------------------------------------------------------

Mon Apr 10 21:58:19 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 112.0

  * https://www.mozilla.org/en-US/firefox/112.0/releasenotes/

  MFSA 2023-13 (bsc#1210212)

  * CVE-2023-29531 (bmo#1794292)

    Out-of-bound memory access in WebGL on macOS

  * CVE-2023-29532 (bmo#1806394)

    Mozilla Maintenance Service Write-lock bypass

  * CVE-2023-29533 (bmo#1798219, bmo#1814597)

    Fullscreen notification obscured

  * CVE-2023-29534 (bmo#1816007, bmo#1816059, bmo#1821155, bmo#1821576,

    bmo#1821906, bmo#1822298, bmo#1822305)

    Fullscreen notification could have been obscured on Firefox

    for Android

  * MFSA-TMP-2023-0001 (bmo#1819244)

    Double-free in libwebp

  * CVE-2023-29535 (bmo#1820543)

    Potential Memory Corruption following Garbage Collector compaction

  * CVE-2023-29536 (bmo#1821959)

    Invalid free from JavaScript code

  * CVE-2023-29537 (bmo#1823365, bmo#1824200, bmo#1825569)

    Data Races in font initialization code

  * CVE-2023-29538 (bmo#1685403)

    Directory information could have been leaked to WebExtensions

  * CVE-2023-29539 (bmo#1784348)

    Content-Disposition filename truncation leads to Reflected

    File Download

  * CVE-2023-29540 (bmo#1790542)

    Iframe sandbox bypass using redirects and sourceMappingUrls

  * CVE-2023-29541 (bmo#1810191)

    Files with malicious extensions could have been downloaded

    unsafely on Linux

  * CVE-2023-29542 (bmo#1810793, bmo#1815062)

    Bypass of file download extension restrictions

  * CVE-2023-29543 (bmo#1816158)

    Use-after-free in debugging APIs

  * CVE-2023-29544 (bmo#1818781)

    Memory Corruption in garbage collector

  * CVE-2023-29545 (bmo#1823077)

    Windows Save As dialog resolved environment variables

  * CVE-2023-29546 (bmo#1780842)

    Screen recording in Private Browsing included address bar on

    Android

  * CVE-2023-29547 (bmo#1783536)

    Secure document cookie could be spoofed with insecure cookie

  * CVE-2023-29548 (bmo#1822754)

    Incorrect optimization result on ARM64

  * CVE-2023-29549 (bmo#1823042)

    Javascript's bind function may have failed

  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498, bmo#1814217,

    bmo#1818357, bmo#1818762, bmo#1819493, bmo#1820389, bmo#1820602,

    bmo#1821448, bmo#1822413, bmo#1824828)

    Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10

  * CVE-2023-29551 (bmo#1763625, bmo#1814314, bmo#1815798, bmo#1815890,

    bmo#1819239, bmo#1819465, bmo#1819486, bmo#1819492, bmo#1819957,

    bmo#1820514, bmo#1820776, bmo#1821838, bmo#1822175, bmo#1823547)

    Memory safety bugs fixed in Firefox 112

- requires

  * NSS 3.89

  * Python >= 3.7 (for build)

- removed obsolete mozilla-bmo1807652.patch

- Fix Icons displayed incorrectly on GNOME/wayland via WMCLASS

  in desktop file

-------------------------------------------------------------------

Mon Mar 27 15:17:17 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 111.0.1 (boo#1209688)

  * Fixed a crash on macOS while pinch-zooming under some circumstances

    (bmo#1658986)

  * Fixed a bug causing Firefox to freeze on startup for some

    Windows users (bmo#1823159)

- fix build on Tumbleweed (mozilla-bmo1807652.patch)

- exclude i586/i686 once again because it fails to link libxul due

  to its size

-------------------------------------------------------------------

Tue Mar 14 14:29:09 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 111.0

  * https://www.mozilla.org/en-US/firefox/111.0/releasenotes

  MFSA 2023-09 (bsc#1209173)

  * CVE-2023-28159 (bmo#1783561)

    Fullscreen Notification could have been hidden by download

    popups on Android

  * CVE-2023-25748 (bmo#1798798)

    Fullscreen Notification could have been hidden by window

    prompts on Android

  * CVE-2023-25749 (bmo#1810705)

    Firefox for Android may have opened third-party apps without

    a prompt

  * CVE-2023-25750 (bmo#1814733)

    Potential ServiceWorker cache leak during private browsing mode

  * CVE-2023-25751 (bmo#1814899)

    Incorrect code generation during JIT compilation

  * CVE-2023-28160 (bmo#1802385)

    Redirect to Web Extension files may have leaked local path

  * CVE-2023-28164 (bmo#1809122)

    URL being dragged from a removed cross-origin iframe into the

    same tab triggered navigation

  * CVE-2023-28161 (bmo#1811181)

    One-time permissions granted to a local file were extended to

    other local files loaded in the same tab

  * CVE-2023-28162 (bmo#1811327)

    Invalid downcast in Worklets

  * CVE-2023-25752 (bmo#1811627)

    Potential out-of-bounds when accessing throttled streams

  * CVE-2023-28163 (bmo#1817768)

    Windows Save As dialog resolved environment variables

  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904, bmo#1817442,

    bmo#1818674)

    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9

  * CVE-2023-28177 (bmo#1803109, bmo#1808832, bmo#1809542, bmo#1817336)

    Memory safety bugs fixed in Firefox 111

- ensure gcc11-c++ gets used on Leap 15.5

- requires NSS >= 3.88.1

- removed obsolete patches

  gcc13-fix.patch

  mozilla-bmo1810584.patch

- rebased patches

- update create-tar.sh

-------------------------------------------------------------------

Tue Mar  7 09:40:11 UTC 2023 - Martin Liška <mliska@suse.cz>

- Cherry-pick upstream changes for GCC 13 in gcc13-fix.patch.

-------------------------------------------------------------------

Mon Mar  6 20:09:41 UTC 2023 - Andreas Schwab <schwab@suse.de>

- Limit memory use on riscv64

-------------------------------------------------------------------

Sat Mar  4 16:03:22 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>

- Fix 32 bit build bmo#1810584 (add mozilla-bmo1810584.patch)

-------------------------------------------------------------------

Fri Mar  3 17:29:27 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 110.0.1 (boo#1208886)

  * Fixed clearing recent cookies clears all cookies

    (bmo#1816279)

  * Fixed WebGL crashes on Linux when ran inside a VMWare virtual

    machine (bmo#1807942)

  * Fixed a bug with CSP serialization causing bugs with the MitID

    Digital ID in Denmark (bmo#1819096)

-------------------------------------------------------------------

Wed Feb 15 09:56:46 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 110.0

  * https://www.mozilla.org/en-US/firefox/110.0/releasenotes

  MFSA 2023-05 (bsc#1208144)

  * CVE-2023-25728 (bmo#1790345)

    Content security policy leak in violation reports using iframes

  * CVE-2023-25730 (bmo#1794622)

    Screen hijack via browser fullscreen mode

  * CVE-2023-25743 (bmo#1800203)

    Fullscreen notification not shown in Firefox Focus

  * CVE-2023-0767 (bmo#1804640)

    Arbitrary memory write via PKCS 12 in NSS

  * CVE-2023-25735 (bmo#1810711)

    Potential use-after-free from compartment mismatch in SpiderMonkey

  * CVE-2023-25737 (bmo#1811464)

    Invalid downcast in SVGUtils::SetupStrokeGeometry

  * CVE-2023-25738 (bmo#1811852)

    Printing on Windows could potentially crash Firefox with some

    device drivers

  * CVE-2023-25739 (bmo#1811939)

    Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext

  * CVE-2023-25729 (bmo#1792138)

    Extensions could have opened external schemes without user knowledge

  * CVE-2023-25732 (bmo#1804564)

    Out of bounds memory write from EncodeInputStream

  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143, bmo#1812338)

    Opening local .url files could cause unexpected network loads

  * CVE-2023-25740 (bmo#1812354)

    Opening local .scf files could cause unexpected network loads

  * CVE-2023-25731 (bmo#1801542)

    Prototype pollution when rendering URLPreview

  * CVE-2023-25733 (bmo#1808632)

    Possible null pointer dereference in TaskbarPreviewCallback

  * CVE-2023-25736 (bmo#1811331)

    Invalid downcast in GetTableSelectionMode

  * CVE-2023-25741 (bmo#1437126, bmo#1812611, bmo#1813376)

    Same-origin policy leak via image drag and drop

  * CVE-2023-25742 (bmo#1813424)

    Web Crypto ImportKey crashes tab

  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)

    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8

  * CVE-2023-25745 (bmo#1688592, bmo#1797186, bmo#1804998,

    bmo#1806521, bmo#1813284)

    Memory safety bugs fixed in Firefox 110

- requires

  NSS = 3.87

  rust/cargo = 1.66

- update create-tar.sh

-------------------------------------------------------------------

Wed Feb  1 19:48:47 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 109.0.1

  * Fixed jank when loading pages containing a large number of

    emoji characters (bmo#1809081)

  * Fixed an issue causing authentication prompts to not appear

    when loading pages in some enterprise environments

    (bmo#1809151)

  * ixed inconsistent sizing of event listener checkboxes inside

    the Inspector developer tool (bmo#1811760)

-------------------------------------------------------------------

Mon Jan 16 06:54:09 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 109.0

  MFSA 2023-01 (bsc#1207119)

  * CVE-2023-23597 (bmo#1538028)

    Logic bug in process allocation allowed to read arbitrary

    files

  * CVE-2023-23598 (bmo#1800425)

    Arbitrary file read from GTK drag and drop on Linux

  * CVE-2023-23599 (bmo#1777800)

    Malicious command could be hidden in devtools output on

    Windows

  * CVE-2023-23600 (bmo#1787034)

    Notification permissions persisted between Normal and Private

    Browsing on Android

  * CVE-2023-23601 (bmo#1794268)

    URL being dragged from cross-origin iframe into same tab

    triggers navigation

  * CVE-2023-23602 (bmo#1800890)

    Content Security Policy wasn't being correctly applied to

    WebSockets in WebWorkers

  * CVE-2023-23603 (bmo#1800832)

    Calls to <code>console.log</code> allowed bypasing Content

    Security Policy via format directive

  * CVE-2023-23604 (bmo#1802346)

    Creation of duplicate <code>SystemPrincipal</code> from less

    secure contexts

  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)

    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7

  * CVE-2023-23606 (bmo#1764974, bmo#1798591, bmo#1799201,

    bmo#1800446, bmo#1801248, bmo#1802100, bmo#1803393,

    bmo#1804626, bmo#1804971, bmo#1807004)

    Memory safety bugs fixed in Firefox 109

- requires NSS 3.86

- rebased patches

-------------------------------------------------------------------

Fri Jan  6 06:57:25 UTC 2023 - Luciano Santos <luc14n0@opensuse.org>

- Mozilla Firefox 108.0.2

  * Fixes a crash that might occur when managing browser history

    (bmo#1806408).

- Drop merged-upstream mozilla-bmo1805809.patch.

-------------------------------------------------------------------

Wed Dec 21 16:05:26 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- add mozilla-bmo1805809.patch to fix build for x86-32 (boo#1206600)

-------------------------------------------------------------------

Tue Dec 20 07:58:58 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 108.0.1 (boo#1206507)

  * Fixes the default search engine being reset on upgrade for

    profiles which were previously copied from a different location

-------------------------------------------------------------------

Tue Dec 13 13:54:35 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 108.0

  https://www.mozilla.org/en-US/firefox/108.0/releasenotes/

  MFSA 2022-51 (bsc#1206242)

  * CVE-2022-46871 (bmo#1795697)

    libusrsctp library out of date

  * CVE-2022-46872 (bmo#1799156)

    Arbitrary file read from a compromised content process

  * CVE-2022-46873 (bmo#1644790)

    Firefox did not implement the CSP directive unsafe-hashes

  * CVE-2022-46874 (bmo#1746139)

    Drag and Dropped Filenames could have been truncated to

    malicious extensions

  * CVE-2022-46875 (bmo#1786188)

    Download Protections were bypassed by .atloc and .ftploc

    files on Mac OS

  * CVE-2022-46877 (bmo#1795139)

    Fullscreen notification bypass

  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,

    bmo#1801102, bmo#1801315, bmo#1802395)

    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6

  * CVE-2022-46879 (bmo#1736224, bmo#1793407, bmo#1794249, bmo#1795845,

    bmo#1797682, bmo#1797720, bmo#1798494, bmo#1799479)

    Memory safety bugs fixed in Firefox 108

- requires

  NSS >= 3.85

  rustc/cargo 1.65

-------------------------------------------------------------------

Thu Dec  8 08:42:14 UTC 2022 - Milachew <milachew@mail.lv>

- added translations to .desktop file.

-------------------------------------------------------------------

Thu Dec  1 21:13:32 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 107.0.1:

  * Fix an issue with accessing some sites reliably in Private

    Browsing mode or Strict ETP due to anti-adblockers

    (bmo#1717806)

  * Fix an issue where Color Management was not available for

    some users (bmo#1799391)

  * Fix an issue with text overlapping in the Settings Menu for

    some locales (bmo#1800379)

  * Fix an issue where the DevTools UI is not accessible when an

    alert dialog is displayed (bmo#1801840)

-------------------------------------------------------------------

Tue Nov 15 14:22:26 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 107.0

  MFSA 2022-47 (bsc#1205270)

 * CVE-2022-45403 (bmo#1762078)

    Service Workers might have learned size of cross-origin media files

  * CVE-2022-45404 (bmo#1790815)

    Fullscreen notification bypass

  * CVE-2022-45405 (bmo#1791314)

    Use-after-free in InputStream implementation

  * CVE-2022-45406 (bmo#1791975)

    Use-after-free of a JavaScript Realm

  * CVE-2022-45407 (bmo#1793314)

    Loading fonts on workers was not thread-safe

  * CVE-2022-45408 (bmo#1793829)

    Fullscreen notification bypass via windowName

  * CVE-2022-45409 (bmo#1796901)

    Use-after-free in Garbage Collection

  * CVE-2022-45410 (bmo#1658869)

    ServiceWorker-intercepted requests bypassed SameSite cookie policy

  * CVE-2022-45411 (bmo#1790311)

    Cross-Site Tracing was possible via non-standard override headers

  * CVE-2022-45412 (bmo#1791029)

    Symlinks may resolve to partially uninitialized buffers

  * CVE-2022-45413 (bmo#1791201)

    SameSite=Strict cookies could have been sent cross-site via

    intent URLs

  * CVE-2022-40674 (bmo#1791598)

    Use-after-free vulnerability in expat

  * CVE-2022-45415 (bmo#1793551)

    Downloaded file may have been saved with malicious extension

  * CVE-2022-45416 (bmo#1793676)

    Keystroke Side-Channel Leakage

  * CVE-2022-45417 (bmo#1794508)

    Service Workers in Private Browsing Mode may have been

    written to disk

  * CVE-2022-45418 (bmo#1795815)

    Custom mouse cursor could have been drawn over browser UI

  * CVE-2022-45419 (bmo#1716082)

    Deleting a security exception did not take effect immediately

  * CVE-2022-45420 (bmo#1792643)

    Iframe contents could be rendered outside the iframe

  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)

    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5

- requires

  * NSS >= 3.84

  * rust = 1.64

-------------------------------------------------------------------

Sat Nov  5 13:16:42 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 106.0.5

  * Addresses a crash experienced by users with Intel Gemini Lake

    CPUs (bmo#1702019)

- Mozilla Firefox 106.0.4

  * Fixed an issue with DRM Video playback (bmo#1797292)

  * Fixed broken layout of datetime input when switching

    types (bmo#1797139)

-------------------------------------------------------------------

Tue Nov  1 19:26:39 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 106.0.3

  * Fixes for other platforms

-------------------------------------------------------------------

Thu Oct 27 18:07:29 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 106.0.2

  * Fix missing content on some PDF forms (bmo#1794351)

  * Fix column width for the Notification sub-panel in Settings

    (bmo#1793558)

  * Fix a browser freeze with accessibility enabled on some sites

    such as the Proxmox Web UI (bmo#1793748)

  * Fix page reloading not working with Firefox View and not

    refreshing synced data (bmo#1792680, bmo#1794474)

-------------------------------------------------------------------

Sun Oct 23 07:34:50 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 106.0.1

  * Addresses a crash experienced by users with AMD Zen 1 CPUs

    (bmo#1796126)

-------------------------------------------------------------------

Sun Oct 16 20:08:21 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 106.0

  * support editing of PDFs