-------------------------------------------------------------------

Wed Jan 22 10:30:21 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 72.0.2

  * Various stability fixes

  * Fixed issues opening files with spaces in their path (bmo#1601905)

  * Fixed a hang opening about:logins when a master password is set

    (bmo#1606992)

  * Fixed a web compatibility issue with CSS Shadow Parts which

    shipped in Firefox 72 (bmo#1604989)

  * Fixed inconsistent playback performance for fullscreen 1080p

    videos on some systems (bmo#1608485)

-------------------------------------------------------------------

Tue Jan 21 12:59:54 UTC 2020 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Fix build for aarch64/ppc64le (do not update config.sub file

  for libbacktrace)

-------------------------------------------------------------------

Wed Jan  8 08:19:12 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 72.0.1

  MFSA 2020-03 (bsc#1160498)

  * CVE-2019-17026 (bmo#1607443)

    IonMonkey type confusion with StoreElementHole and FallibleStoreElement

- Mozilla Firefox 72.0

  * block fingerprinting scripts by default

  * new notification pop-ups

  * Picture-in-picture video

  MFSA 2020-01 (bsc#1160305)

  * CVE-2019-17016 (bmo#1599181)

    Bypass of @namespace CSS sanitization during pasting

  * CVE-2019-17017 (bmo#1603055)

    Type Confusion in XPCVariant.cpp

  * CVE-2019-17020 (bmo#1597645)

    Content Security Policy not applied to XSL stylesheets applied

    to XML documents

  * CVE-2019-17022 (bmo#1602843)

    CSS sanitization does not escape HTML tags

  * CVE-2019-17023 (bmo#1590001) (fixed in NSS FIXME)

    NSS may negotiate TLS 1.2 or below after a TLS 1.3

    HelloRetryRequest had been sent

  * CVE-2019-17024 (bmo#1507180,bmo#1595470,bmo#1598605,bmo#1601826)

    Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4

  * CVE-2019-17025 (bmo#1328295,bmo#1328300,bmo#1590447,bmo#1590965

    bmo#1595692,bmo#1597321,bmo#1597481)

    Memory safety bugs fixed in Firefox 72

- update create-tar.sh to skip compare-locales

- requires NSPR 4.24 and NSS 3.48

- removed usage of browser-plugins convention for NPAPI plugins

  from start wrapper and changed the RPM macro to the

  /usr/$LIB/mozilla/plugins location (boo#1160302)

-------------------------------------------------------------------

Mon Dec  2 08:24:05 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 71.0

  * Improvements to Lockwise, our integrated password manager

  * More information about Enhanced Tracking Protection in action

  * Native MP3 decoding on Windows, Linux, and macOS

  * Configuration page (about:config) reimplemented in HTML

  * New kiosk mode functionality, which allows maximum screen space

    for customer-facing displays

  MFSA 2019-36

  * CVE-2019-11756 (bmo#1508776)

    Use-after-free of SFTKSession object

  * CVE-2019-17008 (bmo#1546331)

    Use-after-free in worker destruction

  * CVE-2019-13722 (bmo#1580156) (Windows only)

    Stack corruption due to incorrect number of arguments in WebRTC code

  * CVE-2019-17014 (bmo#1322864)

    Dragging and dropping a cross-origin resource, incorrectly loaded

    as an image, could result in information disclosure

  * CVE-2019-17010 (bmo#1581084)

    Use-after-free when performing device orientation checks

  * CVE-2019-17005 (bmo#1584170)

    Buffer overflow in plain text serializer

  * CVE-2019-17011 (bmo#1591334)

    Use-after-free when retrieving a document in antitracking

  * CVE-2019-17012 (bmo#1449736, bmo#1533957, bmo#1560667, bmo#1567209

    bmo#1580288, bmo#1585760, bmo#1592502)

    Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3

  * CVE-2019-17013 (bmo#1298509, bmo#1472328, bmo#1577439, bmo#1577937

    bmo#1580320, bmo#1584195, bmo#1585106, bmo#1586293, bmo#1593865

    bmo#1594181)

    Memory safety bugs fixed in Firefox 71

- requires

  NSPR >= 4.23

  NSS >= 3.47.1

  rust/cargo >= 1.37

- reactivate webrtc for platforms where it was disabled

- updated create-tar.sh to cover buildid and origin repo information

  -> removed obsolete source-stamp.txt

- removed obsolete patches

  mozilla-bmo1511604.patch

  mozilla-openaes-decl.patch

- changed locale building procedure

  * removed obsolete compare-locales.tar.xz

- added mozilla-bmo1601707.patch to fix gcc/LTO builds

  (bmo#1601707, boo#1158466)

- added mozilla-bmo849632.patch to fix big endian issues in skia

  used for WebGL

-------------------------------------------------------------------

Fri Nov  1 14:16:39 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 70.0.1

  * Fix for an issue that caused some websites or page elements using

    dynamic JavaScript to fail to load. (bmo#1592136)

  * Title bar no longer shows in full screen view (bmo#1588747)

- added mozilla-bmo1504834-part4.patch to fix some visual issues on

  big endian platforms

-------------------------------------------------------------------

Sun Oct 20 20:19:31 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 70.0

  * more privacy protections from Enhanced Tracking Protection

  * Firefox Lockwise passwordmanager

  * Improvements to core engine components, for better browsing on more sites

  * Improved privacy and security indicators

  MFSA 2019-34

  * CVE-2018-6156 (bmo#1480088)

    Heap buffer overflow in FEC processing in WebRTC

  * CVE-2019-15903 (bmo#1584907)

    Heap overflow in expat library in XML_GetCurrentLineNumber

  * CVE-2019-11757 (bmo#1577107)

    Use-after-free when creating index updates in IndexedDB

  * CVE-2019-11759 (bmo#1577953)

    Stack buffer overflow in HKDF output

  * CVE-2019-11760 (bmo#1577719)

    Stack buffer overflow in WebRTC networking

  * CVE-2019-11761 (bmo#1561502)

    Unintended access to a privileged JSONView object

  * CVE-2019-11762 (bmo#1582857)

    document.domain-based origin isolation has same-origin-property violation

  * CVE-2019-11763 (bmo#1584216)

    Incorrect HTML parsing results in XSS bypass technique

  * CVE-2019-11765 (bmo#1562582)

    Incorrect permissions could be granted to a website

  * CVE-2019-17000 (bmo#1441468)

    CSP bypass using object tag with data: URI

  * CVE-2019-17001 (bmo#1587976)

    CSP bypass using object tag when script-src 'none' is specified

  * CVE-2019-17002 (bmo#1561056)

    upgrade-insecure-requests was not being honored for links dragged and dropped

  * CVE-2019-11764 (bmo#1558522, bmo#1577061, bmo#1548044, bmo#1571223,

    bmo#1573048, bmo#1578933, bmo#1575217, bmo#1583684, bmo#1586845, bmo#1581950,

    bmo#1583463, bmo#1586599)

    Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2

- requires

    rust/cargo >= 1.36

    NSPR >= 4.22

    NSS >= 3.46.1

    rust-cbindgen >= 0.9.1

- removed obsolete patches

    mozilla-bmo1573381.patch

    mozilla-nestegg-big-endian.patch

-------------------------------------------------------------------

Sun Oct 13 08:58:12 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 69.0.3

  * Fixed Yahoo mail users being prompted to download files when

    clicking on emails (bmo#1582848)

- devel package build can easily be disabled now

-------------------------------------------------------------------

Thu Oct  3 08:40:05 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 69.0.2

  * Fixed a crash when editing files on Office 365 websites (bmo#1579858)

  * Fixed a Linux-only crash when changing the playback speed while

    watching YouTube videos (bmo#1582222)

- updated supported locale list

- Allow to build without profile guided optimizations (boo#1040589)

  (contributed by Bernhard Wiedemann)

- Make build verbose (contributed by Martin Liška)

- remove obsolete kde.js setting (boo#1151186) and related patch

  firefox-add-kde.js-in-order-to-survive-PGO-build.patch

- update create-tar.sh to latest revision and adjusted tar_stamps

- add mozilla-fix-top-level-asm.patch to fix LTO build (w/o PGO)

- extension preferences moved from branding package to core package

  (packaging but not branding specific)

-------------------------------------------------------------------

Thu Sep 19 13:31:16 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 69.0.1

  * Fixed external programs launching in the background when clicking

    a link from inside Firefox to launch them (bmo#1570845)

  * Usability improvements to the Add-ons Manager for users with

    screen readers (bmo#1567600)

  * Fixed the Captive Portal notification bar not being dismissable

    in some situations after login is complete (bmo#1578633)

  * Fixed the maximum size of fonts in Reader Mode when zoomed (bmo#1578454)

  * Fixed missing stacks in the Developer Tools Performance section

    (bmo#1578354)

  MFSA 2019-31

  * CVE-2019-11754 (bmo#1580506)

    Pointer Lock is enabled with no user notification

- disable DOH by default

-------------------------------------------------------------------

Thu Sep  5 13:02:39 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 69.0

  * Enhanced Tracking Protection (ETP) for stronger privacy protections

  * Block Autoplay feature is enhanced to give users the option to block

    any video

  * Users in the US or using the en-US browser, can get a new “New Tab”

    page experience connecting to the best of Pocket's content.

  * Support for the Web Authentication HmacSecret extension via

    Windows Hello introduced.

  * Support for receiving multiple video codecs with this release makes

    it easier for WebRTC conferencing services to mix video from

    different clients.

  MFSA 2019-25 (boo#1149324)

  * CVE-2019-11741 (bmo#1539595)

    Isolate addons.mozilla.org and accounts.firefox.com

  * CVE-2019-5849 (bmo#1555838)

    Out-of-bounds read in Skia

  * CVE-2019-11737 (bmo#1388015)

    Content security policy directives ignore port and path if host is a wildcard

  * CVE-2019-11734 (bmo#1352875,bmo#1536227,bmo#1557208,bmo#1560641)

    Memory safety bugs fixed in Firefox 69

  * CVE-2019-11735 (bmo#1561404,bmo#1561484,bmo#1568047,bmo#1561912,

    bmo#1565744,bmo#1568858,bmo#1570358)

    Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1

  * CVE-2019-11740 (bmo#1563133,bmo#1573160)

    Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9

- requires

  * rust/cargo >= 1.35

  * rust-cbindgen >= 0.9.0

  * mozilla-nss >= 3.45

- rebased patches

-------------------------------------------------------------------

Wed Sep  4 15:38:40 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- added a bunch of patches mainly for big endian platforms

  * mozilla-bmo1504834-part1.patch

  * mozilla-bmo1504834-part2.patch

  * mozilla-bmo1504834-part3.patch

  * mozilla-bmo1511604.patch

  * mozilla-bmo1554971.patch

  * mozilla-bmo1573381.patch

  * mozilla-nestegg-big-endian.patch

  * mozilla-bmo1512162.patch

-------------------------------------------------------------------

Fri Aug 30 20:49:11 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 68.1.0

  MFSA 2019-26

  * CVE-2019-11751 (bmo#1572838; Windows only)

    Malicious code execution through command line parameters

  * CVE-2019-11746 (bmo#1564449)

    Use-after-free while manipulating video

  * CVE-2019-11744 (bmo#1562033)

    XSS by breaking out of title and textarea elements using innerHTML

  * CVE-2019-11742 (bmo#1559715)

    Same-origin policy violation with SVG filters and canvas to steal

    cross-origin images

  * CVE-2019-11736 (bmo#1551913, bmo#1552206; Windows only))

    File manipulation and privilege escalation in Mozilla Maintenance Service

  * CVE-2019-11753 (bmo#1574980; Windows only)

    Privilege escalation with Mozilla Maintenance Service in custom

    Firefox installation location

  * CVE-2019-11752 (bmo#1501152)

    Use-after-free while extracting a key value in IndexedDB

  * CVE-2019-9812 (bmo#1538008, bmo#1538015)

    Sandbox escape through Firefox Sync

  * CVE-2019-11743 (bmo#1560495)

    Cross-origin access to unload event attributes

  * CVE-2019-11748 (bmo#1564588)

    Persistence of WebRTC permissions in a third party context

  * CVE-2019-11749 (bmo#1565374)

    Camera information available without prompting using getUserMedia

  * CVE-2019-11750 (bmo#1568397)

    Type confusion in Spidermonkey

  * CVE-2019-11738 (bmo#1452037)

    Content security policy bypass through hash-based sources in directives

  * CVE-2019-11747 (bmo#1564481)

    'Forget about this site' removes sites from pre-loaded HSTS list

  * CVE-2019-11735i (bmo#1561404,bmo#1561484,bmo#1568047,bmo#1561912,

    bmo#1565744,bmo#1568858,bmo#1570358)

    Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1

  * CVE-2019-11740 (bmo#1563133,bmo#1573160)

    Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9

- switched package to ESR branch

- added mozilla-bmo1568145.patch to make builds reproducible

- removed upstreamed patch mozilla-gcc-internal-compiler-error.patch

-------------------------------------------------------------------

Sun Aug 18 17:29:25 UTC 2019 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 68.0.2:

  * Fixed a bug causing some special characters to be cut off from

    the end of the search terms when searching from the URL bar

    (bmo#1560228)

  * Allow fonts to be loaded via file:// URLs when opening a page

    locally (bmo#1565942)

  * Printing emails from the Outlook web app no longer prints only

    the header and footer (bmo#1567105)

  * Fixed a bug causing some images not to be displayed on reload,

    including on Google Maps (bmo# 1565542)

  * Fixed an error when starting external applications configured

    as URI handlers (bmo#1567614)

  MFSA 2019-24 (boo#1145665)

  * CVE-2019-11733: Stored passwords in 'Saved Logins' can be

    copied without master password entry (bmo#1565780)

- drop fix-build-after-y2038-changes-in-glibc.patch, upstream

-------------------------------------------------------------------

Fri Aug 16 16:49:24 UTC 2019 - Jonathan Brielmaier <jbrielmaier@suse.de>

- Fix crash when typing in the URL bar on ppc64le (bmo#1512162).

  The upstream patch doesn't resolve the issue on TW, but compiling

  with -O1 does. Do this until we have a proper fix.

-------------------------------------------------------------------

Thu Aug  1 14:25:02 UTC 2019 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Update build constraints to fix arm builds

-------------------------------------------------------------------

Fri Jul 19 08:11:27 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 68.0.1

  * Fixed missing Full Screen button when watching videos in full

    screen mode on HBO GO (bmo#1562837)

  * Fixed a bug causing incorrect messages to appear for some

    locales when sites try to request the use of the Storage

    Access API (bmo#1558503)

  * Users in Russian regions may have their default search engine

    changed (bmo#1565315)

  * Built-in search engines in some locales do not function

    correctly (bmo#1565779)

  * SupportMenu policy doesn't always work (bmo#1553290)

  * Allow the privacy.file_unique_origin pref to be controlled by

    policy (bmo#1563759)

-------------------------------------------------------------------

Thu Jul 11 10:51:39 UTC 2019 - Jiri Slaby <jslaby@suse.com>

- add fix-build-after-y2038-changes-in-glibc.patch

-------------------------------------------------------------------

Wed Jul 10 13:47:41 UTC 2019 - Bernhard Wiedemann <bwiedemann@suse.com>

- Generate langpacks sequentially to avoid file corruption

  from racy file writes (boo#1137970)

-------------------------------------------------------------------

Mon Jul  8 13:30:35 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 68.0

  * Dark mode in reader view

  * Improved extension security and discovery

  * Cryptomining and fingerprinting protections are added to strict

    content blocking settings in Privacy & Security preferences

  * Camera and microphone access now require an HTTPS connection

  MFSA 2019-21 (bsc#1140868)

  * CVE-2019-9811 (bmo#1538007, bmo#1539598, bmo#1563327)

    Sandbox escape via installation of malicious languagepack

  * CVE-2019-11711 (bmo#1552541)

    Script injection within domain through inner window reuse

  * CVE-2019-11712 (bmo#1543804)

    Cross-origin POST requests can be made with NPAPI plugins by

    following 308 redirects

  * CVE-2019-11713 (bmo#1528481)

    Use-after-free with HTTP/2 cached stream

  * CVE-2019-11714 (bmo#1542593)

    NeckoChild can trigger crash when accessed off of main thread

  * CVE-2019-11729 (bmo#1515342)

    Empty or malformed p256-ECDH public keys may trigger a segmentation fault

  * CVE-2019-11715 (bmo#1555523)

    HTML parsing error can contribute to content XSS

  * CVE-2019-11716 (bmo#1552632)

    globalThis not enumerable until accessed

  * CVE-2019-11717 (bmo#1548306)

    Caret character improperly escaped in origins

  * CVE-2019-11718 (bmo#1408349)

    Activity Stream writes unsanitized content to innerHTML

  * CVE-2019-11719 (bmo#1540541)

    Out-of-bounds read when importing curve25519 private key

  * CVE-2019-11720 (bmo#1556230)

    Character encoding XSS vulnerability

  * CVE-2019-11721 (bmo#1256009)

    Domain spoofing through unicode latin 'kra' character

  * CVE-2019-11730 (bmo#1558299)

    Same-origin policy treats all files in a directory as having the

    same-origin

  * CVE-2019-11723 (bmo#1528335)

    Cookie leakage during add-on fetching across private browsing boundaries

  * CVE-2019-11724 (bmo#1512511)

    Retired site input.mozilla.org has remote troubleshooting permissions

  * CVE-2019-11725 (bmo#1483510)

    Websocket resources bypass safebrowsing protections

  * CVE-2019-11727 (bmo#1552208)

    PKCS#1 v1.5 signatures can be used for TLS 1.3

  * CVE-2019-11728 (bmo#1552993)

    Port scanning through Alt-Svc header

  * CVE-2019-11710 (bmo#1549768, bmo#1548611, bmo#1533842, bmo#1537692,

    bmo#1540590, bmo#1551907, bmo#1510345, bmo#1535482, bmo#1535848,

    bmo#1547472, bmo#1547760, bmo#1507696, bmo#1544180)

    Memory safety bugs fixed in Firefox 68

  * CVE-2019-11709 (bmo#1547266, bmo#1540759, bmo#1548822, bmo#1550498

    bmo#1515052, bmo#1539219, bmo#1547757, bmo#1550498, bmo#1533522)

    Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8

- requires

  * NSS 3.44.1

  * rust/cargo 1.34

  * rust-cbindgen 0.8.7

- rebased patches

  * mozilla-aarch64-startup-crash.patch

  * mozilla-kde.patch

  * mozilla-nongnome-proxies.patch

  * firefox-kde.patch

- use new create-tar.sh and add tar_stamps for package definitions

- added patches imported from SLE flavour

  * mozilla-gcc-internal-compiler-error.patch

  * mozilla-bmo1005535.patch

  * mozilla-ppc-altivec_static_inline.patch

  * mozilla-reduce-rust-debuginfo.patch

  * mozilla-s390-bigendian.patch

  * mozilla-s390-context.patch

-------------------------------------------------------------------

Mon Jul  2 14:15:17 UTC 2019 - Martin Liška <mliska@suse.cz>

- Enable PGO for x86_64.

  * added firefox-add-kde.js-in-order-to-survive-PGO-build.patch

-------------------------------------------------------------------

Thu Jun 20 06:20:59 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 67.0.4

  MFSA 2019-19 (boo#1138872)

  * CVE-2019-11708 (bmo#1559858)

    sandbox escape using Prompt:Open

-------------------------------------------------------------------

Tue Jun 18 18:36:15 UTC 2019 - Wolfgang Rosenauer <wr@rosenauer.org>