-------------------------------------------------------------------

Sat Oct  8 13:41:12 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 105.0.3:

  * Fixes for other platforms

-------------------------------------------------------------------

Wed Oct  5 18:27:01 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 105.0.2:

  * Fixed poor contrast on various menu items with certain

    themes on Linux systems (bmo#1792063)

  * Fixed the scrollbar appearing on the wrong side of

    `select` elements in right-to-left locales (bmo#1791219)

  * Fixed a possible deadlock when loading some sites in

    Troubleshoot Mode (bmo#1786259)

  * Fixed a bug causing some dynamic appearance changes to

    not appear when expected (bmo#1786521)

  * Fixed a bug causing theme styling to not be properly applied

    to sidebars for some add-ons in Private Browsing Mode

    (bmo#1787543)

-------------------------------------------------------------------

Thu Sep 22 22:12:39 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 105.0.1

  * Reverted focus behavior for new windows back to the content

    area instead of the address bar (bmo#1784692)

- added mozilla-i686-build.patch to avoid using avx2

-------------------------------------------------------------------

Sat Sep 17 21:01:10 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 105.0

  https://www.mozilla.org/en-US/firefox/105.0/releasenotes

  MFSA 2022-40 (bsc#1203477)

  * CVE-2022-40959 (bmo#1782211)

    Bypassing FeaturePolicy restrictions on transient pages

  * CVE-2022-40960 (bmo#1787633)

    Data-race when parsing non-UTF-8 URLs in threads

  * CVE-2022-40958 (bmo#1779993)

    Bypassing Secure Context restriction for cookies with __Host

    and __Secure prefix

  * CVE-2022-40961 (bmo#1784588)

    Stack-buffer overflow when initializing Graphics

  * CVE-2022-40956 (bmo#1770094)

    Content-Security-Policy base-uri bypass

  * CVE-2022-40957 (bmo#1777604)

    Incoherent instruction cache when building WASM on ARM64

  * CVE-2022-40962 (bmo#1767360, bmo#1776655, bmo#1777574,

    bmo#1784835, bmo#1785109, bmo#1786502, bmo#1789440)

    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3

- requires

  NSS 3.82

  Rust 1.63 (1.61)

- removed obsolete mozilla-glibc236.patch

-------------------------------------------------------------------

Fri Sep  9 05:59:03 UTC 2022 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Adjust memory requirements to fix build on aarch64

-------------------------------------------------------------------

Wed Sep  7 06:50:24 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 104.0.2 (boo#1203177)

  https://www.mozilla.org/en-US/firefox/104.0.2/releasenotes/

  * Fixed a bug making it impossible to use touch or a stylus to

    drag the scrollbar on pages (bmo#1787361)

  * Fixed an issue causing some users to crash in out-of-memory

    conditions (bmo#1774155)

  * Fixed an issue that would sometimes affect video & audio playback

    when loaded via a cross-origin iframe src attribute (bmo#1781759)

  * Fixed an issue that would sometimes affect video & audio playback

    when served with Content-Security-Policy: sandbox (bmo#1781063)

-------------------------------------------------------------------

Thu Sep  1 07:04:11 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 104.0.1

  * Addresses an issue with Youtube video playback that was

    affecting some users (boo#1203003)

-------------------------------------------------------------------

Sun Aug 21 11:12:14 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 104.0

  * https://www.mozilla.org/en-US/firefox/104.0/releasenotes

  MFSA 2022-33 (bsc#1202645)

  * CVE-2022-38472 (bmo#1769155)

    Address bar spoofing via XSLT error handling

  * CVE-2022-38473 (bmo#1771685)

    Cross-origin XSLT Documents would have inherited the parent's

    permissions

  * CVE-2022-38474 (bmo#1719511)

    Recording notification not shown when microphone was

    recording on Android

  * CVE-2022-38475 (bmo#1773266)

    Attacker could write a value to a zero-length array

  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159, bmo#1773363)

    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2

  * CVE-2022-38478 (bmo#1770630, bmo#1776658)

    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,

    and Firefox ESR 91.13

- requires

  NSPR 4.34.1

  NSS 3.81

  rust 1.62

-------------------------------------------------------------------

Sat Aug 13 06:25:20 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- added mozilla-glibc236.patch (bmo#1782988, boo#1202323)

-------------------------------------------------------------------

Tue Aug  9 08:46:29 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 103.0.2

  * Fixed menu shortcuts for users of the JAWS screen reader

  * Fixed an occasional non-overridable certificate error when

    accessing device configuration pages

-------------------------------------------------------------------

Tue Aug  2 08:05:28 UTC 2022 - Andreas Schwab <schwab@suse.de>

- The --disable-elf-hack option only exists on ARM and X86

-------------------------------------------------------------------

Mon Aug  1 10:45:16 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 103.0.1

  * Enabled hardware acceleration on newer AMD cards.

  * Fixed a crash on Firefox shutdown caused by a bug in the

    audio manager

-------------------------------------------------------------------

Wed Jul 27 07:13:07 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 103.0

  https://www.mozilla.org/en-US/firefox/103.0/releasenotes

  MFSA 2022-28 (bsc#1201758)

  * CVE-2022-36319 (bmo#1737722)

    Mouse Position spoofing with CSS transforms

  * CVE-2022-36317 (bmo#1759951)

    Long URL would hang Firefox for Android

  * CVE-2022-36318 (bmo#1771774)

    Directory indexes for bundled resources reflected URL

    parameters

  * CVE-2022-36314 (bmo#1773894)

    Opening local <code>.lnk</code> files could cause unexpected

    network loads

  * CVE-2022-36315 (bmo#1762520)

    Preload Cache Bypasses Subresource Integrity

  * CVE-2022-36316 (bmo#1768583)

    Performance API leaked whether a cross-site resource is

    redirecting

  * CVE-2022-36320 (bmo#1759794, bmo#1760998)

    Memory safety bugs fixed in Firefox 103

  * CVE-2022-2505 (bmo#1769739, bmo#1772824)

    Memory safety bugs fixed in Firefox 103 and 102.1

- requires

  NSS >= 3.80

  rust = 1.61

  rust-cbindgen >= 0.24.3

-------------------------------------------------------------------

Wed Jul 13 07:54:21 UTC 2022 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Move %limit_build set before mozilla config to actually set the

  value of %jobs to MOZ_MAKE_FLAGS to fix build on aarch64

-------------------------------------------------------------------

Wed Jul  6 18:35:47 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Firefox 102.0.1:

  * Fixed: Fixed bookmarks sidebar flashing white when opened in

    dark mode (bmo#1776157)

  * Fixed: Fixed multilingual spell checking not working with

    content in both English and a non-Latin alphabet

    (bmo#1773802)

  * Fixed: Developer tools:  Fixed an issue where the console

    output keep getting scrolled to the bottom when the last

    visible message is an evaluation result (bmo#1776262)

  * Fixed: Fixed *Delete cookies and site data when Firefox is

    closed* checkbox getting disabled on startup (bmo#1777419)

  * Fixed: Various stability fixes

-------------------------------------------------------------------

Sat Jun 25 12:51:46 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Firefox 102.0

  * You can now disable automatic opening of the download panel

    every time a new download starts

  * Firefox now mitigates query parameter tracking when navigating

    sites in ETP strict mode

  * Improved security by moving audio decoding into a separate

    process with stricter sandboxing, thus improving process isolation

  * https://www.mozilla.org/en-US/firefox/102.0/releasenotes

  MFSA 2022-24 (bsc#1200793)

  * CVE-2022-34479 (bmo#1745595)

    A popup window could be resized in a way to overlay the

    address bar with web content

  * CVE-2022-34470 (bmo#1765951)

    Use-after-free in nsSHistory

  * CVE-2022-34468 (bmo#1768537)

    CSP sandbox header without `allow-scripts` can be bypassed

    via retargeted javascript: URI

  * CVE-2022-34482 (bmo#845880)

    Drag and drop of malicious image could have led to malicious

    executable and potential code execution

  * CVE-2022-34483 (bmo#1335845)

    Drag and drop of malicious image could have led to malicious

    executable and potential code execution

  * CVE-2022-34476 (bmo#1387919)

    ASN.1 parser could have been tricked into accepting malformed ASN.1

  * CVE-2022-34481 (bmo#1483699, bmo#1497246)

    Potential integer overflow in ReplaceElementsAt

  * CVE-2022-34474 (bmo#1677138)

    Sandboxed iframes could redirect to external schemes

  * CVE-2022-34469 (bmo#1721220)

    TLS certificate errors on HSTS-protected domains could be

    bypassed by the user on Firefox for Android

  * CVE-2022-34471 (bmo#1766047)

    Compromised server could trick a browser into an addon downgrade

  * CVE-2022-34472 (bmo#1770123)

    Unavailable PAC file resulted in OCSP requests being blocked

  * CVE-2022-34478 (bmo#1773717)

    Microsoft protocols can be attacked if a user accepts a prompt

  * CVE-2022-2200 (bmo#1771381)

    Undesired attributes could be set as part of prototype pollution

  * CVE-2022-34480 (bmo#1454072)

    Free of uninitialized pointer in lg_init

  * CVE-2022-34477 (bmo#1731614)

    MediaError message property leaked information on cross-

    origin same-site pages

  * CVE-2022-34475 (bmo#1757210)

    HTML Sanitizer could have been bypassed via same-origin

    script via use tags

  * CVE-2022-34473 (bmo#1770888)

    HTML Sanitizer could have been bypassed via use tags

  * CVE-2022-34484 (bmo#1763634, bmo#1772651)

    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11

  * CVE-2022-34485 (bmo#1768409, bmo#1768578)

    Memory safety bugs fixed in Firefox 102

- requires

  NSPR >= 4.34

  NSS >= 3.79

  rust = 1.60

- switch out skia-patches with webrender-patches for big endian

  removed:

  * mozilla-bmo1504834-part2.patch

  * mozilla-bmo1504834-part4.patch

  * mozilla-bmo1626236.patch

  added:

  * one_swizzle_to_rule_them_all.patch

  * svg-rendering.patch

- add some more returns to the no-return-patch

-------------------------------------------------------------------

Fri Jun 10 20:45:37 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 101.0.1:

  * Fixed context menus not appearing when right-clicking

    Picture-in-Picture windows on some Linux systems (bmo#1771914)

  * Various stability fixes

-------------------------------------------------------------------

Sun May 29 08:02:45 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 101.0

  * Reading is now easier with the prefers-contrast media query,

    which allows sites to detect if the user has requested that web

    content is presented with a higher (or lower) contrast

  * All non-configured MIME types can now be assigned a custom

    action upon download completion

  * allows users to use as many microphones as you want, at the

    same time, during video conferencing. The most exciting benefit

    is that you can easily switch your microphones at any time

    (if your conferencing service provider enables this flexibility)

  MFSA 2022-20 (bsc#1200027)

  * CVE-2022-31736 (bmo#1735923)

    Cross-Origin resource's length leaked

  * CVE-2022-31737 (bmo#1743767)

    Heap buffer overflow in WebGL

  * CVE-2022-31738 (bmo#1756388)

    Browser window spoof using fullscreen mode

  * CVE-2022-31739 (bmo#1765049)

    Attacker-influenced path traversal when saving downloaded files

  * CVE-2022-31740 (bmo#1766806)

    Register allocation problem in WASM on arm64

  * CVE-2022-31741 (bmo#1767590)

    Uninitialized variable leads to invalid memory read

  * CVE-2022-31742 (bmo#1730434)

    Querying a WebAuthn token with a large number of allowCredential

    entries may have leaked cross-origin information

  * CVE-2022-31743 (bmo#1747388)

    HTML Parsing incorrectly ended HTML comments prematurely

  * CVE-2022-31744 (bmo#1757604)

    CSP bypass enabling stylesheet injection

  * CVE-2022-31745 (bmo#1760944)

    Incorrect Assertion caused by unoptimized array shift operations

  * CVE-2022-1919 (bmo#1761275)

    Memory Corruption when manipulating webp images

  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,

    bmo#1767365, bmo#1768559, bmo#1768734)

    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10

  * CVE-2022-31748 (bmo#1713773, bmo#1762201, bmo#1762469,

    bmo#1762770, bmo#1764878, bmo#1765226, bmo#1765782, bmo#1765973,

    bmo#1767177, bmo#1767181, bmo#1768232, bmo#1768251, bmo#1769869)

    Memory safety bugs fixed in Firefox 101

- requires

  * NSS 3.78.1

  * rust-cbindgen 0.23.0

  * rust 1.59

-------------------------------------------------------------------

Fri May 20 15:03:50 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 100.0.2

  MFSA 2022-19 (bsc#1199768)

  * CVE-2022-1802 (bmo#1770137)

    Prototype pollution in Top-Level Await implementation

  * CVE-2022-1529 (bmo#1770048)

    Untrusted input used in JavaScript object indexing, leading

    to prototype pollution

-------------------------------------------------------------------

Wed May 18 20:27:49 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 100.0.1:

  * Fixed: Fixed an issue with subtitles in Picture-in-Picture

    mode while using Netflix (bmo#1768818)

  * Fixed: Fixed an issue where some commands were unavailable in

    the Picture-in-Picture window (bmo#1768201)

-------------------------------------------------------------------

Sun May  1 21:31:01 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 100.0

  * subtitle support in PiP

  * spell checking supports multiple languages in parallel

  * more details here

    https://www.mozilla.org/en-US/firefox/100.0/releasenotes

  MFSA 2022-16 (boo#1198970)

  * CVE-2022-29914 (bmo#1746448)

    Fullscreen notification bypass using popups

  * CVE-2022-29909 (bmo#1755081)

    Bypassing permission prompt in nested browsing contexts

  * CVE-2022-29916 (bmo#1760674)

    Leaking browser history with CSS variables

  * CVE-2022-29911 (bmo#1761981)

    iframe Sandbox bypass

  * CVE-2022-29912 (bmo#1692655)

    Reader mode bypassed SameSite cookies

  * CVE-2022-29910 (bmo#1757138)

    Firefox for Android forgot HTTP Strict Transport Security

    settings

  * CVE-2022-29915 (bmo#1751678)

    Leaking cross-origin redirect through the Performance API

  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,

    bmo#1762614, bmo#1762620, bmo#1764778)

    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9

  * CVE-2022-29918 (bmo#1744043, bmo#1747178, bmo#1753535,

    bmo#1754017, bmo#1755847, bmo#1756172, bmo#1757477,

    bmo#1758223, bmo#1760160, bmo#1761481, bmo#1761771)

    Memory safety bugs fixed in Firefox 100

- requires NSS 3.77

-------------------------------------------------------------------

Tue Apr 12 19:30:30 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 99.0.1

  * Fixed an issue with text rendering in Bengali (bmo#1763368)

  * Fixed a selection issue in the Download panel with drag and

    drop (bmo#1762723)

  * Fixed: Fixed an issue preventing Zoom gallery mode for users

    who go to zoom.us URLs instead of subdomain.zoom.us URLs

    (bmo#1763801)

-------------------------------------------------------------------

Mon Apr  4 07:34:36 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 99.0

  * You can now toggle Narrate in ReaderMode with the keyboard

    shortcut "n."

  * You can find added support for search—with or without

    diacritics—in the PDF viewer.

  * The Linux sandbox has been strengthened: processes exposed to web

    content no longer have access to the X Window system (X11).

  * Firefox now supports credit card autofill and capture in

    Germany and France.

  MFSA 2022-13 (bsc#1197903)

  * CVE-2022-1097 (bmo#1745667)

    Use-after-free in NSSToken objects

  * CVE-2022-28281 (bmo#1755621)

    Out of bounds write due to unexpected WebAuthN Extensions

  * CVE-2022-28282 (bmo#1751609)

    Use-after-free in DocumentL10n::TranslateDocument

  * CVE-2022-28283 (bmo#1754066)

    Missing security checks for fetching sourceMapURL

  * CVE-2022-28284 (bmo#1754522)

    Script could be executed via svg's use element

  * CVE-2022-28285 (bmo#1756957)

    Incorrect AliasSet used in JIT Codegen

  * CVE-2022-28286 (bmo#1735265)

    iframe contents could be rendered outside the border

  * CVE-2022-28287 (bmo#1741515)

    Text Selection could crash Firefox

  * CVE-2022-24713 (bmo#1758509)

    Denial of Service via complex regular expressions

  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,

    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)

    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8

  * CVE-2022-28288 (bmo#1746415, bmo#1746495, bmo#1746500,

    bmo#1747282, bmo#1748759, bmo#1749056, bmo#1749786,

    bmo#1751679, bmo#1752120, bmo#1756010, bmo#1756017,

    bmo#1757213, bmo#1757258, bmo#1757427)

    Memory safety bugs fixed in Firefox 99

- requires NSS >= 3.76.1

- remove obsolete patch

  * mozilla-bmo1756347.patch

  * mozilla-bmo1757571.patch

- update create-tar.sh

-------------------------------------------------------------------

Thu Mar 24 21:49:57 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- MozillaFirefox 98.0.2: