-------------------------------------------------------------------

Sun Dec 13 18:18:58 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 84.0

  * Firefox 84 is the final release to support Adobe Flash

  * WebRender is enabled by default when run on GNOME-based X11

    Linux desktops

  MFSA 2020-54 (bsc#1180039))

  * CVE-2020-16042 (bmo#1679003)

    Operations on a BigInt could have caused uninitialized memory

    to be exposed

  * CVE-2020-26971 (bmo#1663466)

    Heap buffer overflow in WebGL

  * CVE-2020-26972 (bmo#1671382)

    Use-After-Free in WebGL

  * CVE-2020-26973 (bmo#1680084)

    CSS Sanitizer performed incorrect sanitization

  * CVE-2020-26974 (bmo#1681022)

    Incorrect cast of StyleGenericFlexBasis resulted in a heap

    use-after-free

  * CVE-2020-26975 (bmo#1661071)

    Malicious applications on Android could have induced Firefox

    for Android into sending arbitrary attacker-specified headers

  * CVE-2020-26976 (bmo#1674343)

    HTTPS pages could have been intercepted by a registered

    service worker when they should not have been

  * CVE-2020-26977 (bmo#1676311)

    URL spoofing via unresponsive port in Firefox for Android

  * CVE-2020-26978 (bmo#1677047)

    Internal network hosts could have been probed by a malicious

    webpage

  * CVE-2020-26979 (bmo#1641287, bmo#1673299)

    When entering an address in the address or search bars, a

    website could have redirected the user before they were

    navigated to the intended url

  * CVE-2020-35111 (bmo#1657916)

    The proxy.onRequest API did not catch view-source URLs

  * CVE-2020-35112 (bmo#1661365)

    Opening an extension-less download may have inadvertently

    launched an executable instead

  * CVE-2020-35113 (bmo#1664831, bmo#1673589)

    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6

  * CVE-2020-35114 (bmo#1607449, bmo#1640416, bmo#1656459,

    bmo#1669914, bmo#1673567)

    Memory safety bugs fixed in Firefox 84

- requires

  NSS >= 3.59

  rust >= 1.44

  rust-cbindgen >= 0.15.0

- remove revert-795c8762b16b.patch and replace with mozilla-pgo.patch

-------------------------------------------------------------------

Sat Nov 21 08:12:17 UTC 2020 - Kirill Kirillov <kkirill@opensuse.org>

- Add/Enable GNOME search provider

-------------------------------------------------------------------

Sun Nov 15 12:16:53 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 83.0

  * major update for SpiderMonkey improving performance significantly

  * optional HTTPS-Only mode

  * more improvements

    https://www.mozilla.org/en-US/firefox/83.0/releasenotes/

  MFSA 2020-50 (bsc#1178824))

  * CVE-2020-26951 (bmo#1667113)

    Parsing mismatches could confuse and bypass security

    sanitizer for chrome privileged code

  * CVE-2020-26952 (bmo#1667685)

    Out of memory handling of JITed, inlined functions could lead

    to a memory corruption

  * CVE-2020-16012 (bmo#1642028)

    Variable time processing of cross-origin images during

    drawImage calls

  * CVE-2020-26953 (bmo#1656741)

    Fullscreen could be enabled without displaying the security UI

  * CVE-2020-26954 (bmo#1657026)

    Local spoofing of web manifests for arbitrary pages in

    Firefox for Android

  * CVE-2020-26955 (bmo#1663261)

    Cookies set during file downloads are shared between normal

    and Private Browsing Mode in Firefox for Android

  * CVE-2020-26956 (bmo#1666300)

    XSS through paste (manual and clipboard API)

  * CVE-2020-26957 (bmo#1667179)

    OneCRL was not working in Firefox for Android

  * CVE-2020-26958 (bmo#1669355)

    Requests intercepted through ServiceWorkers lacked MIME type

    restrictions

  * CVE-2020-26959 (bmo#1669466)

    Use-after-free in WebRequestService

  * CVE-2020-26960 (bmo#1670358)

    Potential use-after-free in uses of nsTArray

  * CVE-2020-15999 (bmo#1672223)

    Heap buffer overflow in freetype

  * CVE-2020-26961 (bmo#1672528)

    DoH did not filter IPv4 mapped IP Addresses

  * CVE-2020-26962 (bmo#610997)

    Cross-origin iframes supported login autofill

  * CVE-2020-26963 (bmo#1314912)

    History and Location interfaces could have been used to hang

    the browser

  * CVE-2020-26964 (bmo#1658865)

    Firefox for Android's Remote Debugging via USB could have

    been abused by untrusted apps on older versions of Android

  * CVE-2020-26965 (bmo#1661617)

    Software keyboards may have remembered typed passwords

  * CVE-2020-26966 (bmo#1663571)

    Single-word search queries were also broadcast to local

    network

  * CVE-2020-26967 (bmo#1665820)

    Mutation Observers could break or confuse Firefox Screenshots

    feature

  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,

    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,

    bmo#1671923)

    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5

  * CVE-2020-26969 (bmo#1623920, bmo#1651705, bmo#1667872,

    bmo#1668876)

    Memory safety bugs fixed in Firefox 83

- requires

  NSS >= 3.58

  nodejs >= 10.22.1

- removed obsolete mozilla-ppc-altivec_static_inline.patch

- disable LTO on TW because of ICEs in gcc

-------------------------------------------------------------------

Mon Nov  9 10:15:52 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 82.0.3

  MSFA 2020-49

  * CVE-2020-26950 (bmo#1675905)

    Write side effects in MCallGetProperty opcode not accounted for

-------------------------------------------------------------------

Mon Nov  2 09:00:13 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 82.0.2

  * few bugfixes for introduced regressions

-------------------------------------------------------------------

Sun Nov  1 20:15:17 UTC 2020 - Kirill Kirillov <kkirill@opensuse.org>

- Enable GNOME search provider

-------------------------------------------------------------------

Thu Oct 15 20:44:47 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 82.0

  * https://www.mozilla.org/en-US/firefox/82.0/releasenotes/

  MFSA 2020-45 (bsc#1177872)

  * CVE-2020-15969 (bmo#1666570)

    Use-after-free in usersctp

  * CVE-2020-15254 (bmo#1668514)

    Undefined behavior in bounded channel of crossbeam rust crate

  * CVE-2020-15680 (bmo#1658881)

    Presence of external protocol handlers could be determined

    through image tags

  * CVE-2020-15681 (bmo#1666568)

    Multiple WASM threads may have overwritten each others' stub

    table entries

  * CVE-2020-15682 (bmo#1636654)

    The domain associated with the prompt to open an external

    protocol could be spoofed to display the incorrect origin

  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,

    bmo#1662760, bmo#1663439, bmo#1666140)

    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4

  * CVE-2020-15684 (bmo#1653764, bmo#1661402, bmo#1662259,

    bmo#1664257)

    Memory safety bugs fixed in Firefox 82

- requires

  * NSPR 4.29

  * NSS 3.57

-------------------------------------------------------------------

Thu Oct  1 20:00:27 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 81.0.1

  * https://www.mozilla.org/en-US/firefox/81.0.1/releasenotes/

- remove obsolete python2 build requires

-------------------------------------------------------------------

Wed Sep 30 18:49:10 UTC 2020 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Increase disk requirements in _constraints to match current needs

-------------------------------------------------------------------

Fri Sep 18 06:22:40 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 81.0

  * https://www.mozilla.org/en-US/firefox/81.0/releasenotes

  MFSA 2020-42 (bsc#1176756)

  * CVE-2020-15675 (bmo#1654211)

    Use-After-Free in WebGL

  * CVE-2020-15677 (bmo#1641487)

    Download origin spoofing via redirect

  * CVE-2020-15676 (bmo#1646140)

    XSS when pasting attacker-controlled data into a

    contenteditable element

  * CVE-2020-15678 (bmo#1660211)

    When recursing through layers while scrolling, an iterator

    may have become invalid, resulting in a potential use-after-

    free scenario

  * CVE-2020-15673 (bmo#1648493, bmo#1660800)

    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3

  * CVE-2020-15674 (bmo#1656063, bmo#1656064, bmo#1656067, bmo#1660293)

    Memory safety bugs fixed in Firefox 81

- requires

  NSPR 4.28

  NSS 3.56

- removed obsolete patches

  * mozilla-system-nspr.patch

  * mozilla-bmo1661715.patch

  * mozilla-silence-no-return-type.patch

- skip post-build-checks for 15.0 and 15.1

- add revert-795c8762b16b.patch to fix LTO builds with gcc

  (related to bmo#1644409)

- require python3-curses as workaround to fix i586 build

-------------------------------------------------------------------

Thu Sep 17 11:45:31 UTC 2020 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Use %limit_build macro again for aarch64 and armv7, instead of

  the new memoryperjob _constraints to use more workers

-------------------------------------------------------------------

Sat Sep  5 17:43:26 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- add mozilla-bmo1661715.patch to fix Flash plugin

-------------------------------------------------------------------

Wed Sep  2 17:11:19 UTC 2020 - Manfred Hollstein <manfred.h@gmx.net>

- Mozilla Firefox 80.0.1: Bug fixes:

  * Fixed a performance regression when encountering new intermediate

    CA certificates (bmo#1661543)

  * Fixed crashes possibly related to GPU resets (bmo#1627616)

  * Fixed rendering on some sites using WebGL (bmo#1659225)

  * Fixed the zoom-in keyboard shortcut on Japanese language builds

    (bmo#1661895)

  * Fixed download issues related to extensions and cookies

    (bmo#1655190)

- added mozilla-silence-no-return-type.patch

-------------------------------------------------------------------

Tue Aug 25 19:30:15 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- more whitelisting (/dev/random) for sandbox in relation to FIPS

  (bsc#1174284)

- improve langpack builds to use dedicated objdirs and make it

  parallel again

-------------------------------------------------------------------

Sat Aug 22 06:52:01 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 80.0

  MFSA 2020-36 (bsc#1175686)

  * CVE-2020-15663 (bmo#1643199)

    Downgrade attack on the Mozilla Maintenance Service could

    have resulted in escalation of privilege

  * CVE-2020-15664 (bmo#1658214)

    Attacker-induced prompt for extension installation

  * CVE-2020-12401 (bmo#1631573)

    Timing-attack on ECDSA signature generation

  * CVE-2020-6829 (bmo#1631583)

    P-384 and P-521 vulnerable to an electro-magnetic side

    channel attack on signature generation

  * CVE-2020-12400 (bmo#1623116)

    P-384 and P-521 vulnerable to a side channel attack on

    modular inversion

  * CVE-2020-15665 (bmo#1651636)

    Address bar not reset when choosing to stay on a page after

    the beforeunload dialog is shown

  * CVE-2020-15666 (bmo#1450853)

    MediaError message property leaks cross-origin response

    status

  * CVE-2020-15667 (bmo#1653371)

    Heap overflow when processing an update file

  * CVE-2020-15668 (bmo#1651520)

    Data Race when reading certificate information

  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,

    bmo#1656957)

    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2

- requires

  * NSPR 4.27

  * NSS 3.55

- added mozilla-system-nspr.patch (bmo#1661096)

- exclude ga-IE locale as it's failing to build

- rollback parallelize locale build because it breaks bookmarks

  (boo#1167976)

- preserve original default bookmark file during langpack build

  (boo#1167976)

- add some ccache output during build

-------------------------------------------------------------------

Thu Aug 20 13:07:33 UTC 2020 - Martin Liška <mliska@suse.cz>

- Use new memoryperjob _constraints instead of %limit_build macro.

-------------------------------------------------------------------

Mon Aug 10 09:19:38 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- use ccache for build

- replace versioned RPM deps with requires_ge

- parallelize locale build

-------------------------------------------------------------------

Thu Aug  6 14:37:16 UTC 2020 - Yunhe Guo <i@guoyunhe.me>

- Change *.appdata.xml location to latest AppStream standard

-------------------------------------------------------------------

Thu Jul 23 21:00:34 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 79.0

  MFSA 2020-30 (bsc#1174538)

  * CVE-2020-15652 (bmo#1634872)

    Potential leak of redirect targets when loading scripts in a worker

  * CVE-2020-6514 (bmo#1642792)

    WebRTC data channel leaks internal address to peer

  * CVE-2020-15655 (bmo#1645204)

    Extension APIs could be used to bypass Same-Origin Policy

  * CVE-2020-15653 (bmo#1521542)

    Bypassing iframe sandbox when allowing popups

  * CVE-2020-6463 (bmo#1635293)

    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture

  * CVE-2020-15656 (bmo#1647293)

    Type confusion for special arguments in IonMonkey

  * CVE-2020-15658 (bmo#1637745)

    Overriding file type when saving to disk

  * CVE-2020-15657 (bmo#1644954)

    DLL hijacking due to incorrect loading path

  * CVE-2020-15654 (bmo#1648333)

    Custom cursor can overlay user interface

  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1638856,

    bmo#1643613, bmo#1644839, bmo#1645835, bmo#1646006, bmo#1646220,

    bmo#1646787, bmo#1649347, bmo#1650811, bmo#1651678)

    Memory safety bugs fixed in Firefox 79

- updated dependency requirements:

  * mozilla-nspr >= 4.26

  * mozilla-nss >= 3.54

  * rust >= 1.43

  * rust-cbindgen >= 0.14.3

- removed obsolete patch

  mozilla-bmo1463035.patch

-------------------------------------------------------------------

Tue Jul 21 21:31:20 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- fixed syntax issue in desktop file (boo#1174360)

-------------------------------------------------------------------

Fri Jul 17 15:07:45 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Add mozilla-libavcodec58_91.patch to link against updated

  soversion of libavcodec (58.91) with ffmpeg >= 4.3.

  (patch provided by Atri Bhattacharya <badshah400@gmail.com>

- enable MOZ_USE_XINPUT2 for TW (again) (boo#1173320)

  (Plasma 5.19.3 is now in TW)

-------------------------------------------------------------------

Sat Jul 11 11:08:06 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 78.0.2

  * Fixed an accessibility regression in reader mode (bmo#1650922)

  * Made the address bar more resilient to data corruption in the

    user profile (bmo#1649981)

  * Fixed a regression opening certain external applications (bmo#1650162)

  MFSA 2020-28

  * CVE pending (bmo#1644076)

    X-Frame-Options bypass using object or embed tags

- added desktop file actions

- do not use XINPUT2 for the moment until Plasma 5.19.3 has landed

  (boo#1173993)

- rework langpack integration (boo#1173991)

  * ship XPIs instead of directories

  * allow addon sideloading

  * mark signatures for langpacks non-mandatory

  * do not autodisable user profile scopes

- Google API key is not usable for geolocation service

- fix pipewire support for TW (boo#1172903)

-------------------------------------------------------------------

Wed Jul  1 07:15:02 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 78.0.1

  * Fixed an issue which could cause installed search engines to not

    be visible when upgrading from a previous release.

- enable MOZ_USE_XINPUT2 for TW (boo#1173320)

-------------------------------------------------------------------

Sun Jun 28 07:17:13 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 78.0

  * startup notifications now using Gtk instead of libnotify

  * PDF downloads now show an option to open the PDF directly in Firefox

  * Protections Dashboard (about:protections)

  * WebRTC not interrupted by screensaver anymore

  * disabled TLS 1.0 and 1.1 by default

  MFSA 2020-24 (bsc#1173576)

  * CVE-2020-12415 (bmo#1586630)

    AppCache manifest poisoning due to url encoded character processing

  * CVE-2020-12416 (bmo#1639734)

    Use-after-free in WebRTC VideoBroadcaster

  * CVE-2020-12417 (bmo#1640737)

    Memory corruption due to missing sign-extension for ValueTags

    on ARM64

  * CVE-2020-12418 (bmo#1641303)

    Information disclosure due to manipulated URL object

  * CVE-2020-12419 (bmo#1643874)

    Use-after-free in nsGlobalWindowInner

  * CVE-2020-12420 (bmo#1643437)

    Use-After-Free when trying to connect to a STUN server

  * CVE-2020-12402 (bmo#1631597)

    RSA Key Generation vulnerable to side-channel attack

  * CVE-2020-12421 (bmo#1308251)

    Add-On updates did not respect the same certificate trust

    rules as software updates

  * CVE-2020-12422 (bmo#1450353)

    Integer overflow in nsJPEGEncoder::emptyOutputBuffer

  * CVE-2020-12423 (bmo#1642400)

    DLL Hijacking due to searching %PATH% for a library

  * CVE-2020-12424 (bmo#1562600)

    WebRTC permission prompt could have been bypassed by a

    compromised content process

  * CVE-2020-12425 (bmo#1634738)

    Out of bound read in Date.parse()

  * CVE-2020-12426 (bmo#1608068, bmo#1609951, bmo#1631187, bmo#1637682)

    Memory safety bugs fixed in Firefox 78

- requires

  * NSS >= 3.53.1

  * nodejs >= 10.21

  * Gtk+3 >= 3.14

- removed obsolete patches

  * mozilla-s390-bigendian.patch

  * mozilla-bmo1634646.patch

- Add mozilla-pipewire-0-3.patch for openSUSE >= 15.2 to build

  WebRTC with pipewire support to enable screen sharing under

  Wayland; also add BuildRequires: pkgconfig(libpipewire-0.3)

  appropriately (boo#1172903).

- adding SLE12 compatibility in spec file

- add patches for s390x

  * mozilla-bmo1602730.patch (bmo#1602730)

  * mozilla-bmo1626236.patch (bmo#1626236)

  * mozilla-bmo998749.patch (bmo#998749)

  * mozilla-s390x-skia-gradient.patch

- update create-tar.sh

- Use same _constraints for ppc64 (BE) as ppc64le to avoid oom build failure

-------------------------------------------------------------------

Wed Jun 10 07:17:15 UTC 2020 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Exclude armv6, since it is unbuildable since about 3 years

-------------------------------------------------------------------

Wed Jun  3 21:39:11 UTC 2020 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 77.0.1

  * Disable automatic selection of DNS over HTTPS providers during

    a test to enable wider deployment in a more controlled way

    (bmo#1642723)

-------------------------------------------------------------------

Fri May 29 11:49:36 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 77.0

  * view and manage web certificates more easily on the new