# HG changeset patch # User Wolfgang Rosenauer # Date 1544613316 -3600 # Node ID 821cfbe8efcc6ec7195e2e40cdc97b7b9ce92c9a # Parent 9fec29d2ead20d59029bee0ef1067fe7f17660ee Firefox 64.0 diff -r 9fec29d2ead2 -r 821cfbe8efcc MozillaFirefox/MozillaFirefox.changes --- a/MozillaFirefox/MozillaFirefox.changes Tue Dec 11 08:48:38 2018 +0100 +++ b/MozillaFirefox/MozillaFirefox.changes Wed Dec 12 12:15:16 2018 +0100 @@ -1,4 +1,61 @@ ------------------------------------------------------------------- +Tue Dec 11 08:45:56 UTC 2018 - Wolfgang Rosenauer + +- update to Firefox 64.0 + * Better recommendations: You may see suggestions in regular browsing + mode for new and relevant Firefox features, services, and extensions + based on how you use the web (for US users only) + * Enhanced tab management: You can now select multiple tabs from the + tab bar and close, move, bookmark, or pin them quickly and easily + * Easier performance management: The new Task Manager page found at + about:performance lets you see how much energy each open tab consumes + and provides access to close tabs to conserve power + * Improved performance for Mac and Linux users, by enabling link time + optimization (Clang LTO). + * Added option to remove add-ons using the context menu on their + toolbar buttons + * RSS feed preview and live bookmarks are available only via add-ons + * TLS certificates issued by Symantec are no longer trusted by Firefox. + Website operators are strongly encouraged to replace any remaining + Symantec TLS certificates as soon as possible + MFSA 2018-29 (bsc#1119105) + * CVE-2018-12407 bmo#1505973 + Buffer overflow with ANGLE library when using VertexBuffer11 module + * CVE-2018-17466 bmo#1488295 + Buffer overflow and out-of-bounds read in ANGLE library with + TextureStorage11 + * CVE-2018-18492 bmo#1499861 + Use-after-free with select element + * CVE-2018-18493 bmo#1504452 + Buffer overflow in accelerated 2D canvas with Skia + * CVE-2018-18494 bmo#1487964 + Same-origin policy violation using location attribute and + performance.getEntries to steal cross-origin URLs + * CVE-2018-18495 bmo#1427585 + WebExtension content scripts can be loaded in about: pages + * CVE-2018-18496 bmo#1422231 (Windows only) + Embedded feed preview page can be abused for clickjacking + * CVE-2018-18497 bmo#1488180 + WebExtensions can load arbitrary URLs through pipe separators + * CVE-2018-18498 bmo#1500011 + Integer overflow when calculating buffer sizes for images + * CVE-2018-12406 bmo#1456947 bmo#1475669 bmo#1504816 bmo#1502886 + bmo#1500064 bmo#1500310 bmo#1500696 bmo#1498765 bmo#1499198 bmo#1434490 + bmo#1481745 bmo#1458129 + Memory safety bugs fixed in Firefox 64 + * CVE-2018-12405 bmo#1494752 bmo#1503326 bmo#1505181 bmo#1500759 + bmo#1504365 bmo#1506640 bmo#1503082 bmo#1502013 bmo#1510471 + Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4 +- requires + * rust/cargo >= 1.29 + * mozilla-nss >= 3.40.1 + * rust-cbindgen >= 0.6.4 +- rebased patches +- removed obsolete patch + * mozilla-bmo1491289.patch +- now uses clang primarily for compilation + +------------------------------------------------------------------- Wed Nov 28 11:07:18 UTC 2018 - Guillaume GARDET - Remove --disable-elf-hack when not available: on aarch64 and ppc64* diff -r 9fec29d2ead2 -r 821cfbe8efcc MozillaFirefox/MozillaFirefox.spec --- a/MozillaFirefox/MozillaFirefox.spec Tue Dec 11 08:48:38 2018 +0100 +++ b/MozillaFirefox/MozillaFirefox.spec Wed Dec 12 12:15:16 2018 +0100 @@ -18,15 +18,20 @@ # changed with every update -%define major 63 -%define mainver %major.0.3 -%define orig_version 63.0.3 +%define major 64 +%define mainver %major.0 +%define orig_version 64.0 %define orig_suffix %{nil} %define update_channel release %define branding 1 -%define releasedate 20181114214635 +%define releasedate 20181206201918 %define source_prefix firefox-%{orig_version} +# use clang (upstream default since 64.0) +%if 0%{?suse_version} > 1320 +%define clang_build 1 +%endif + # PIE, full relro (x86_64 for now) %define build_hardened 1 @@ -66,7 +71,6 @@ %else BuildRequires: gcc-c++ %endif -BuildRequires: cargo >= 1.28 BuildRequires: libXcomposite-devel BuildRequires: libcurl-devel BuildRequires: libidl-devel @@ -75,13 +79,14 @@ BuildRequires: libproxy-devel BuildRequires: makeinfo BuildRequires: mozilla-nspr-devel >= 4.20 -BuildRequires: mozilla-nss-devel >= 3.39 +BuildRequires: mozilla-nss-devel >= 3.40.1 BuildRequires: nodejs8 >= 8.11 BuildRequires: python-devel BuildRequires: python2-xml BuildRequires: python3 >= 3.5 -BuildRequires: rust >= 1.28 -BuildRequires: rust-cbindgen >= 0.6.2 +BuildRequires: rust >= 1.29 +BuildRequires: cargo >= 1.29 +BuildRequires: rust-cbindgen >= 0.6.4 BuildRequires: startup-notification-devel BuildRequires: unzip BuildRequires: update-desktop-files @@ -160,8 +165,7 @@ Patch7: mozilla-aarch64-startup-crash.patch Patch8: mozilla-bmo256180.patch Patch9: mozilla-bmo1463035.patch -Patch10: mozilla-bmo1491289.patch -Patch11: mozilla-cubeb-noreturn.patch +Patch10: mozilla-cubeb-noreturn.patch # Firefox/browser Patch101: firefox-kde.patch Patch102: firefox-branded-icons.patch @@ -272,7 +276,6 @@ %patch8 -p1 %patch9 -p1 %patch10 -p1 -%patch11 -p1 # Firefox %patch101 -p1 %patch102 -p1 @@ -303,9 +306,11 @@ %endif export CFLAGS="%{optflags} -fno-strict-aliasing" # boo#986541: add -fno-delete-null-pointer-checks for gcc6 +%if 0%{?clang_build} == 0 %if 0%{?suse_version} > 1320 export CFLAGS="$CFLAGS -fno-delete-null-pointer-checks" %endif +%endif %ifarch %arm %ix86 # Limit RAM usage during link export LDFLAGS="${LDFLAGS} -Wl,--no-keep-memory -Wl,--reduce-memory-overheads" @@ -336,8 +341,10 @@ ac_add_options --disable-gconf %endif %if 0%{?build_hardened} +%if 0%{?clang_build} == 0 ac_add_options --enable-pie %endif +%endif # gcc7 (boo#104105) %if 0%{?suse_version} > 1320 ac_add_options --enable-optimize="-g -O2" diff -r 9fec29d2ead2 -r 821cfbe8efcc MozillaFirefox/create-tar.sh --- a/MozillaFirefox/create-tar.sh Tue Dec 11 08:48:38 2018 +0100 +++ b/MozillaFirefox/create-tar.sh Wed Dec 12 12:15:16 2018 +0100 @@ -7,8 +7,8 @@ CHANNEL="release" BRANCH="releases/mozilla-$CHANNEL" -RELEASE_TAG="FIREFOX_63.0.3_RELEASE" -VERSION="63.0.3" +RELEASE_TAG="8337ebb86a425a1c65467fc68eb7c26b9046159e" +VERSION="64.0" VERSION_SUFFIX="" LOCALE_FILE="firefox-$VERSION/browser/locales/l10n-changesets.json" diff -r 9fec29d2ead2 -r 821cfbe8efcc MozillaFirefox/mozilla-bmo1491289.patch --- a/MozillaFirefox/mozilla-bmo1491289.patch Tue Dec 11 08:48:38 2018 +0100 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,1 +0,0 @@ -../mozilla-bmo1491289.patch \ No newline at end of file diff -r 9fec29d2ead2 -r 821cfbe8efcc MozillaFirefox/mozilla-newer-cbindgen.patch --- a/MozillaFirefox/mozilla-newer-cbindgen.patch Tue Dec 11 08:48:38 2018 +0100 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,1 +0,0 @@ -../mozilla-newer-cbindgen.patch \ No newline at end of file diff -r 9fec29d2ead2 -r 821cfbe8efcc MozillaFirefox/source-stamp.txt --- a/MozillaFirefox/source-stamp.txt Tue Dec 11 08:48:38 2018 +0100 +++ b/MozillaFirefox/source-stamp.txt Wed Dec 12 12:15:16 2018 +0100 @@ -1,2 +1,2 @@ -REV=4666a1c322d8 +REV=8337ebb86a42 REPO=http://hg.mozilla.org/releases/mozilla-release diff -r 9fec29d2ead2 -r 821cfbe8efcc firefox-kde.patch --- a/firefox-kde.patch Tue Dec 11 08:48:38 2018 +0100 +++ b/firefox-kde.patch Wed Dec 12 12:15:16 2018 +0100 @@ -1,11 +1,11 @@ # HG changeset patch -# Parent fdf78810e83396d10418791fbe32bed6bfe1558b +# Parent f2429084f187d5758508ae547c411943cba60fcf diff --git a/browser/base/content/browser-kde.xul b/browser/base/content/browser-kde.xul new file mode 100644 --- /dev/null +++ b/browser/base/content/browser-kde.xul -@@ -0,0 +1,1317 @@ +@@ -0,0 +1,1384 @@ +#filter substitution + +# -*- Mode: HTML -*- @@ -19,6 +19,12 @@ + both "content" and "skin" packages, which bug 1385444 will unify later. --> + + ++ ++ ++ ++ + + + @@ -72,7 +78,11 @@ + fullscreenbutton="true" + sizemode="normal" + retargetdocumentfocus="urlbar" -+ persist="screenX screenY width height sizemode"> ++ persist="screenX screenY width height sizemode" ++#ifdef BROWSER_XHTML ++ hidden="true" ++#endif ++ > + +# All JS files which are needed by browser.xul and other top level windows to +# support MacOS specific features *must* go into the global-scripts.inc file so @@ -90,9 +100,14 @@ + window.onload = gBrowserInit.onLoad.bind(gBrowserInit); + window.onunload = gBrowserInit.onUnload.bind(gBrowserInit); + window.onclose = WindowIsClosing; ++ +#ifdef BROWSER_XHTML -+ window.addEventListener("DOMContentLoaded", -+ gBrowserInit.onBeforeInitialXULLayout.bind(gBrowserInit), { once: true }); ++ window.addEventListener("readystatechange", () => { ++ // We initially hide the window to prevent layouts during parse. This lets us ++ // avoid accidental XBL construction and better match browser.xul (see Bug 1497975). ++ gBrowserInit.onBeforeInitialXULLayout(); ++ document.documentElement.removeAttribute("hidden"); ++ }, { once: true, capture: true }); +#else + window.addEventListener("MozBeforeInitialXULLayout", + gBrowserInit.onBeforeInitialXULLayout.bind(gBrowserInit), { once: true }); @@ -116,13 +131,12 @@ + onpopuphidden="if (event.target == this) TabContextMenu.contextTab = null;"> + -+