Mercurial Mercurial > hg > mozilla / changeset
summary | shortlog | changelog | graph | tags | bookmarks | branches | files | changeset | raw | help
Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
38.4.0 firefox38
authorWolfgang Rosenauer <wr@rosenauer.org>
Sat, 12 Dec 2015 10:06:11 +0100
branchfirefox38
changeset 888 b94dace970c6
parent 878 abc6cbf98a30
child 891 2fa2f92f6f37
38.4.0
MozillaFirefox/MozillaFirefox.changes file | annotate | diff | comparison | revisions
MozillaFirefox/MozillaFirefox.spec file | annotate | diff | comparison | revisions
MozillaFirefox/create-tar.sh file | annotate | diff | comparison | revisions
MozillaFirefox/firefox-esr.changes file | annotate | diff | comparison | revisions
MozillaFirefox/firefox-esr.spec file | annotate | diff | comparison | revisions
mozilla-kde.patch file | annotate | diff | comparison | revisions
xulrunner/create-tar.sh file | annotate | diff | comparison | revisions
xulrunner/xulrunner.changes file | annotate | diff | comparison | revisions
xulrunner/xulrunner.spec file | annotate | diff | comparison | revisions 
--- a/MozillaFirefox/MozillaFirefox.changes	Sat Aug 22 09:10:33 2015 +0200
+++ b/MozillaFirefox/MozillaFirefox.changes	Sat Dec 12 10:06:11 2015 +0100
@@ -1,7 +1,95 @@
 -------------------------------------------------------------------
+Fri Oct 30 21:31:52 UTC 2015 - wr@rosenauer.org
+
+- update to Firefox 38.4.0 (bnc#952810)
+  * MFSA 2015-116/CVE-2015-4513/CVE-2015-4514
+    Miscellaneous memory safety hazards
+  * MFSA 2015-122/CVE-2015-7188 (bmo#1199430)
+    Trailing whitespace in IP address hostnames can bypass same-origin policy
+  * MFSA 2015-123/CVE-2015-7189 (bmo#1205900)
+    Buffer overflow during image interactions in canvas
+  * MFSA 2015-127/CVE-2015-7193 (bmo#1210302)
+    CORS preflight is bypassed when non-standard Content-Type headers
+    are received
+  * MFSA 2015-128/CVE-2015-7194 (bmo#1211262)
+    Memory corruption in libjar through zip files
+  * MFSA 2015-130/CVE-2015-7196 (bmo#1140616)
+    JavaScript garbage collection crash with Java applet
+  * MFSA 2015-131/CVE-2015-7198/CVE-2015-7199/CVE-2015-7200
+    (bmo#1188010, bmo#1204061, bmo#1204155)
+    Vulnerabilities found through code inspection
+  * MFSA 2015-132/CVE-2015-7197 (bmo#1204269)
+    Mixed content WebSocket policy bypass through workers
+  * MFSA 2015-133/CVE-2015-7181/CVE-2015-7182/CVE-2015-7183
+    (bmo#1202868, bmo#1205157)
+    NSS and NSPR memory corruption issues
+    (fixed in mozilla-nspr and mozilla-nss packages)
+- requires NSPR 4.10.10 and NSS 3.19.2.1
+
+-------------------------------------------------------------------
+Tue Sep 22 07:01:24 UTC 2015 - wr@rosenauer.org
+
+- update to Firefox 38.3.0esr (bnc#947003)
+  * MFSA 2015-96/CVE-2015-4500
+    Miscellaneous memory safety hazards
+  * MFSA 2015-100/CVE-2015-4505 (bmo#1177861) (Windows only)
+    Arbitrary file manipulation by local user through Mozilla updater
+  * MFSA 2015-101/CVE-2015-4506 (bmo#1192226)
+    Buffer overflow in libvpx while parsing vp9 format video
+  * MFSA 2015-105/CVE-2015-4511 (bmo#1200148)
+    Buffer overflow while decoding WebM video
+  * MFSA 2015-106/CVE-2015-4509 (bmo#1198435)
+    Use-after-free while manipulating HTML media content
+  * MFSA 2015-110/CVE-2015-4519 (bmo#1189814)
+    Dragging and dropping images exposes final URL after redirects
+  * MFSA 2015-111/CVE-2015-4520 (bmo#1200856, bmo#1200869)
+    Errors in the handling of CORS preflight request headers
+  * MFSA 2015-112/CVE-2015-4517/CVE-2015-4521/CVE-2015-4522/
+    CVE-2015-7174/CVE-2015-7175/CVE-2015-7176/CVE-2015-7177/
+    CVE-2015-7180
+    Vulnerabilities found through code inspection
+  * MFSA 2015-113/CVE-2015-7178/CVE-2015-7179 (bmo#1189860,
+    bmo#1190526) (Windows only)
+    Memory safety errors in libGLES in the ANGLE graphics library
+
+-------------------------------------------------------------------
+Thu Aug 27 06:03:51 UTC 2015 - wr@rosenauer.org
+
+- update to Firefox 38.2.1 (bnc#943550)
+  * MFSA 2015-94/CVE-2015-4497 (bmo#1164766, bmo#1175278)
+    Use-after-free when resizing canvas element during restyling
+  * MFSA 2015-95/CVE-2015-4498 (bmo#1042699)
+    Add-on notification bypass through data URLs
+
+-------------------------------------------------------------------
 Mon Aug 10 16:40:17 UTC 2015 - wr@rosenauer.org
 
 - update to Firefox 38.2.0esr (bnc#940806)
+  * MFSA 2015-79/CVE-2015-4473
+    Miscellaneous memory safety hazards
+  * MFSA 2015-80/CVE-2015-4475 (bmo#1175396)
+    Out-of-bounds read with malformed MP3 file
+  * MFSA 2015-82/CVE-2015-4478 (bmo#1105914)
+    Redefinition of non-configurable JavaScript object properties
+  * MFSA 2015-83/CVE-2015-4479/CVE-2015-4480/CVE-2015-4493
+    Overflow issues in libstagefright
+  * MFSA 2015-84/CVE-2015-4481 (bmo1171518)
+    Arbitrary file overwriting through Mozilla Maintenance Service
+    with hard links (only affected Windows)
+  * MFSA 2015-85/CVE-2015-4482 (bmo#1184500)
+    Out-of-bounds write with Updater and malicious MAR file
+    (does not affect openSUSE RPM packages which do not ship the
+     updater)
+  * MFSA 2015-87/CVE-2015-4484 (bmo#1171540)
+    Crash when using shared memory in JavaScript
+  * MFSA 2015-88/CVE-2015-4491 (bmo#1184009)
+    Heap overflow in gdk-pixbuf when scaling bitmap images
+  * MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948, bmo#1178148)
+    Buffer overflows on Libvpx when decoding WebM video
+  * MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489
+    Vulnerabilities found through code inspection
+  * MFSA 2015-92/CVE-2015-4492 (bmo#1185820)
+    Use-after-free in XMLHttpRequest with shared workers
 - rebased mozilla-repo.patch
 
 -------------------------------------------------------------------
--- a/MozillaFirefox/MozillaFirefox.spec	Sat Aug 22 09:10:33 2015 +0200
+++ b/MozillaFirefox/MozillaFirefox.spec	Sat Dec 12 10:06:11 2015 +0100
@@ -19,9 +19,9 @@
 
 # changed with every update
 %define major 38
-%define mainver %major.2.0
+%define mainver %major.4.0
 %define update_channel esr38
-%define releasedate 2015080900
+%define releasedate 2015102700
 
 # general build definitions
 %if "%{update_channel}" != "aurora"
@@ -76,8 +76,8 @@
 BuildRequires:  libnotify-devel
 BuildRequires:  libproxy-devel
 BuildRequires:  makeinfo
-BuildRequires:  mozilla-nspr-devel >= 4.10.8
-BuildRequires:  mozilla-nss-devel >= 3.19.2
+BuildRequires:  mozilla-nspr-devel >= 4.10.10
+BuildRequires:  mozilla-nss-devel >= 3.19.2.1
 BuildRequires:  nss-shared-helper-devel
 BuildRequires:  python-devel
 BuildRequires:  startup-notification-devel
--- a/MozillaFirefox/create-tar.sh	Sat Aug 22 09:10:33 2015 +0200
+++ b/MozillaFirefox/create-tar.sh	Sat Dec 12 10:06:11 2015 +0100
@@ -2,8 +2,8 @@
 
 CHANNEL="esr38"
 BRANCH="releases/mozilla-$CHANNEL"
-RELEASE_TAG="FIREFOX_38_2_0esr_RELEASE"
-VERSION="38.2.0"
+RELEASE_TAG="FIREFOX_38_4_0esr_RELEASE"
+VERSION="38.4.0"
 
 # mozilla
 if [ -d mozilla ]; then
--- a/MozillaFirefox/firefox-esr.changes	Sat Aug 22 09:10:33 2015 +0200
+++ b/MozillaFirefox/firefox-esr.changes	Sat Dec 12 10:06:11 2015 +0100
@@ -1,7 +1,95 @@
 -------------------------------------------------------------------
+Fri Oct 30 21:31:52 UTC 2015 - wr@rosenauer.org
+
+- update to Firefox 38.4.0 (bnc#952810)
+  * MFSA 2015-116/CVE-2015-4513/CVE-2015-4514
+    Miscellaneous memory safety hazards
+  * MFSA 2015-122/CVE-2015-7188 (bmo#1199430)
+    Trailing whitespace in IP address hostnames can bypass same-origin policy
+  * MFSA 2015-123/CVE-2015-7189 (bmo#1205900)
+    Buffer overflow during image interactions in canvas
+  * MFSA 2015-127/CVE-2015-7193 (bmo#1210302)
+    CORS preflight is bypassed when non-standard Content-Type headers
+    are received
+  * MFSA 2015-128/CVE-2015-7194 (bmo#1211262)
+    Memory corruption in libjar through zip files
+  * MFSA 2015-130/CVE-2015-7196 (bmo#1140616)
+    JavaScript garbage collection crash with Java applet
+  * MFSA 2015-131/CVE-2015-7198/CVE-2015-7199/CVE-2015-7200
+    (bmo#1188010, bmo#1204061, bmo#1204155)
+    Vulnerabilities found through code inspection
+  * MFSA 2015-132/CVE-2015-7197 (bmo#1204269)
+    Mixed content WebSocket policy bypass through workers
+  * MFSA 2015-133/CVE-2015-7181/CVE-2015-7182/CVE-2015-7183
+    (bmo#1202868, bmo#1205157)
+    NSS and NSPR memory corruption issues
+    (fixed in mozilla-nspr and mozilla-nss packages)
+- requires NSPR 4.10.10 and NSS 3.19.2.1
+
+-------------------------------------------------------------------
+Tue Sep 22 07:01:24 UTC 2015 - wr@rosenauer.org
+
+- update to Firefox 38.3.0esr (bnc#947003)
+  * MFSA 2015-96/CVE-2015-4500
+    Miscellaneous memory safety hazards
+  * MFSA 2015-100/CVE-2015-4505 (bmo#1177861) (Windows only)
+    Arbitrary file manipulation by local user through Mozilla updater
+  * MFSA 2015-101/CVE-2015-4506 (bmo#1192226)
+    Buffer overflow in libvpx while parsing vp9 format video
+  * MFSA 2015-105/CVE-2015-4511 (bmo#1200148)
+    Buffer overflow while decoding WebM video
+  * MFSA 2015-106/CVE-2015-4509 (bmo#1198435)
+    Use-after-free while manipulating HTML media content
+  * MFSA 2015-110/CVE-2015-4519 (bmo#1189814)
+    Dragging and dropping images exposes final URL after redirects
+  * MFSA 2015-111/CVE-2015-4520 (bmo#1200856, bmo#1200869)
+    Errors in the handling of CORS preflight request headers
+  * MFSA 2015-112/CVE-2015-4517/CVE-2015-4521/CVE-2015-4522/
+    CVE-2015-7174/CVE-2015-7175/CVE-2015-7176/CVE-2015-7177/
+    CVE-2015-7180
+    Vulnerabilities found through code inspection
+  * MFSA 2015-113/CVE-2015-7178/CVE-2015-7179 (bmo#1189860,
+    bmo#1190526) (Windows only)
+    Memory safety errors in libGLES in the ANGLE graphics library
+
+-------------------------------------------------------------------
+Thu Aug 27 06:03:51 UTC 2015 - wr@rosenauer.org
+
+- update to Firefox 38.2.1 (bnc#943550)
+  * MFSA 2015-94/CVE-2015-4497 (bmo#1164766, bmo#1175278)
+    Use-after-free when resizing canvas element during restyling
+  * MFSA 2015-95/CVE-2015-4498 (bmo#1042699)
+    Add-on notification bypass through data URLs
+
+-------------------------------------------------------------------
 Mon Aug 10 16:40:17 UTC 2015 - wr@rosenauer.org
 
 - update to Firefox 38.2.0esr (bnc#940806)
+  * MFSA 2015-79/CVE-2015-4473
+    Miscellaneous memory safety hazards
+  * MFSA 2015-80/CVE-2015-4475 (bmo#1175396)
+    Out-of-bounds read with malformed MP3 file
+  * MFSA 2015-82/CVE-2015-4478 (bmo#1105914)
+    Redefinition of non-configurable JavaScript object properties
+  * MFSA 2015-83/CVE-2015-4479/CVE-2015-4480/CVE-2015-4493
+    Overflow issues in libstagefright
+  * MFSA 2015-84/CVE-2015-4481 (bmo1171518)
+    Arbitrary file overwriting through Mozilla Maintenance Service
+    with hard links (only affected Windows)
+  * MFSA 2015-85/CVE-2015-4482 (bmo#1184500)
+    Out-of-bounds write with Updater and malicious MAR file
+    (does not affect openSUSE RPM packages which do not ship the
+     updater)
+  * MFSA 2015-87/CVE-2015-4484 (bmo#1171540)
+    Crash when using shared memory in JavaScript
+  * MFSA 2015-88/CVE-2015-4491 (bmo#1184009)
+    Heap overflow in gdk-pixbuf when scaling bitmap images
+  * MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948, bmo#1178148)
+    Buffer overflows on Libvpx when decoding WebM video
+  * MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489
+    Vulnerabilities found through code inspection
+  * MFSA 2015-92/CVE-2015-4492 (bmo#1185820)
+    Use-after-free in XMLHttpRequest with shared workers
 - rebased mozilla-repo.patch
 
 -------------------------------------------------------------------
--- a/MozillaFirefox/firefox-esr.spec	Sat Aug 22 09:10:33 2015 +0200
+++ b/MozillaFirefox/firefox-esr.spec	Sat Dec 12 10:06:11 2015 +0100
@@ -19,9 +19,9 @@
 
 # changed with every update
 %define major 38
-%define mainver %major.2.0
+%define mainver %major.4.0
 %define update_channel esr38
-%define releasedate 2015080900
+%define releasedate 2015102700
 
 # general build definitions
 %if "%{update_channel}" != "aurora"
@@ -76,8 +76,8 @@
 BuildRequires:  libnotify-devel
 BuildRequires:  libproxy-devel
 BuildRequires:  makeinfo
-BuildRequires:  mozilla-nspr-devel >= 4.10.8
-BuildRequires:  mozilla-nss-devel >= 3.19.2
+BuildRequires:  mozilla-nspr-devel >= 4.10.10
+BuildRequires:  mozilla-nss-devel >= 3.19.2.1
 BuildRequires:  nss-shared-helper-devel
 BuildRequires:  python-devel
 BuildRequires:  startup-notification-devel
--- a/mozilla-kde.patch	Sat Aug 22 09:10:33 2015 +0200
+++ b/mozilla-kde.patch	Sat Dec 12 10:06:11 2015 +0100
@@ -1,5 +1,5 @@
 # HG changeset patch
-# Parent  214f99f3ce4f1f8ae9b3d18da44e5d66b3105663
+# Parent  879df970cffe74db62f72f5b815b559dab63418a
 Description: Add KDE integration to Firefox (toolkit parts)
 Author: Wolfgang Rosenauer <wolfgang@rosenauer.org>
 Author: Lubos Lunak <lunak@suse.com>
@@ -3148,11 +3148,11 @@
  using namespace mozilla;
  
  #define MAX_PREVIEW_SIZE 180
+ // bug 1184009
+ #define MAX_PREVIEW_SOURCE_SIZE 4096
  
  nsIFile *nsFilePicker::mPrevDisplayDirectory = nullptr;
- 
- void
-@@ -238,17 +240,19 @@ nsFilePicker::AppendFilters(int32_t aFil
+@@ -243,17 +245,19 @@ nsFilePicker::AppendFilters(int32_t aFil
    return nsBaseFilePicker::AppendFilters(aFilterMask);
  }
  
@@ -3173,7 +3173,7 @@
  
    mFilters.AppendElement(filter);
    mFilterNames.AppendElement(name);
-@@ -363,16 +367,32 @@ nsFilePicker::Show(int16_t *aReturn)
+@@ -368,16 +372,32 @@ nsFilePicker::Show(int16_t *aReturn)
  
  NS_IMETHODIMP
  nsFilePicker::Open(nsIFilePickerShownCallback *aCallback)
@@ -3206,7 +3206,7 @@
  
    GtkFileChooserAction action = GetGtkFileChooserAction(mMode);
    const gchar *accept_button = (action == GTK_FILE_CHOOSER_ACTION_SAVE)
-@@ -551,8 +571,235 @@ nsFilePicker::Done(GtkWidget* file_choos
+@@ -556,8 +576,235 @@ nsFilePicker::Done(GtkWidget* file_choos
    if (mCallback) {
      mCallback->Done(result);
      mCallback = nullptr;
--- a/xulrunner/create-tar.sh	Sat Aug 22 09:10:33 2015 +0200
+++ b/xulrunner/create-tar.sh	Sat Dec 12 10:06:11 2015 +0100
@@ -2,8 +2,8 @@
 
 CHANNEL="esr38"
 BRANCH="releases/mozilla-$CHANNEL"
-RELEASE_TAG="FIREFOX_38_2_0esr_RELEASE"
-VERSION="38.2.0"
+RELEASE_TAG="FIREFOX_38_4_0esr_RELEASE"
+VERSION="38.4.0"
 
 # mozilla
 if [ -d mozilla ]; then
--- a/xulrunner/xulrunner.changes	Sat Aug 22 09:10:33 2015 +0200
+++ b/xulrunner/xulrunner.changes	Sat Dec 12 10:06:11 2015 +0100
@@ -1,3 +1,57 @@
+-------------------------------------------------------------------
+Sat Oct 31 09:32:17 UTC 2015 - wr@rosenauer.org
+
+- update to xulrunner 38.4.0 (bnc#952810)
+  * MFSA 2015-116/CVE-2015-4513/CVE-2015-4514
+    Miscellaneous memory safety hazards
+  * MFSA 2015-122/CVE-2015-7188 (bmo#1199430)
+    Trailing whitespace in IP address hostnames can bypass same-origin policy
+  * MFSA 2015-123/CVE-2015-7189 (bmo#1205900)
+    Buffer overflow during image interactions in canvas
+  * MFSA 2015-127/CVE-2015-7193 (bmo#1210302)
+    CORS preflight is bypassed when non-standard Content-Type headers
+    are received
+  * MFSA 2015-128/CVE-2015-7194 (bmo#1211262)
+    Memory corruption in libjar through zip files
+  * MFSA 2015-130/CVE-2015-7196 (bmo#1140616)
+    JavaScript garbage collection crash with Java applet
+  * MFSA 2015-131/CVE-2015-7198/CVE-2015-7199/CVE-2015-7200
+    (bmo#1188010, bmo#1204061, bmo#1204155)
+    Vulnerabilities found through code inspection
+  * MFSA 2015-132/CVE-2015-7197 (bmo#1204269)
+    Mixed content WebSocket policy bypass through workers
+  * MFSA 2015-133/CVE-2015-7181/CVE-2015-7182/CVE-2015-7183
+    (bmo#1202868, bmo#1205157)
+    NSS and NSPR memory corruption issues
+    (fixed in mozilla-nspr and mozilla-nss packages)
+- requires NSPR 4.10.10 and NSS 3.19.2.1
+
+-------------------------------------------------------------------
+Wed Sep 23 05:47:20 UTC 2015 - wr@rosenauer.org
+
+- update to xulrunner 38.3.0 (bnc#947003)
+  * MFSA 2015-96/CVE-2015-4500
+    Miscellaneous memory safety hazards
+  * MFSA 2015-100/CVE-2015-4505 (bmo#1177861) (Windows only)
+    Arbitrary file manipulation by local user through Mozilla updater
+  * MFSA 2015-101/CVE-2015-4506 (bmo#1192226)
+    Buffer overflow in libvpx while parsing vp9 format video
+  * MFSA 2015-105/CVE-2015-4511 (bmo#1200148)
+    Buffer overflow while decoding WebM video
+  * MFSA 2015-106/CVE-2015-4509 (bmo#1198435)
+    Use-after-free while manipulating HTML media content
+  * MFSA 2015-110/CVE-2015-4519 (bmo#1189814)
+    Dragging and dropping images exposes final URL after redirects
+  * MFSA 2015-111/CVE-2015-4520 (bmo#1200856, bmo#1200869)
+    Errors in the handling of CORS preflight request headers
+  * MFSA 2015-112/CVE-2015-4517/CVE-2015-4521/CVE-2015-4522/
+    CVE-2015-7174/CVE-2015-7175/CVE-2015-7176/CVE-2015-7177/
+    CVE-2015-7180
+    Vulnerabilities found through code inspection
+  * MFSA 2015-113/CVE-2015-7178/CVE-2015-7179 (bmo#1189860,
+    bmo#1190526) (Windows only)
+    Memory safety errors in libGLES in the ANGLE graphics library
+
 -------------------------------------------------------------------
 Mon Aug 10 16:40:17 UTC 2015 - wr@rosenauer.org
 
--- a/xulrunner/xulrunner.spec	Sat Aug 22 09:10:33 2015 +0200
+++ b/xulrunner/xulrunner.spec	Sat Dec 12 10:06:11 2015 +0100
@@ -17,10 +17,10 @@
 #
 
 
-%define version_internal 38.2.0
+%define version_internal 38.4.0
 %define apiversion 38
-%define uaweight 3820000
-%define releasedate 2015080900
+%define uaweight 3840000
+%define releasedate 2015102700
 %define shared_js 0
 %define has_system_nspr  1
 %define has_system_nss   1
@@ -67,8 +67,8 @@
 %else
 BuildRequires:  wireless-tools
 %endif
-BuildRequires:  mozilla-nspr-devel >= 4.10.8
-BuildRequires:  mozilla-nss-devel >= 3.19.2
+BuildRequires:  mozilla-nspr-devel >= 4.10.10
+BuildRequires:  mozilla-nss-devel >= 3.19.2.1
 BuildRequires:  pkgconfig(libpulse)
 %if %suse_version > 1210
 BuildRequires:  pkgconfig(gstreamer-%gstreamer_ver)
mozilla