-------------------------------------------------------------------

Mon Aug  1 12:37:05 UTC 2016 - wr@rosenauer.org

- update to Firefox 48.0 (boo#991809)

  * requires NSS 3.24

  * Process separation (e10s) is enabled for some of you

  * Add-ons that have not been verified and signed by Mozilla will not load

  * WebRTC embetterments

  * The media parser has been redeveloped using the Rust programming

    language

  * better Canvas performance with speedy Skia support

  security fixes:

  * MFSA 2016-62/CVE-2016-2835/CVE-2016-2836

    Miscellaneous memory safety hazards

  * MFSA 2016-63/CVE-2016-2830 (bmo#1255270)

    Favicon network connection can persist when page is closed

  * MFSA 2016-64/CVE-2016-2838 (bmo#1279814)

    Buffer overflow rendering SVG with bidirectional content

  * MFSA 2016-65/CVE-2016-2839 (bmo#1275339)

    Cairo rendering crash due to memory allocation issue with FFmpeg 0.10

  * MFSA 2016-66/CVE-2016-5251 (bmo#1255570)

    Location bar spoofing via data URLs with malformed/invalid mediatypes

  * MFSA 2016-67/CVE-2016-5252 (bmo#1268854)

    Stack underflow during 2D graphics rendering

  * MFSA 2016-68/CVE-2016-0718 (bmo#1236923)

    Out-of-bounds read during XML parsing in Expat library

  * MFSA 2016-69/CVE-2016-5253 (bmo#1246944)

    Arbitrary file manipulation by local user through Mozilla updater

    and callback application path parameter (Windows-only)

  * MFSA 2016-70/CVE-2016-5254 (bmo#1266963)

    Use-after-free when using alt key and toplevel menus

  * MFSA 2016-71/CVE-2016-5255 (bmo#1212356)

    Crash in incremental garbage collection in JavaScript

  * MFSA 2016-72/CVE-2016-5258 (bmo#1279146)

    Use-after-free in DTLS during WebRTC session shutdown

  * MFSA 2016-73/CVE-2016-5259 (bmo#1282992)

    Use-after-free in service workers with nested sync events

  * MFSA 2016-74/CVE-2016-5260 (bmo#1280294)

    Form input type change from password to text can store plain

    text password in session restore file

  * MFSA 2016-75/CVE-2016-5261 (bmo#1287266)

    Integer overflow in WebSockets during data buffering

  * MFSA 2016-76/CVE-2016-5262 (bmo#1277475)

    Scripts on marquee tag can execute in sandboxed iframes

  * MFSA 2016-77/CVE-2016-2837 (bmo#1274637)

    Buffer overflow in ClearKey Content Decryption Module (CDM)

    during video playback

  * MFSA 2016-78/CVE-2016-5263 (bmo#1276897)

    Type confusion in display transformation

  * MFSA 2016-79/CVE-2016-5264 (bmo#1286183)

    Use-after-free when applying SVG effects

  * MFSA 2016-80/CVE-2016-5265 (bmo#1278013)

    Same-origin policy violation using local HTML file and saved shortcut file

  * MFSA 2016-81/CVE-2016-5266 (bmo#1226977)

    Information disclosure and local file manipulation through drag and drop

  * MFSA 2016-82/CVE-2016-5267 (bmo#1284372)

    Addressbar spoofing with right-to-left characters on Firefox for Android

    (Android only)

  * MFSA 2016-83/CVE-2016-5268 (bmo#1253673)

    Spoofing attack through text injection into internal error pages

  * MFSA 2016-84/CVE-2016-5250 (bmo#1254688)

    Information disclosure through Resource Timing API during page navigation

- removed obsolete mozilla-gcc6.patch

-------------------------------------------------------------------

Fri Jul 29 01:26:13 UTC 2016 - badshah400@gmail.com

- Update description and screenshots in appdata.xml file.

-------------------------------------------------------------------

Sat Jul 23 20:13:08 UTC 2016 - antoine.belvire@laposte.net

- Fix Firefox crash on startup on i586 (boo#986541):

  * Add -fno-delete-null-pointer-checks and

    -fno-inline-small-functions to CFLAGS

-------------------------------------------------------------------

Tue Jul 19 20:12:11 UTC 2016 - mailaender@opensuse.org

- Update the appdata.xml file (replace Windows XP screenshot)

-------------------------------------------------------------------

Wed Jun 29 09:25:41 UTC 2016 - astieger@suse.com

- Mozilla Firefox 47.0.1:

  * Selenium WebDriver may cause Firefox to crash at startup

    (bmo#1280854)

-------------------------------------------------------------------

Wed Jun 15 07:52:18 UTC 2016 - wr@rosenauer.org

- mozilla-binutils-visibility.patch to fix build issues with

  gcc/binutils combination used in Leap 42.2 (boo#984637)

-------------------------------------------------------------------

Tue Jun 14 08:35:03 UTC 2016 - badshah400@gmail.com

- Update mozilla-gtk3_20.patch to latest version from Fedora.

-------------------------------------------------------------------

Mon Jun 13 20:28:01 UTC 2016 - agraf@suse.com

- Fix running on 48bit va aarch64 (bsc#984126)

  * add patch mozilla-aarch64-48bit-va.patch

-------------------------------------------------------------------

Mon Jun 13 15:27:13 UTC 2016 - wr@rosenauer.org

- fix XUL dialog button order under KDE session (boo#984403)

-------------------------------------------------------------------

Tue Jun  7 19:47:25 UTC 2016 - wr@rosenauer.org

- update to Firefox 47.0 (boo#983549)

  * Enable VP9 video codec for users with fast machines

  * Embedded YouTube videos now play with HTML5 video if Flash is

    not installed

  * View and search open tabs from your smartphone or another

    computer in a sidebar

  * Allow no-cache on back/forward navigations for https resources

  security fixes:

  * MFSA 2016-49/CVE-2016-2815/CVE-2016-2818

    (boo#983638)

    (bmo#1241896, bmo#1242798, bmo#1243466, bmo#1245743,

     bmo#1264300, bmo#1271037, bmo#1234147, bmo#1256493,

     bmo#1256739, bmo#1256968, bmo#1261230, bmo#1261752,

     bmo#1263384, bmo#1264575, bmo#1265577, bmo#1267130,

     bmo#1269729, bmo#1273202, bmo#1273701)

    Miscellaneous memory safety hazards (rv:47.0 / rv:45.2)

  * MFSA 2016-50/CVE-2016-2819 (boo#983655) (bmo#1270381)

    Buffer overflow parsing HTML5 fragments

  * MFSA 2016-51/CVE-2016-2821 (bsc#983653) (bmo#1271460)

    Use-after-free deleting tables from a contenteditable document

  * MFSA 2016-52/CVE-2016-2822 (boo#983652) (bmo#1273129)

    Addressbar spoofing though the SELECT element

  * MFSA 2016-53/CVE-2016-2824 (boo#983651) (bmo#1248580)

    Out-of-bounds write with WebGL shader

  * MFSA 2016-54/CVE-2016-2825 (boo#983649) (bmo#1193093)

    Partial same-origin-policy through setting location.host

    through data URI

  * MFSA 2016-56/CVE-2016-2828 (boo#983646) (bmo#1223810)

    Use-after-free when textures are used in WebGL operations

    after recycle pool destruction

  * MFSA 2016-57/CVE-2016-2829 (boo#983644) (bmo#1248329)

    Incorrect icon displayed on permissions notifications

  * MFSA 2016-58/CVE-2016-2831 (boo#983643) (bmo#1261933)

    Entering fullscreen and persistent pointerlock without user

    permission

  * MFSA 2016-59/CVE-2016-2832 (boo#983632) (bmo#1025267)

    Information disclosure of disabled plugins through CSS

    pseudo-classes

  * MFSA 2016-60/CVE-2016-2833 (boo#983640) (bmo#908933)

    Java applets bypass CSP protections

  * MFSA 2016-62/CVE-2016-2834 (boo#983639) (bmo#1206283,

    bmo#1221620, bmo#1241034, bmo#1241037)

    Network Security Services (NSS) vulnerabilities

    fixed by requiring NSS 3.23

  packaging changes:

  * cleanup configure options (boo#981695):

    - notably remove GStreamer support which is gone from FF

  * remove obsolete patches

    - mozilla-libproxy.patch

    - mozilla-repo.patch

-------------------------------------------------------------------

Wed May 25 16:36:23 UTC 2016 - badshah400@gmail.com

- The conditional testing for gcc was failing for different

  openSUSE versions, drop it and apply patches unconditionally.

-------------------------------------------------------------------

Mon May 23 15:30:27 UTC 2016 - badshah400@gmail.com

- Add patches to fix building with gcc6:

  + mozilla-gcc6.patch: fix building with gcc >= 6.1; patch

    taken from upstream:

    https://hg.mozilla.org/mozilla-central/rev/55212130f19d.

  + mozilla-exclude-nametablecpp.patch: Exclude NameTable.cpp

    from unified compilation because #include <cmath> in other

    source files causes gcc6 compilation failure; patch taken from

    upstream:

    https://hg.mozilla.org/mozilla-central/rev/9c57b7cacffc.

-------------------------------------------------------------------

Fri May 13 00:00:00 CEST 2016 - dsterba@suse.cz

- enable build with PIE and full relro on x86_64 (boo#980384)

-------------------------------------------------------------------

Wed May  4 10:27:43 UTC 2016 - wr@rosenauer.org

- update to Firefox 46.0.1

  Fixed:

  * Search plugin issue for various locales

  * Add-on signing certificate expiration

  * Service worker update issue

  * Build issue when jit is disabled

  * Limit Sync registration updates

- removed now obsolete mozilla-jit_branch64.patch

-------------------------------------------------------------------

Tue May  3 15:47:18 UTC 2016 - normand@linux.vnet.ibm.com

- add mozilla-jit_branch64.patch to avoid PowerPC build failure

  (from bmo#1266366)

-------------------------------------------------------------------

Wed Apr 27 08:39:28 UTC 2016 - badshah400@gmail.com

- Update mozilla-gtk3_20.patch for Firefox 46.0 (sync to latest

  version from Fedora).

-------------------------------------------------------------------

Wed Apr 27 06:09:30 UTC 2016 - wr@rosenauer.org

- update to Firefox 46.0 (boo#977333)

  * Improved security of the JavaScript Just In Time (JIT) Compiler

  * WebRTC fixes to improve performance and stability

  * Added support for document.elementsFromPoint

  * Added HKDF support for Web Crypto API

  * requires NSPR 4.12 and NSS 3.22.3

  * added patch to fix unchecked return value

    mozilla-check_return.patch

  * Gtk3 builds not supported at the moment

  security fixes:

  * MFSA 2016-39/CVE-2016-2804/CVE-2016-2806/CVE-2016-2807

    (boo#977373, boo#977375, boo#977376)

    Miscellaneous memory safety hazards

  * MFSA 2016-40/CVE-2016-2809 (bmo#1212939, boo#977377)

    Privilege escalation through file deletion by Maintenance Service updater

    (Windows only)

  * MFSA 2016-41/CVE-2016-2810 (bmo#1229681, boo#977378)

    Content provider permission bypass allows malicious application

    to access data (Android only)

  * MFSA 2016-42/CVE-2016-2811/CVE-2016-2812

    (bmo#1252330, bmo#1261776, boo#977379)

    Use-after-free and buffer overflow in Service Workers

  * MFSA 2016-43/CVE-2016-2813 (bmo#1197901, bmo#2714650, boo#977380)

    Disclosure of user actions through JavaScript with motion and

    orientation sensors (only affects mobile variants)

  * MFSA 2016-44/CVE-2016-2814 (bmo#1254721, boo#977381)

    Buffer overflow in libstagefright with CENC offsets

  * MFSA 2016-45/CVE-2016-2816 (bmo#1223743, boo#977382)

    CSP not applied to pages sent with multipart/x-mixed-replace

  * MFSA 2016-46/CVE-2016-2817 (bmo#1227462, boo#977384)

    Elevation of privilege with chrome.tabs.update API in web extensions

  * MFSA 2016-47/CVE-2016-2808 (bmo#1246061, boo#977386)

    Write to invalid HashMap entry through JavaScript.watch()

  * MFSA 2016-48/CVE-2016-2820 (bmo#870870, boo#977388)

    Firefox Health Reports could accept events from untrusted domains

-------------------------------------------------------------------

Thu Apr 21 12:00:28 UTC 2016 - badshah400@gmail.com

- Update mozilla-gtk3_20.patch to fix scrollbar appearance under

  gtk >= 3.20 (patch synced to Fedora's version).

-------------------------------------------------------------------

Tue Apr 12 19:11:30 UTC 2016 - badshah400@gmail.com

- Compile against gtk3 depending on whether the macro

  %firefox_use_gtk3 is defined or not (e.g., at the prjconf

  level); macro is undefined by default and so gtk2 is used as the

  default toolkit.

- Add BuildRequires for additional packages needed when building

  against gtk3: pkgconfig(glib-2.0), pkgconfig(gobject-2.0),

  pkgconfig(gtk+-3.0) >= 3.4.0, pkgconfig(gtk+-unix-print-3.0).

- Add firefox-gtk3_20.patch to fix appearance with gtk3 >= 3.20;

  patch taken from Fedora (bmo#1230955).

-------------------------------------------------------------------

Mon Apr 11 22:49:24 UTC 2016 - astieger@suse.com

- Mozilla Firefox 45.0.2:

  * Fix an issue impacting the cookie header when third-party

    cookies are blocked (bmo#1257861)

  * Fix a web compatibility regression impacting the srcset

    attribute of the image tag (bmo#1259482)

  * Fix a crash impacting the video playback with Media Source

    Extension (bmo#1258562)

  * Fix a regression impacting some specific uploads (bmo#1255735)

  * Fix a regression with the copy and paste with some old versions

    of some Gecko applications like Thunderbird (bmo#1254980)

-------------------------------------------------------------------

Fri Mar 18 08:52:58 UTC 2016 - astieger@suse.com

- Mozilla Firefox 45.0.1:

  * Fix a regression causing search engine settings to be lost in

    some context (bmo#1254694)

  * Bring back non-standard jar: URIs to fix a regression in IBM

    iNotes (bmo#1255139)

  * XSLTProcessor.importStylesheet was failing when <import> was

    used (bmo#1249572)

  * Fix an issue which could cause the list of search provider to

    be empty (bmo#1255605)

  * Fix a regression when using the location bar (bmo#1254503)

  * Fix some loading issues when Accept third-party cookies: was

    set to Never (bmo#1254856)

  * Disabled Graphite font shaping library

-------------------------------------------------------------------

Sun Mar  6 19:52:13 UTC 2016 - wr@rosenauer.org

- update to Firefox 45.0 (boo#969894)

  * requires NSPR 4.12 / NSS 3.21.1

  * Instant browser tab sharing through Hello

  * Synced Tabs button in button bar

  * Tabs synced via Firefox Accounts from other devices are now shown

    in dropdown area of Awesome Bar when searching

  * Introduce a new preference (network.dns.blockDotOnion) to allow

    blocking .onion at the DNS level

  * Tab Groups (Panorama) feature removed

  * MFSA 2016-16/CVE-2016-1952/CVE-2016-1953

    Miscellaneous memory safety hazards

  * MFSA 2016-17/CVE-2016-1954 (bmo#1243178)

    Local file overwriting and potential privilege escalation through

    CSP reports

  * MFSA 2016-18/CVE-2016-1955 (bmo#1208946)

    CSP reports fail to strip location information for embedded iframe pages

  * MFSA 2016-19/CVE-2016-1956 (bmo#1199923)

    Linux video memory DOS with Intel drivers

  * MFSA 2016-20/CVE-2016-1957 (bmo#1227052)

    Memory leak in libstagefright when deleting an array during MP4

    processing

  * MFSA 2016-21/CVE-2016-1958 (bmo#1228754)

    Displayed page address can be overridden

  * MFSA 2016-22/CVE-2016-1959 (bmo#1234949)

    Service Worker Manager out-of-bounds read in Service Worker Manager

  * MFSA 2016-23/CVE-2016-1960/ZDI-CAN-3545 (bmo#1246014)

    Use-after-free in HTML5 string parser

  * MFSA 2016-24/CVE-2016-1961/ZDI-CAN-3574 (bmo#1249377)

    Use-after-free in SetBody

  * MFSA 2016-25/CVE-2016-1962 (bmo#1240760)

    Use-after-free when using multiple WebRTC data channels

  * MFSA 2016-26/CVE-2016-1963 (bmo#1238440)

    Memory corruption when modifying a file being read by FileReader

  * MFSA 2016-27/CVE-2016-1964 (bmo#1243335)

    Use-after-free during XML transformations

  * MFSA 2016-28/CVE-2016-1965 (bmo#1245264)

    Addressbar spoofing though history navigation and Location protocol

    property

  * MFSA 2016-29/CVE-2016-1967 (bmo#1246956)

    Same-origin policy violation using perfomance.getEntries and

    history navigation with session restore

  * MFSA 2016-30/CVE-2016-1968 (bmo#1246742)

    Buffer overflow in Brotli decompression

  * MFSA 2016-31/CVE-2016-1966 (bmo#1246054)

    Memory corruption with malicious NPAPI plugin

  * MFSA 2016-32/CVE-2016-1970/CVE-2016-1971/CVE-2016-1975/

    CVE-2016-1976/CVE-2016-1972

    WebRTC and LibVPX vulnerabilities found through code inspection

  * MFSA 2016-33/CVE-2016-1973 (bmo#1219339)

    Use-after-free in GetStaticInstance in WebRTC

  * MFSA 2016-34/CVE-2016-1974 (bmo#1228103)

    Out-of-bounds read in HTML parser following a failed allocation

  * MFSA 2016-35/CVE-2016-1950 (bmo#1245528)

    Buffer overflow during ASN.1 decoding in NSS

    (fixed by requiring 3.21.1)

  * MFSA 2016-36/CVE-2016-1979 (bmo#1185033)

    Use-after-free during processing of DER encoded keys in NSS

    (fixed by requiring 3.21.1)

  * MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/

    CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/

    CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/

    CVE-2016-2800/CVE-2016-2801/CVE-2016-2802

    Font vulnerabilities in the Graphite 2 library

-------------------------------------------------------------------

Sat Mar  5 15:27:00 UTC 2016 - olaf@aepfle.de

- Remove B_CNT from symbols.zip filename to reduce build-compare noise

-------------------------------------------------------------------

Fri Feb 26 16:22:52 UTC 2016 - astieger@suse.com

- fix build problems on i586, caused by too large unified compile

  units - adding mozilla-reduce-files-per-UnifiedBindings.patch

-------------------------------------------------------------------

Thu Feb 11 07:51:34 UTC 2016 - wr@rosenauer.org

- update to Firefox 44.0.2

  * MFSA 2016-13/CVE-2016-1949 (bmo#1245724, boo#966438)

    Same-origin-policy violation using Service Workers with plugins

  * Fix issue which could lead to the removal of stored passwords

    under certain circumstances (bmo#1242176)

  * Allows spaces in cookie names (bmo#1244505)

  * Disable opus/vorbis audio with H.264 (bmo#1245696)

  * Fix for graphics startup crash (GNU/Linux) (bmo#1222171)

  * Fix a crash in cache networking (bmo#1244076)

  * Fix using WebSockets in service worker controlled pages (bmo#1243942)

-------------------------------------------------------------------

Sat Jan 30 08:28:17 UTC 2016 - dmueller@suse.com

- build fixes for arm/aarch64:

  * disable webrtc for arm/aarch64

  * switch away from openGL-ES backend to default for arm/aarch64

   since it almost never builds

  * reenable neon

- reenable webrtc for powerpc as it seems to build

-------------------------------------------------------------------

Sun Jan 24 09:33:15 UTC 2016 - wr@rosenauer.org

- update to Firefox 44.0

  * MFSA 2016-01/CVE-2016-1930/CVE-2016-1931 boo#963633

    Miscellaneous memory safety hazards

  * MFSA 2016-02/CVE-2016-1933 (bmo#1231761) boo#963634

    Out of Memory crash when parsing GIF format images

  * MFSA 2016-03/CVE-2016-1935 (bmo#1220450) boo#963635

    Buffer overflow in WebGL after out of memory allocation

  * MFSA 2016-04/CVE-2015-7208/CVE-2016-1939 (bmo#1191423, bmo#1233784) boo#963637

    Firefox allows for control characters to be set in cookie names

  * MFSA 2016-06/CVE-2016-1937 (bmo#724353) boo#963641

    Missing delay following user click events in protocol handler dialog

  * MFSA 2016-07/CVE-2016-1938 (bmo#1190248) boo#963731

    Errors in mp_div and mp_exptmod cryptographic functions in NSS

    (fixed by requiring NSS 3.21)

  * MFSA 2016-09/CVE-2016-1942/CVE-2016-1943 (bmo#1189082, bmo#1228590)

    Addressbar spoofing attacks boo#963643

  * MFSA 2016-10/CVE-2016-1944/CVE-2016-1945/CVE-2016-1946

    (bmo#1186621, bmo#1214782, bmo#1232096) boo#963644

    Unsafe memory manipulation found through code inspection

  * MFSA 2016-11/CVE-2016-1947 (bmo#1237103) boo#963645

    Application Reputation service disabled in Firefox 43

  * requires NSPR 4.11

  * requires NSS 3.21

- prepare mozilla-kde.patch for Gtk3 builds

- rebased patches

-------------------------------------------------------------------

Mon Jan 11 08:04:24 UTC 2016 - astieger@suse.com

- Mozilla Firefox 43.0.4:

  * Re-enable SHA-1 certificates to prevent outdated

    man-in-the-middle security devices from interfering with

    properly secured SSL/TLS connections (bmo#1236975)

  * Fix for startup crash for users of a third party antivirus tool

    (bmo#1235537)

- The following change was previously in the package as a patch:

  * Multi-user GNU/Linux download folders can be created

   (bmo#1233434), removed mozilla-bmo1233434.patch

-------------------------------------------------------------------

Tue Dec 29 20:29:35 UTC 2015 - wr@rosenauer.org

- update to Firefox 43.0.3

  * requires NSS 3.20.2 to fix

    MFSA 2015-150/CVE-2015-7575 (bmo#1158489)

    MD5 signatures accepted within TLS 1.2 ServerKeyExchange in

    server signature

  * various changes to support Windows update (SHA-1 vs. SHA-2)

  * workaround Youtube user agent detection issue (bmo#1233970)

- fix file download regression for multi user systems

  (bmo#1233434) (mozilla-bmo1233434.patch)

- explicitely requires libXcomposite-devel

-------------------------------------------------------------------

Sun Dec 13 23:07:56 UTC 2015 - wr@rosenauer.org

- update to Firefox 43.0 (bnc#959277)

  * Improved API support for m4v video playback

  * Users can opt-in to receive search suggestions from the Awesome Bar

  * WebRTC streaming on multiple monitors

  * User selectable second block list for Private Browsing's Tracking

    Protection

  security fixes:

  * MFSA 2015-134/CVE-2015-7201/CVE-2015-7202

    Miscellaneous memory safety hazards

  * MFSA 2015-135/CVE-2015-7204 (bmo#1216130)

    Crash with JavaScript variable assignment with unboxed objects

  * MFSA 2015-136/CVE-2015-7207 (bmo#1185256)

    Same-origin policy violation using perfomance.getEntries and

    history navigation

  * MFSA 2015-137/CVE-2015-7208 (bmo#1191423)

    Firefox allows for control characters to be set in cookies

  * MFSA 2015-138/CVE-2015-7210 (bmo#1218326)

    Use-after-free in WebRTC when datachannel is used after being

    destroyed

  * MFSA 2015-139/CVE-2015-7212 (bmo#1222809)

    Integer overflow allocating extremely large textures

  * MFSA 2015-140/CVE-2015-7215 (bmo#1160890)