# HG changeset patch # User Wolfgang Rosenauer # Date 1670880913 -3600 # Node ID ba646dddffeff697a50e146026b399b08e014bce # Parent d76083122710ea3d9829dc2ef09660951a54a711 107.0.1 diff -r d76083122710 -r ba646dddffef MozillaFirefox/MozillaFirefox.changes --- a/MozillaFirefox/MozillaFirefox.changes Tue Nov 15 15:11:07 2022 +0100 +++ b/MozillaFirefox/MozillaFirefox.changes Mon Dec 12 22:35:13 2022 +0100 @@ -1,10 +1,73 @@ ------------------------------------------------------------------- +Thu Dec 1 21:13:32 UTC 2022 - Andreas Stieger + +- Mozilla Firefox 107.0.1: + * Fix an issue with accessing some sites reliably in Private + Browsing mode or Strict ETP due to anti-adblockers + (bmo#1717806) + * Fix an issue where Color Management was not available for + some users (bmo#1799391) + * Fix an issue with text overlapping in the Settings Menu for + some locales (bmo#1800379) + * Fix an issue where the DevTools UI is not accessible when an + alert dialog is displayed (bmo#1801840) + +------------------------------------------------------------------- +Tue Nov 15 14:22:26 UTC 2022 - Wolfgang Rosenauer + +- Mozilla Firefox 107.0 + MFSA 2022-47 (bsc#1205270) + * CVE-2022-45403 (bmo#1762078) + Service Workers might have learned size of cross-origin media files + * CVE-2022-45404 (bmo#1790815) + Fullscreen notification bypass + * CVE-2022-45405 (bmo#1791314) + Use-after-free in InputStream implementation + * CVE-2022-45406 (bmo#1791975) + Use-after-free of a JavaScript Realm + * CVE-2022-45407 (bmo#1793314) + Loading fonts on workers was not thread-safe + * CVE-2022-45408 (bmo#1793829) + Fullscreen notification bypass via windowName + * CVE-2022-45409 (bmo#1796901) + Use-after-free in Garbage Collection + * CVE-2022-45410 (bmo#1658869) + ServiceWorker-intercepted requests bypassed SameSite cookie policy + * CVE-2022-45411 (bmo#1790311) + Cross-Site Tracing was possible via non-standard override headers + * CVE-2022-45412 (bmo#1791029) + Symlinks may resolve to partially uninitialized buffers + * CVE-2022-45413 (bmo#1791201) + SameSite=Strict cookies could have been sent cross-site via + intent URLs + * CVE-2022-40674 (bmo#1791598) + Use-after-free vulnerability in expat + * CVE-2022-45415 (bmo#1793551) + Downloaded file may have been saved with malicious extension + * CVE-2022-45416 (bmo#1793676) + Keystroke Side-Channel Leakage + * CVE-2022-45417 (bmo#1794508) + Service Workers in Private Browsing Mode may have been + written to disk + * CVE-2022-45418 (bmo#1795815) + Custom mouse cursor could have been drawn over browser UI + * CVE-2022-45419 (bmo#1716082) + Deleting a security exception did not take effect immediately + * CVE-2022-45420 (bmo#1792643) + Iframe contents could be rendered outside the iframe + * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061) + Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5 +- requires + * NSS >= 3.84 + * rust = 1.64 + +------------------------------------------------------------------- Sat Nov 5 13:16:42 UTC 2022 - Andreas Stieger -- Mozilla Firefox 106.0.5: +- Mozilla Firefox 106.0.5 * Addresses a crash experienced by users with Intel Gemini Lake CPUs (bmo#1702019) -- Mozilla Firefox 106.0.4: +- Mozilla Firefox 106.0.4 * Fixed an issue with DRM Video playback (bmo#1797292) * Fixed broken layout of datetime input when switching types (bmo#1797139) diff -r d76083122710 -r ba646dddffef MozillaFirefox/MozillaFirefox.spec --- a/MozillaFirefox/MozillaFirefox.spec Tue Nov 15 15:11:07 2022 +0100 +++ b/MozillaFirefox/MozillaFirefox.spec Mon Dec 12 22:35:13 2022 +0100 @@ -2,7 +2,7 @@ # spec file for package MozillaFirefox # # Copyright (c) 2022 SUSE LLC -# 2006-2022 Wolfgang Rosenauer +# Copyright (c) 2006-2022 Wolfgang Rosenauer # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -28,9 +28,9 @@ # orig_suffix b3 # major 69 # mainver %major.99 -%define major 106 -%define mainver %major.0.5 -%define orig_version 106.0.5 +%define major 107 +%define mainver %major.0.1 +%define orig_version 107.0.1 %define orig_suffix %{nil} %define update_channel release %define branding 1 @@ -108,8 +108,8 @@ # minimal requirement: BuildRequires: rust+cargo >= 1.61 # actually used upstream: -BuildRequires: cargo1.63 -BuildRequires: rust1.63 +BuildRequires: cargo1.64 +BuildRequires: rust1.64 %endif %if 0%{useccache} != 0 BuildRequires: ccache @@ -120,7 +120,7 @@ BuildRequires: libproxy-devel BuildRequires: makeinfo BuildRequires: mozilla-nspr-devel >= 4.35 -BuildRequires: mozilla-nss-devel >= 3.83 +BuildRequires: mozilla-nss-devel >= 3.84 BuildRequires: nasm >= 2.14 BuildRequires: nodejs >= 10.22.1 %if 0%{?sle_version} >= 120000 && 0%{?sle_version} < 150000 diff -r d76083122710 -r ba646dddffef MozillaFirefox/tar_stamps --- a/MozillaFirefox/tar_stamps Tue Nov 15 15:11:07 2022 +0100 +++ b/MozillaFirefox/tar_stamps Mon Dec 12 22:35:13 2022 +0100 @@ -1,10 +1,10 @@ PRODUCT="firefox" CHANNEL="release" -VERSION="106.0.5" +VERSION="107.0.1" VERSION_SUFFIX="" -PREV_VERSION="106.0.3" +PREV_VERSION="107.0" PREV_VERSION_SUFFIX="" #SKIP_LOCALES="" # Uncomment to skip l10n and compare-locales-generation RELEASE_REPO="https://hg.mozilla.org/releases/mozilla-release" -RELEASE_TAG="aaf1f34d6010a4ae9384998d9e2e57911eb28aa7" -RELEASE_TIMESTAMP="20221104133228" +RELEASE_TAG="a9a9c8c68badf2c5ce288111cfa036e332617e63" +RELEASE_TIMESTAMP="20221128144904" diff -r d76083122710 -r ba646dddffef mozilla-bmo531915.patch --- a/mozilla-bmo531915.patch Tue Nov 15 15:11:07 2022 +0100 +++ b/mozilla-bmo531915.patch Mon Dec 12 22:35:13 2022 +0100 @@ -1,6 +1,6 @@ # HG changeset patch # User Wolfgang Rosenauer -# Parent 5573047016750e02413781dac0ac4c2361946ed2 +# Parent fa8a5832a374ccd7af5db927b992b5d9f15273ef diff --git a/modules/fdlibm/src/math_private.h b/modules/fdlibm/src/math_private.h --- a/modules/fdlibm/src/math_private.h @@ -23,7 +23,6 @@ +#endif typedef __double_t double_t; -typedef float __float_t; - typedef __float_t float_t; /* * The original fdlibm code used statements like: @@ -31,3 +30,4 @@ * ix0 = *(n0+(int*)&x); * high word of x * * ix1 = *((1-n0)+(int*)&x); * low word of x * * to dig two 32 bit words out of the 64 bit IEEE floating point + * value. That is non-ANSI, and, moreover, the gcc instruction diff -r d76083122710 -r ba646dddffef mozilla-buildfixes.patch --- a/mozilla-buildfixes.patch Tue Nov 15 15:11:07 2022 +0100 +++ b/mozilla-buildfixes.patch Mon Dec 12 22:35:13 2022 +0100 @@ -1,56 +1,12 @@ # HG changeset patch # User Wolfgang Rosenauer -# Parent 39a0846a4f2df1c4669273933d74567a8774e1da +# Parent e583ac9b86ba82dd1c60d307115b4cb96296a6af # References: bmo#1792159 - Add missing includes to AtomicOperationsGenerated.h -diff --git a/js/src/jit/GenerateAtomicOperations.py b/js/src/jit/GenerateAtomicOperations.py ---- a/js/src/jit/GenerateAtomicOperations.py -+++ b/js/src/jit/GenerateAtomicOperations.py -@@ -702,16 +702,18 @@ HEADER_TEMPLATE = """\ - * License, v. 2.0. If a copy of the MPL was not distributed with this - * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ - - #ifndef jit_AtomicOperationsGenerated_h - #define jit_AtomicOperationsGenerated_h - - /* This file is generated by jit/GenerateAtomicOperations.py. Do not edit! */ - -+#include "mozilla/Attributes.h" -+ - namespace js { - namespace jit { - - %(contents)s - - } // namespace jit - } // namespace js - -diff --git a/media/ffvpx/config_unix_aarch64.h b/media/ffvpx/config_unix_aarch64.h ---- a/media/ffvpx/config_unix_aarch64.h -+++ b/media/ffvpx/config_unix_aarch64.h -@@ -324,17 +324,17 @@ - #define HAVE_SETCONSOLETEXTATTRIBUTE 0 - #define HAVE_SETCONSOLECTRLHANDLER 0 - #define HAVE_SETDLLDIRECTORY 0 - #define HAVE_SETMODE 0 - #define HAVE_SETRLIMIT 1 - #define HAVE_SLEEP 0 - #define HAVE_STRERROR_R 1 - #define HAVE_SYSCONF 1 --#define HAVE_SYSCTL 1 -+#define HAVE_SYSCTL 0 - #define HAVE_USLEEP 1 - #define HAVE_UTGETOSTYPEFROMSTRING 0 - #define HAVE_VIRTUALALLOC 0 - #define HAVE_WGLGETPROCADDRESS 0 - #define HAVE_BCRYPT 0 - #define HAVE_VAAPI_DRM 0 - #define HAVE_VAAPI_X11 0 - #define HAVE_VDPAU_X11 0 diff --git a/mozglue/misc/SIMD_avx2.cpp b/mozglue/misc/SIMD_avx2.cpp --- a/mozglue/misc/SIMD_avx2.cpp +++ b/mozglue/misc/SIMD_avx2.cpp -@@ -50,17 +50,17 @@ template +@@ -53,17 +53,17 @@ template } if (sizeof(TValue) == 2) { return _mm256_cmpeq_epi16(a, b); diff -r d76083122710 -r ba646dddffef mozilla-kde.patch --- a/mozilla-kde.patch Tue Nov 15 15:11:07 2022 +0100 +++ b/mozilla-kde.patch Mon Dec 12 22:35:13 2022 +0100 @@ -3,7 +3,7 @@ # Date 1559294891 -7200 # Fri May 31 11:28:11 2019 +0200 # Node ID c2aa7198fb925e7fde96abf65b6f68b9b755f112 -# Parent b8fad36c438a0d20ffe73630e35c17addb4ee57d +# Parent 36f9c3a81777563ef87663a210b1cd38fdd734d9 Description: Add KDE integration to Firefox (toolkit parts) Author: Wolfgang Rosenauer Author: Lubos Lunak @@ -13,7 +13,7 @@ diff --git a/modules/libpref/Preferences.cpp b/modules/libpref/Preferences.cpp --- a/modules/libpref/Preferences.cpp +++ b/modules/libpref/Preferences.cpp -@@ -88,16 +88,17 @@ +@@ -89,16 +89,17 @@ #include "PLDHashTable.h" #include "plstr.h" #include "prlink.h" @@ -31,7 +31,7 @@ #ifdef MOZ_MEMORY # include "mozmemory.h" #endif -@@ -4823,16 +4824,27 @@ nsresult Preferences::InitInitialObjects +@@ -4849,16 +4850,27 @@ nsresult Preferences::InitInitialObjects "unix.js" # if defined(_AIX) , @@ -59,7 +59,7 @@ // Load jar:$app/omni.jar!/defaults/preferences/*.js // or jar:$gre/omni.jar!/defaults/preferences/*.js. -@@ -4897,17 +4909,17 @@ nsresult Preferences::InitInitialObjects +@@ -4923,17 +4935,17 @@ nsresult Preferences::InitInitialObjects } nsCOMPtr path = do_QueryInterface(elem); @@ -81,7 +81,7 @@ diff --git a/modules/libpref/moz.build b/modules/libpref/moz.build --- a/modules/libpref/moz.build +++ b/modules/libpref/moz.build -@@ -121,16 +121,20 @@ EXPORTS.mozilla += [ +@@ -123,16 +123,20 @@ EXPORTS.mozilla += [ ] EXPORTS.mozilla += sorted(["!" + g for g in gen_h]) @@ -165,7 +165,7 @@ diff --git a/toolkit/mozapps/downloads/HelperAppDlg.jsm b/toolkit/mozapps/downloads/HelperAppDlg.jsm --- a/toolkit/mozapps/downloads/HelperAppDlg.jsm +++ b/toolkit/mozapps/downloads/HelperAppDlg.jsm -@@ -1265,36 +1265,66 @@ nsUnknownContentTypeDialog.prototype = { +@@ -1239,36 +1239,66 @@ nsUnknownContentTypeDialog.prototype = { params.handlerApp && params.handlerApp.executable && params.handlerApp.executable.isFile() @@ -1283,8 +1283,8 @@ #include "nsGtkUtils.h" #include "nsIFileURL.h" #include "nsIGIOService.h" -@@ -22,16 +23,18 @@ - #include "nsMemory.h" +@@ -21,16 +22,18 @@ + #include "nsArrayEnumerator.h" #include "nsEnumeratorUtils.h" #include "nsNetUtil.h" #include "nsReadableUtils.h" @@ -1302,7 +1302,7 @@ # include "Units.h" extern mozilla::LazyLogModule gWidgetLog; # define LOG(args) MOZ_LOG(gWidgetLog, mozilla::LogLevel::Debug, args) -@@ -236,17 +239,19 @@ nsFilePicker::AppendFilters(int32_t aFil +@@ -235,17 +238,19 @@ nsFilePicker::AppendFilters(int32_t aFil mAllowURLs = !!(aFilterMask & filterAllowURLs); return nsBaseFilePicker::AppendFilters(aFilterMask); } @@ -1323,7 +1323,7 @@ mFilters.AppendElement(filter); mFilterNames.AppendElement(name); -@@ -346,16 +351,39 @@ nsresult nsFilePicker::Show(int16_t* aRe +@@ -345,16 +350,39 @@ nsresult nsFilePicker::Show(int16_t* aRe return NS_OK; } @@ -1363,7 +1363,7 @@ GtkFileChooserAction action = GetGtkFileChooserAction(mMode); const gchar* accept_button; -@@ -575,16 +603,244 @@ void nsFilePicker::Done(void* file_choos +@@ -574,16 +602,244 @@ void nsFilePicker::Done(void* file_choos mCallback->Done(result); mCallback = nullptr; } else { @@ -1807,7 +1807,7 @@ # include "prmem.h" # include "plbase64.h" -@@ -2083,20 +2084,29 @@ nsLocalFile::SetPersistentDescriptor(con +@@ -2088,20 +2089,29 @@ nsLocalFile::SetPersistentDescriptor(con NS_IMETHODIMP nsLocalFile::Reveal() { @@ -1839,7 +1839,7 @@ ::CFRelease(url); return rv; } -@@ -2108,16 +2118,23 @@ nsLocalFile::Reveal() { +@@ -2113,16 +2123,23 @@ nsLocalFile::Reveal() { NS_IMETHODIMP nsLocalFile::Launch() { diff -r d76083122710 -r ba646dddffef mozilla-s390-context.patch --- a/mozilla-s390-context.patch Tue Nov 15 15:11:07 2022 +0100 +++ b/mozilla-s390-context.patch Mon Dec 12 22:35:13 2022 +0100 @@ -3,15 +3,15 @@ # Date 1558452408 -7200 # Tue May 21 17:26:48 2019 +0200 # Node ID 602e92722e765a3c238d3b96b26c0c8063b5eeb4 -# Parent 263ccc06617bef4b8ef891eec54995190d5d5df3 +# Parent 6d6ebdace8a9877fe17c1bd14b80307c258c864f [mq]: mozilla-s390-context.patch diff --git a/js/src/wasm/WasmSignalHandlers.cpp b/js/src/wasm/WasmSignalHandlers.cpp --- a/js/src/wasm/WasmSignalHandlers.cpp +++ b/js/src/wasm/WasmSignalHandlers.cpp @@ -163,16 +163,20 @@ using mozilla::DebugOnly; - # define RSP_sig(p) ((p)->uc_mcontext.gregs[3]) - # define RFP_sig(p) ((p)->uc_mcontext.gregs[22]) + # define R03_sig(p) ((p)->uc_mcontext.__gregs[3]) + # define RFP_sig(p) ((p)->uc_mcontext.__gregs[22]) # endif # if defined(__sun__) && defined(__sparc__) # define PC_sig(p) ((p)->uc_mcontext.gregs[REG_PC]) @@ -37,7 +37,7 @@ # elif defined(__loongarch__) # define PC_sig(p) EPC_sig(p) # define FP_sig(p) RFP_sig(p) - # define SP_sig(p) RSP_sig(p) + # define SP_sig(p) R03_sig(p) # define LR_sig(p) RRA_sig(p) +# elif defined(__s390x__) +# define PC_sig(p) PSWa_sig(p) diff -r d76083122710 -r ba646dddffef mozilla-silence-no-return-type.patch --- a/mozilla-silence-no-return-type.patch Tue Nov 15 15:11:07 2022 +0100 +++ b/mozilla-silence-no-return-type.patch Mon Dec 12 22:35:13 2022 +0100 @@ -1,10 +1,10 @@ # HG changeset patch -# Parent ccd8f974707cba440cffeb0c66b5bcc0cda73c63 +# Parent de9644d7851feebc84a70c3d513b8342211acf60 diff --git a/Cargo.lock b/Cargo.lock --- a/Cargo.lock +++ b/Cargo.lock -@@ -2296,18 +2296,16 @@ name = "glsl-to-cxx" +@@ -2298,18 +2298,16 @@ name = "glsl-to-cxx" version = "0.1.0" dependencies = [ "glsl", @@ -26,7 +26,7 @@ diff --git a/Cargo.toml b/Cargo.toml --- a/Cargo.toml +++ b/Cargo.toml -@@ -143,16 +143,17 @@ async-task = { git = "https://github.com +@@ -150,16 +150,17 @@ async-task = { git = "https://github.com chardetng = { git = "https://github.com/hsivonen/chardetng", rev="3484d3e3ebdc8931493aa5df4d7ee9360a90e76b" } chardetng_c = { git = "https://github.com/hsivonen/chardetng_c", rev="ed8a4c6f900a90d4dbc1d64b856e61490a1c3570" } coremidi = { git = "https://github.com/chris-zen/coremidi.git", rev="fc68464b5445caf111e41f643a2e69ccce0b4f83" } @@ -38,11 +38,11 @@ +glslopt = { path = "third_party/rust/glslopt/" } # application-services overrides to make updating them all simpler. - interrupt-support = { git = "https://github.com/mozilla/application-services", rev = "fb1c78b13c27b5db1fd5458b8c2d8f433855dd61" } - sql-support = { git = "https://github.com/mozilla/application-services", rev = "fb1c78b13c27b5db1fd5458b8c2d8f433855dd61" } - sync15-traits = { git = "https://github.com/mozilla/application-services", rev = "fb1c78b13c27b5db1fd5458b8c2d8f433855dd61" } - viaduct = { git = "https://github.com/mozilla/application-services", rev = "fb1c78b13c27b5db1fd5458b8c2d8f433855dd61" } - webext-storage = { git = "https://github.com/mozilla/application-services", rev = "fb1c78b13c27b5db1fd5458b8c2d8f433855dd61" } + interrupt-support = { git = "https://github.com/mozilla/application-services", rev = "d8503475f43dbf1d78eef4e23b0578d0fada3f39" } + sql-support = { git = "https://github.com/mozilla/application-services", rev = "d8503475f43dbf1d78eef4e23b0578d0fada3f39" } + sync15 = { git = "https://github.com/mozilla/application-services", rev = "d8503475f43dbf1d78eef4e23b0578d0fada3f39" } + viaduct = { git = "https://github.com/mozilla/application-services", rev = "d8503475f43dbf1d78eef4e23b0578d0fada3f39" } + webext-storage = { git = "https://github.com/mozilla/application-services", rev = "d8503475f43dbf1d78eef4e23b0578d0fada3f39" } diff --git a/gfx/skia/skia/include/codec/SkEncodedOrigin.h b/gfx/skia/skia/include/codec/SkEncodedOrigin.h --- a/gfx/skia/skia/include/codec/SkEncodedOrigin.h