-------------------------------------------------------------------

Sat Aug 13 06:25:20 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- added mozilla-glibc236.patch (bmo#1782988, boo#1202323)

-------------------------------------------------------------------

Tue Aug  9 08:46:29 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 103.0.2

  * Fixed menu shortcuts for users of the JAWS screen reader

  * Fixed an occasional non-overridable certificate error when

    accessing device configuration pages

-------------------------------------------------------------------

Tue Aug  2 08:05:28 UTC 2022 - Andreas Schwab <schwab@suse.de>

- The --disable-elf-hack option only exists on ARM and X86

-------------------------------------------------------------------

Mon Aug  1 10:45:16 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 103.0.1

  * Enabled hardware acceleration on newer AMD cards.

  * Fixed a crash on Firefox shutdown caused by a bug in the

    audio manager

-------------------------------------------------------------------

Wed Jul 27 07:13:07 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 103.0

  https://www.mozilla.org/en-US/firefox/103.0/releasenotes

  MFSA 2022-28 (bsc#1201758)

  * CVE-2022-36319 (bmo#1737722)

    Mouse Position spoofing with CSS transforms

  * CVE-2022-36317 (bmo#1759951)

    Long URL would hang Firefox for Android

  * CVE-2022-36318 (bmo#1771774)

    Directory indexes for bundled resources reflected URL

    parameters

  * CVE-2022-36314 (bmo#1773894)

    Opening local <code>.lnk</code> files could cause unexpected

    network loads

  * CVE-2022-36315 (bmo#1762520)

    Preload Cache Bypasses Subresource Integrity

  * CVE-2022-36316 (bmo#1768583)

    Performance API leaked whether a cross-site resource is

    redirecting

  * CVE-2022-36320 (bmo#1759794, bmo#1760998)

    Memory safety bugs fixed in Firefox 103

  * CVE-2022-2505 (bmo#1769739, bmo#1772824)

    Memory safety bugs fixed in Firefox 103 and 102.1

- requires

  NSS >= 3.80

  rust = 1.61

  rust-cbindgen >= 0.24.3

-------------------------------------------------------------------

Wed Jul 13 07:54:21 UTC 2022 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Move %limit_build set before mozilla config to actually set the

  value of %jobs to MOZ_MAKE_FLAGS to fix build on aarch64

-------------------------------------------------------------------

Wed Jul  6 18:35:47 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Firefox 102.0.1:

  * Fixed: Fixed bookmarks sidebar flashing white when opened in

    dark mode (bmo#1776157)

  * Fixed: Fixed multilingual spell checking not working with

    content in both English and a non-Latin alphabet

    (bmo#1773802)

  * Fixed: Developer tools:  Fixed an issue where the console

    output keep getting scrolled to the bottom when the last

    visible message is an evaluation result (bmo#1776262)

  * Fixed: Fixed *Delete cookies and site data when Firefox is

    closed* checkbox getting disabled on startup (bmo#1777419)

  * Fixed: Various stability fixes

-------------------------------------------------------------------

Sat Jun 25 12:51:46 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Firefox 102.0

  * You can now disable automatic opening of the download panel

    every time a new download starts

  * Firefox now mitigates query parameter tracking when navigating

    sites in ETP strict mode

  * Improved security by moving audio decoding into a separate

    process with stricter sandboxing, thus improving process isolation

  * https://www.mozilla.org/en-US/firefox/102.0/releasenotes

  MFSA 2022-24 (bsc#1200793)

  * CVE-2022-34479 (bmo#1745595)

    A popup window could be resized in a way to overlay the

    address bar with web content

  * CVE-2022-34470 (bmo#1765951)

    Use-after-free in nsSHistory

  * CVE-2022-34468 (bmo#1768537)

    CSP sandbox header without `allow-scripts` can be bypassed

    via retargeted javascript: URI

  * CVE-2022-34482 (bmo#845880)

    Drag and drop of malicious image could have led to malicious

    executable and potential code execution

  * CVE-2022-34483 (bmo#1335845)

    Drag and drop of malicious image could have led to malicious

    executable and potential code execution

  * CVE-2022-34476 (bmo#1387919)

    ASN.1 parser could have been tricked into accepting malformed ASN.1

  * CVE-2022-34481 (bmo#1483699, bmo#1497246)

    Potential integer overflow in ReplaceElementsAt

  * CVE-2022-34474 (bmo#1677138)

    Sandboxed iframes could redirect to external schemes

  * CVE-2022-34469 (bmo#1721220)

    TLS certificate errors on HSTS-protected domains could be

    bypassed by the user on Firefox for Android

  * CVE-2022-34471 (bmo#1766047)

    Compromised server could trick a browser into an addon downgrade

  * CVE-2022-34472 (bmo#1770123)

    Unavailable PAC file resulted in OCSP requests being blocked

  * CVE-2022-34478 (bmo#1773717)

    Microsoft protocols can be attacked if a user accepts a prompt

  * CVE-2022-2200 (bmo#1771381)

    Undesired attributes could be set as part of prototype pollution

  * CVE-2022-34480 (bmo#1454072)

    Free of uninitialized pointer in lg_init

  * CVE-2022-34477 (bmo#1731614)

    MediaError message property leaked information on cross-

    origin same-site pages

  * CVE-2022-34475 (bmo#1757210)

    HTML Sanitizer could have been bypassed via same-origin

    script via use tags

  * CVE-2022-34473 (bmo#1770888)

    HTML Sanitizer could have been bypassed via use tags

  * CVE-2022-34484 (bmo#1763634, bmo#1772651)

    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11

  * CVE-2022-34485 (bmo#1768409, bmo#1768578)

    Memory safety bugs fixed in Firefox 102

- requires

  NSPR >= 4.34

  NSS >= 3.79

  rust = 1.60

- switch out skia-patches with webrender-patches for big endian

  removed:

  * mozilla-bmo1504834-part2.patch

  * mozilla-bmo1504834-part4.patch

  * mozilla-bmo1626236.patch

  added:

  * one_swizzle_to_rule_them_all.patch

  * svg-rendering.patch

- add some more returns to the no-return-patch

-------------------------------------------------------------------

Fri Jun 10 20:45:37 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 101.0.1:

  * Fixed context menus not appearing when right-clicking

    Picture-in-Picture windows on some Linux systems (bmo#1771914)

  * Various stability fixes

-------------------------------------------------------------------

Sun May 29 08:02:45 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 101.0

  * Reading is now easier with the prefers-contrast media query,

    which allows sites to detect if the user has requested that web

    content is presented with a higher (or lower) contrast

  * All non-configured MIME types can now be assigned a custom

    action upon download completion

  * allows users to use as many microphones as you want, at the

    same time, during video conferencing. The most exciting benefit

    is that you can easily switch your microphones at any time

    (if your conferencing service provider enables this flexibility)

  MFSA 2022-20 (bsc#1200027)

  * CVE-2022-31736 (bmo#1735923)

    Cross-Origin resource's length leaked

  * CVE-2022-31737 (bmo#1743767)

    Heap buffer overflow in WebGL

  * CVE-2022-31738 (bmo#1756388)

    Browser window spoof using fullscreen mode

  * CVE-2022-31739 (bmo#1765049)

    Attacker-influenced path traversal when saving downloaded files

  * CVE-2022-31740 (bmo#1766806)

    Register allocation problem in WASM on arm64

  * CVE-2022-31741 (bmo#1767590)

    Uninitialized variable leads to invalid memory read

  * CVE-2022-31742 (bmo#1730434)

    Querying a WebAuthn token with a large number of allowCredential

    entries may have leaked cross-origin information

  * CVE-2022-31743 (bmo#1747388)

    HTML Parsing incorrectly ended HTML comments prematurely

  * CVE-2022-31744 (bmo#1757604)

    CSP bypass enabling stylesheet injection

  * CVE-2022-31745 (bmo#1760944)

    Incorrect Assertion caused by unoptimized array shift operations

  * CVE-2022-1919 (bmo#1761275)

    Memory Corruption when manipulating webp images

  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,

    bmo#1767365, bmo#1768559, bmo#1768734)

    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10

  * CVE-2022-31748 (bmo#1713773, bmo#1762201, bmo#1762469,

    bmo#1762770, bmo#1764878, bmo#1765226, bmo#1765782, bmo#1765973,

    bmo#1767177, bmo#1767181, bmo#1768232, bmo#1768251, bmo#1769869)

    Memory safety bugs fixed in Firefox 101

- requires

  * NSS 3.78.1

  * rust-cbindgen 0.23.0

  * rust 1.59

-------------------------------------------------------------------

Fri May 20 15:03:50 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 100.0.2

  MFSA 2022-19 (bsc#1199768)

  * CVE-2022-1802 (bmo#1770137)

    Prototype pollution in Top-Level Await implementation

  * CVE-2022-1529 (bmo#1770048)

    Untrusted input used in JavaScript object indexing, leading

    to prototype pollution

-------------------------------------------------------------------

Wed May 18 20:27:49 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 100.0.1:

  * Fixed: Fixed an issue with subtitles in Picture-in-Picture

    mode while using Netflix (bmo#1768818)

  * Fixed: Fixed an issue where some commands were unavailable in

    the Picture-in-Picture window (bmo#1768201)

-------------------------------------------------------------------

Sun May  1 21:31:01 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 100.0

  * subtitle support in PiP

  * spell checking supports multiple languages in parallel

  * more details here

    https://www.mozilla.org/en-US/firefox/100.0/releasenotes

  MFSA 2022-16 (boo#1198970)

  * CVE-2022-29914 (bmo#1746448)

    Fullscreen notification bypass using popups

  * CVE-2022-29909 (bmo#1755081)

    Bypassing permission prompt in nested browsing contexts

  * CVE-2022-29916 (bmo#1760674)

    Leaking browser history with CSS variables

  * CVE-2022-29911 (bmo#1761981)

    iframe Sandbox bypass

  * CVE-2022-29912 (bmo#1692655)

    Reader mode bypassed SameSite cookies

  * CVE-2022-29910 (bmo#1757138)

    Firefox for Android forgot HTTP Strict Transport Security

    settings

  * CVE-2022-29915 (bmo#1751678)

    Leaking cross-origin redirect through the Performance API

  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,

    bmo#1762614, bmo#1762620, bmo#1764778)

    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9

  * CVE-2022-29918 (bmo#1744043, bmo#1747178, bmo#1753535,

    bmo#1754017, bmo#1755847, bmo#1756172, bmo#1757477,

    bmo#1758223, bmo#1760160, bmo#1761481, bmo#1761771)

    Memory safety bugs fixed in Firefox 100

- requires NSS 3.77

-------------------------------------------------------------------

Tue Apr 12 19:30:30 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 99.0.1

  * Fixed an issue with text rendering in Bengali (bmo#1763368)

  * Fixed a selection issue in the Download panel with drag and

    drop (bmo#1762723)

  * Fixed: Fixed an issue preventing Zoom gallery mode for users

    who go to zoom.us URLs instead of subdomain.zoom.us URLs

    (bmo#1763801)

-------------------------------------------------------------------

Mon Apr  4 07:34:36 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 99.0

  * You can now toggle Narrate in ReaderMode with the keyboard

    shortcut "n."

  * You can find added support for search—with or without

    diacritics—in the PDF viewer.

  * The Linux sandbox has been strengthened: processes exposed to web

    content no longer have access to the X Window system (X11).

  * Firefox now supports credit card autofill and capture in

    Germany and France.

  MFSA 2022-13 (bsc#1197903)

  * CVE-2022-1097 (bmo#1745667)

    Use-after-free in NSSToken objects

  * CVE-2022-28281 (bmo#1755621)

    Out of bounds write due to unexpected WebAuthN Extensions

  * CVE-2022-28282 (bmo#1751609)

    Use-after-free in DocumentL10n::TranslateDocument

  * CVE-2022-28283 (bmo#1754066)

    Missing security checks for fetching sourceMapURL

  * CVE-2022-28284 (bmo#1754522)

    Script could be executed via svg's use element

  * CVE-2022-28285 (bmo#1756957)

    Incorrect AliasSet used in JIT Codegen

  * CVE-2022-28286 (bmo#1735265)

    iframe contents could be rendered outside the border

  * CVE-2022-28287 (bmo#1741515)

    Text Selection could crash Firefox

  * CVE-2022-24713 (bmo#1758509)

    Denial of Service via complex regular expressions

  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,

    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)

    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8

  * CVE-2022-28288 (bmo#1746415, bmo#1746495, bmo#1746500,

    bmo#1747282, bmo#1748759, bmo#1749056, bmo#1749786,

    bmo#1751679, bmo#1752120, bmo#1756010, bmo#1756017,

    bmo#1757213, bmo#1757258, bmo#1757427)

    Memory safety bugs fixed in Firefox 99

- requires NSS >= 3.76.1

- remove obsolete patch

  * mozilla-bmo1756347.patch

  * mozilla-bmo1757571.patch

- update create-tar.sh

-------------------------------------------------------------------

Thu Mar 24 21:49:57 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- MozillaFirefox 98.0.2:

  * Fixed: Fixed an issue preventing users from typing in Address

    Bar after opening new tab and pressing cmd + enter

    (bmo#1757376)

  * Fixed: Fixed an issue causing some users to crash in out-of-

    memory conditions (bmo#1757618)

  * Fixed: Fixed an issue in session history which caused some

    sites to fail to load (bmo#1758664)

  * Fixed: Fixed an add-on specific compatibility issue

    (bmo#1759162)

-------------------------------------------------------------------

Wed Mar 23 15:14:22 UTC 2022 - Simon Vogl <simon.vogl@gmx.net>

- Change mozilla-kde.patch to follow the GNOME registry

  behavior for new MIME types to avoid opening downloaded files

  without any inquiries (bsc#1197319)

-------------------------------------------------------------------

Tue Mar 22 12:22:51 UTC 2022 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Add patch to fix start-up on aarch64:

  * mozilla-bmo1757571.patch

-------------------------------------------------------------------

Thu Mar 17 14:52:39 UTC 2022 - Dirk Müller <dmueller@suse.com>

- exclude slow cpus for building

-------------------------------------------------------------------

Thu Mar 17 09:18:01 UTC 2022 - Martin Sirringhaus <martin.sirringhaus@suse.com>

- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,

  faster buildhosts, as the others struggle to build FF.

-------------------------------------------------------------------

Mon Mar 14 22:48:42 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 98.0.1:

  * Yandex and Mail.ru have been removed as optional search

    providers in the drop-down search menu in Firefox

-------------------------------------------------------------------

Tue Mar  8 10:27:16 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 98.0

  * Firefox has a new optimized download flow

  * other changes as documented here

    https://www.mozilla.org/en-US/firefox/98.0/releasenotes

  MFSA 2022-10 (bsc#1196900)

  * CVE-2022-26383 (bmo#1742421)

    Browser window spoof using fullscreen mode

  * CVE-2022-26384 (bmo#1744352)

    iframe allow-scripts sandbox bypass

  * CVE-2022-26387 (bmo#1752979)

    Time-of-check time-of-use bug when verifying add-on signatures

  * CVE-2022-26381 (bmo#1736243)

    Use-after-free in text reflows

  * CVE-2022-26382 (bmo#1741888)

    Autofill Text could be exfiltrated via side-channel attacks

  * CVE-2022-26385 (bmo#1747526)

    Use-after-free in thread shutdown

  * CVE-2022-0843 (bmo#1746523, bmo#1749062, bmo#1749164, bmo#1749214,

    bmo#1749610, bmo#1750032, bmo#1752100, bmo#1752405, bmo#1753612,

    bmo#1754508)

    Memory safety bugs fixed in Firefox 98

- requires NSS 3.75

- add mozilla-bmo1756347.patch to fix i586 build

-------------------------------------------------------------------

Fri Feb 18 20:38:22 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 97.0.1

  * Fixed: Fixed an issue where TikTok videos would fail to load

    when selected from a user's profile page (bmo#1750973)

  * Fixed: Fixed an issue which led to Picture-in-Picture mode

    being unable to be toggled on Hulu (bmo#1753401)

  * Fixed: Works around problems with WebRoot SecureAnywhere

    antivirus rendering Firefox unusable in some situations

    (bmo#1752466)

  * Fixed: Fixed an issue causing users to see the Restore

    Session screen unexpectedly when starting Firefox

    (bmo#1749996)

-------------------------------------------------------------------

Mon Feb 14 19:31:29 UTC 2022 - Luciano Santos <luc14n0@opensuse.org>

- Remove bashisms ("source" and "function" keywords) from

  mozilla.sh.in to ally with the #!/bin/sh shebang. If the end user

  has either dash-sh package or busybox-sh to handle Bourn Shell

  scripts rather than having bash-sh package, the script would

  fail. Using "." instead of "source" and "create_langpack_link()"

  function definition is enough to keep both sides sane,

  behavior-wise.

-------------------------------------------------------------------

Tue Feb  8 08:40:45 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 97.0

  MFSA 2022-04 (bsc#1195682)

  * CVE-2022-22753 (bmo#1732435)

    Privilege Escalation to SYSTEM on Windows via Maintenance Service

  * CVE-2022-22754 (bmo#1750565)

    Extensions could have bypassed permission confirmation during update

  * CVE-2022-22755 (bmo#1309630)

    XSL could have allowed JavaScript execution after a tab was closed

  * CVE-2022-22756 (bmo#1317873)

    Drag and dropping an image could have resulted in the dropped

    object being an executable

  * CVE-2022-22757 (bmo#1720098)

    Remote Agent did not prevent local websites from connecting

  * CVE-2022-22758 (bmo#1728742)

    tel: links could have sent USSD codes to the dialer on

    Firefox for Android

  * CVE-2022-22759 (bmo#1739957)

    Sandboxed iframes could have executed script if the parent

    appended elements

  * CVE-2022-22760 (bmo#1740985, bmo#1748503)

    Cross-Origin responses could be distinguished between script

    and non-script content-types

  * CVE-2022-22761 (bmo#1745566)

    frame-ancestors Content Security Policy directive was not

    enforced for framed extension pages

  * CVE-2022-22762 (bmo#1743931)

    JavaScript Dialogs could have been displayed over other