-------------------------------------------------------------------

Wed May  4 10:27:43 UTC 2016 - wr@rosenauer.org

- update to Firefox 46.0.1

  Fixed:

  * Search plugin issue for various locales

  * Add-on signing certificate expiration

  * Service worker update issue

  * Build issue when jit is disabled

  * Limit Sync registration updates

- removed now obsolete mozilla-jit_branch64.patch

-------------------------------------------------------------------

Tue May  3 15:47:18 UTC 2016 - normand@linux.vnet.ibm.com

- add mozilla-jit_branch64.patch to avoid PowerPC build failure

  (from bmo#1266366)

-------------------------------------------------------------------

Wed Apr 27 08:39:28 UTC 2016 - badshah400@gmail.com

- Update mozilla-gtk3_20.patch for Firefox 46.0 (sync to latest

  version from Fedora).

-------------------------------------------------------------------

Wed Apr 27 06:09:30 UTC 2016 - wr@rosenauer.org

- update to Firefox 46.0 (boo#977333)

  * Improved security of the JavaScript Just In Time (JIT) Compiler

  * WebRTC fixes to improve performance and stability

  * Added support for document.elementsFromPoint

  * Added HKDF support for Web Crypto API

  * requires NSPR 4.12 and NSS 3.22.3

  * added patch to fix unchecked return value

    mozilla-check_return.patch

  * Gtk3 builds not supported at the moment

  security fixes:

  * MFSA 2016-39/CVE-2016-2804/CVE-2016-2806/CVE-2016-2807

    (boo#977373, boo#977375, boo#977376)

    Miscellaneous memory safety hazards

  * MFSA 2016-40/CVE-2016-2809 (bmo#1212939, boo#977377)

    Privilege escalation through file deletion by Maintenance Service updater

    (Windows only)

  * MFSA 2016-41/CVE-2016-2810 (bmo#1229681, boo#977378)

    Content provider permission bypass allows malicious application

    to access data (Android only)

  * MFSA 2016-42/CVE-2016-2811/CVE-2016-2812

    (bmo#1252330, bmo#1261776, boo#977379)

    Use-after-free and buffer overflow in Service Workers

  * MFSA 2016-43/CVE-2016-2813 (bmo#1197901, bmo#2714650, boo#977380)

    Disclosure of user actions through JavaScript with motion and

    orientation sensors (only affects mobile variants)

  * MFSA 2016-44/CVE-2016-2814 (bmo#1254721, boo#977381)

    Buffer overflow in libstagefright with CENC offsets

  * MFSA 2016-45/CVE-2016-2816 (bmo#1223743, boo#977382)

    CSP not applied to pages sent with multipart/x-mixed-replace

  * MFSA 2016-46/CVE-2016-2817 (bmo#1227462, boo#977384)

    Elevation of privilege with chrome.tabs.update API in web extensions

  * MFSA 2016-47/CVE-2016-2808 (bmo#1246061, boo#977386)

    Write to invalid HashMap entry through JavaScript.watch()

  * MFSA 2016-48/CVE-2016-2820 (bmo#870870, boo#977388)

    Firefox Health Reports could accept events from untrusted domains

-------------------------------------------------------------------

Thu Apr 21 12:00:28 UTC 2016 - badshah400@gmail.com

- Update mozilla-gtk3_20.patch to fix scrollbar appearance under

  gtk >= 3.20 (patch synced to Fedora's version).

-------------------------------------------------------------------

Tue Apr 12 19:11:30 UTC 2016 - badshah400@gmail.com

- Compile against gtk3 depending on whether the macro

  %firefox_use_gtk3 is defined or not (e.g., at the prjconf

  level); macro is undefined by default and so gtk2 is used as the

  default toolkit.

- Add BuildRequires for additional packages needed when building

  against gtk3: pkgconfig(glib-2.0), pkgconfig(gobject-2.0),

  pkgconfig(gtk+-3.0) >= 3.4.0, pkgconfig(gtk+-unix-print-3.0).

- Add firefox-gtk3_20.patch to fix appearance with gtk3 >= 3.20;

  patch taken from Fedora (bmo#1230955).

-------------------------------------------------------------------

Mon Apr 11 22:49:24 UTC 2016 - astieger@suse.com

- Mozilla Firefox 45.0.2:

  * Fix an issue impacting the cookie header when third-party

    cookies are blocked (bmo#1257861)

  * Fix a web compatibility regression impacting the srcset

    attribute of the image tag (bmo#1259482)

  * Fix a crash impacting the video playback with Media Source

    Extension (bmo#1258562)

  * Fix a regression impacting some specific uploads (bmo#1255735)

  * Fix a regression with the copy and paste with some old versions

    of some Gecko applications like Thunderbird (bmo#1254980)

-------------------------------------------------------------------

Fri Mar 18 08:52:58 UTC 2016 - astieger@suse.com

- Mozilla Firefox 45.0.1:

  * Fix a regression causing search engine settings to be lost in

    some context (bmo#1254694)

  * Bring back non-standard jar: URIs to fix a regression in IBM

    iNotes (bmo#1255139)

  * XSLTProcessor.importStylesheet was failing when <import> was

    used (bmo#1249572)

  * Fix an issue which could cause the list of search provider to

    be empty (bmo#1255605)

  * Fix a regression when using the location bar (bmo#1254503)

  * Fix some loading issues when Accept third-party cookies: was

    set to Never (bmo#1254856)

  * Disabled Graphite font shaping library

-------------------------------------------------------------------

Sun Mar  6 19:52:13 UTC 2016 - wr@rosenauer.org

- update to Firefox 45.0 (boo#969894)

  * requires NSPR 4.12 / NSS 3.21.1

  * Instant browser tab sharing through Hello

  * Synced Tabs button in button bar

  * Tabs synced via Firefox Accounts from other devices are now shown

    in dropdown area of Awesome Bar when searching

  * Introduce a new preference (network.dns.blockDotOnion) to allow

    blocking .onion at the DNS level

  * Tab Groups (Panorama) feature removed

  * MFSA 2016-16/CVE-2016-1952/CVE-2016-1953

    Miscellaneous memory safety hazards

  * MFSA 2016-17/CVE-2016-1954 (bmo#1243178)

    Local file overwriting and potential privilege escalation through

    CSP reports

  * MFSA 2016-18/CVE-2016-1955 (bmo#1208946)

    CSP reports fail to strip location information for embedded iframe pages

  * MFSA 2016-19/CVE-2016-1956 (bmo#1199923)

    Linux video memory DOS with Intel drivers

  * MFSA 2016-20/CVE-2016-1957 (bmo#1227052)

    Memory leak in libstagefright when deleting an array during MP4

    processing

  * MFSA 2016-21/CVE-2016-1958 (bmo#1228754)

    Displayed page address can be overridden

  * MFSA 2016-22/CVE-2016-1959 (bmo#1234949)

    Service Worker Manager out-of-bounds read in Service Worker Manager

  * MFSA 2016-23/CVE-2016-1960/ZDI-CAN-3545 (bmo#1246014)

    Use-after-free in HTML5 string parser

  * MFSA 2016-24/CVE-2016-1961/ZDI-CAN-3574 (bmo#1249377)

    Use-after-free in SetBody

  * MFSA 2016-25/CVE-2016-1962 (bmo#1240760)

    Use-after-free when using multiple WebRTC data channels

  * MFSA 2016-26/CVE-2016-1963 (bmo#1238440)

    Memory corruption when modifying a file being read by FileReader

  * MFSA 2016-27/CVE-2016-1964 (bmo#1243335)

    Use-after-free during XML transformations

  * MFSA 2016-28/CVE-2016-1965 (bmo#1245264)

    Addressbar spoofing though history navigation and Location protocol

    property

  * MFSA 2016-29/CVE-2016-1967 (bmo#1246956)

    Same-origin policy violation using perfomance.getEntries and

    history navigation with session restore

  * MFSA 2016-30/CVE-2016-1968 (bmo#1246742)

    Buffer overflow in Brotli decompression

  * MFSA 2016-31/CVE-2016-1966 (bmo#1246054)

    Memory corruption with malicious NPAPI plugin

  * MFSA 2016-32/CVE-2016-1970/CVE-2016-1971/CVE-2016-1975/

    CVE-2016-1976/CVE-2016-1972

    WebRTC and LibVPX vulnerabilities found through code inspection

  * MFSA 2016-33/CVE-2016-1973 (bmo#1219339)

    Use-after-free in GetStaticInstance in WebRTC

  * MFSA 2016-34/CVE-2016-1974 (bmo#1228103)

    Out-of-bounds read in HTML parser following a failed allocation

  * MFSA 2016-35/CVE-2016-1950 (bmo#1245528)

    Buffer overflow during ASN.1 decoding in NSS

    (fixed by requiring 3.21.1)

  * MFSA 2016-36/CVE-2016-1979 (bmo#1185033)

    Use-after-free during processing of DER encoded keys in NSS

    (fixed by requiring 3.21.1)

  * MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/

    CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/

    CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/

    CVE-2016-2800/CVE-2016-2801/CVE-2016-2802

    Font vulnerabilities in the Graphite 2 library

-------------------------------------------------------------------

Sat Mar  5 15:27:00 UTC 2016 - olaf@aepfle.de

- Remove B_CNT from symbols.zip filename to reduce build-compare noise

-------------------------------------------------------------------

Fri Feb 26 16:22:52 UTC 2016 - astieger@suse.com

- fix build problems on i586, caused by too large unified compile

  units - adding mozilla-reduce-files-per-UnifiedBindings.patch

-------------------------------------------------------------------

Thu Feb 11 07:51:34 UTC 2016 - wr@rosenauer.org

- update to Firefox 44.0.2

  * MFSA 2016-13/CVE-2016-1949 (bmo#1245724, boo#966438)

    Same-origin-policy violation using Service Workers with plugins

  * Fix issue which could lead to the removal of stored passwords

    under certain circumstances (bmo#1242176)

  * Allows spaces in cookie names (bmo#1244505)

  * Disable opus/vorbis audio with H.264 (bmo#1245696)

  * Fix for graphics startup crash (GNU/Linux) (bmo#1222171)

  * Fix a crash in cache networking (bmo#1244076)

  * Fix using WebSockets in service worker controlled pages (bmo#1243942)

-------------------------------------------------------------------

Sat Jan 30 08:28:17 UTC 2016 - dmueller@suse.com

- build fixes for arm/aarch64:

  * disable webrtc for arm/aarch64

  * switch away from openGL-ES backend to default for arm/aarch64

   since it almost never builds

  * reenable neon

- reenable webrtc for powerpc as it seems to build

-------------------------------------------------------------------

Sun Jan 24 09:33:15 UTC 2016 - wr@rosenauer.org

- update to Firefox 44.0

  * MFSA 2016-01/CVE-2016-1930/CVE-2016-1931 boo#963633

    Miscellaneous memory safety hazards

  * MFSA 2016-02/CVE-2016-1933 (bmo#1231761) boo#963634

    Out of Memory crash when parsing GIF format images

  * MFSA 2016-03/CVE-2016-1935 (bmo#1220450) boo#963635

    Buffer overflow in WebGL after out of memory allocation

  * MFSA 2016-04/CVE-2015-7208/CVE-2016-1939 (bmo#1191423, bmo#1233784) boo#963637

    Firefox allows for control characters to be set in cookie names

  * MFSA 2016-06/CVE-2016-1937 (bmo#724353) boo#963641

    Missing delay following user click events in protocol handler dialog

  * MFSA 2016-07/CVE-2016-1938 (bmo#1190248) boo#963731

    Errors in mp_div and mp_exptmod cryptographic functions in NSS

    (fixed by requiring NSS 3.21)

  * MFSA 2016-09/CVE-2016-1942/CVE-2016-1943 (bmo#1189082, bmo#1228590)

    Addressbar spoofing attacks boo#963643

  * MFSA 2016-10/CVE-2016-1944/CVE-2016-1945/CVE-2016-1946

    (bmo#1186621, bmo#1214782, bmo#1232096) boo#963644

    Unsafe memory manipulation found through code inspection

  * MFSA 2016-11/CVE-2016-1947 (bmo#1237103) boo#963645

    Application Reputation service disabled in Firefox 43

  * requires NSPR 4.11

  * requires NSS 3.21

- prepare mozilla-kde.patch for Gtk3 builds

- rebased patches

-------------------------------------------------------------------

Mon Jan 11 08:04:24 UTC 2016 - astieger@suse.com

- Mozilla Firefox 43.0.4:

  * Re-enable SHA-1 certificates to prevent outdated

    man-in-the-middle security devices from interfering with

    properly secured SSL/TLS connections (bmo#1236975)

  * Fix for startup crash for users of a third party antivirus tool

    (bmo#1235537)

- The following change was previously in the package as a patch:

  * Multi-user GNU/Linux download folders can be created

   (bmo#1233434), removed mozilla-bmo1233434.patch

-------------------------------------------------------------------

Tue Dec 29 20:29:35 UTC 2015 - wr@rosenauer.org

- update to Firefox 43.0.3

  * requires NSS 3.20.2 to fix

    MFSA 2015-150/CVE-2015-7575 (bmo#1158489)

    MD5 signatures accepted within TLS 1.2 ServerKeyExchange in

    server signature

  * various changes to support Windows update (SHA-1 vs. SHA-2)

  * workaround Youtube user agent detection issue (bmo#1233970)

- fix file download regression for multi user systems

  (bmo#1233434) (mozilla-bmo1233434.patch)

- explicitely requires libXcomposite-devel

-------------------------------------------------------------------

Sun Dec 13 23:07:56 UTC 2015 - wr@rosenauer.org

- update to Firefox 43.0 (bnc#959277)

  * Improved API support for m4v video playback

  * Users can opt-in to receive search suggestions from the Awesome Bar

  * WebRTC streaming on multiple monitors

  * User selectable second block list for Private Browsing's Tracking

    Protection

  security fixes:

  * MFSA 2015-134/CVE-2015-7201/CVE-2015-7202

    Miscellaneous memory safety hazards

  * MFSA 2015-135/CVE-2015-7204 (bmo#1216130)

    Crash with JavaScript variable assignment with unboxed objects

  * MFSA 2015-136/CVE-2015-7207 (bmo#1185256)

    Same-origin policy violation using perfomance.getEntries and

    history navigation

  * MFSA 2015-137/CVE-2015-7208 (bmo#1191423)

    Firefox allows for control characters to be set in cookies

  * MFSA 2015-138/CVE-2015-7210 (bmo#1218326)

    Use-after-free in WebRTC when datachannel is used after being

    destroyed

  * MFSA 2015-139/CVE-2015-7212 (bmo#1222809)

    Integer overflow allocating extremely large textures

  * MFSA 2015-140/CVE-2015-7215 (bmo#1160890)

    Cross-origin information leak through web workers error events

  * MFSA 2015-141/CVE-2015-7211 (bmo#1221444)

    Hash in data URI is incorrectly parsed

  * MFSA 2015-142/CVE-2015-7218/CVE-2015-7219 (bmo#1194818, bmo#1194820)

    DOS due to malformed frames in HTTP/2

  * MFSA 2015-143/CVE-2015-7216/CVE-2015-7217 (bmo#1197059, bmo#1203078)

    Linux file chooser crashes on malformed images due to flaws in

    Jasper library

  * MFSA 2015-144/CVE-2015-7203/CVE-2015-7220/CVE-2015-7221

    (bmo#1201183, bmo#1178033, bmo#1199400)

    Buffer overflows found through code inspection

  * MFSA 2015-145/CVE-2015-7205 (bmo#1220493)

    Underflow through code inspection

  * MFSA 2015-146/CVE-2015-7213 (bmo#1206211)

    Integer overflow in MP4 playback in 64-bit versions

  * MFSA 2015-147/CVE-2015-7222 (bmo#1216748)

    Integer underflow and buffer overflow processing MP4 metadata in

    libstagefright

  * MFSA 2015-148/CVE-2015-7223 (bmo#1226423)

    Privilege escalation vulnerabilities in WebExtension APIs

  * MFSA 2015-149/CVE-2015-7214 (bmo#1228950)

    Cross-site reading attack through data and view-source URIs

- rebased patches

-------------------------------------------------------------------

Sun Nov 15 19:52:20 UTC 2015 - wr@rosenauer.org

- Add desktop menu action for private browsing window to desktop

  file (boo#954747)

- remove obsolete patch mozilla-bmo1005535.patch completely from

  source package to avoid automatic check failures

-------------------------------------------------------------------

Sat Oct 31 19:50:03 UTC 2015 - wr@rosenauer.org

- update to Firefox 42.0 (bnc#952810)

  * Private Browsing with Tracking Protection blocks certain Web

    elements that could be used to record your behavior across sites

  * Control Center that contains site security and privacy controls

  * Login Manager improvements

  * WebRTC improvements

  * Indicator added to tabs that play audio with one-click muting

  * Media Source Extension for HTML5 video available for all sites

  security fixes:

  * MFSA 2015-116/CVE-2015-4513/CVE-2015-4514

    Miscellaneous memory safety hazards

  * MFSA 2015-117/CVE-2015-4515 (bmo#1046421)

    Information disclosure through NTLM authentication

  * MFSA 2015-118/CVE-2015-4518 (bmo#1182778, bmo#1136692)

    CSP bypass due to permissive Reader mode whitelist

  * MFSA 2015-119/CVE-2015-7185 (bmo#1149000) (Android only)

    Firefox for Android addressbar can be removed after fullscreen mode

  * MFSA 2015-120/CVE-2015-7186 (bmo#1193027) (Android only)

    Reading sensitive profile files through local HTML file on Android

  * MFSA 2015-121/CVE-2015-7187 (bmo#1195735)

    disabling scripts in Add-on SDK panels has no effect

  * MFSA 2015-122/CVE-2015-7188 (bmo#1199430)

    Trailing whitespace in IP address hostnames can bypass same-origin policy

  * MFSA 2015-123/CVE-2015-7189 (bmo#1205900)

    Buffer overflow during image interactions in canvas

  * MFSA 2015-124/CVE-2015-7190 (bmo#1208520) (Android only)

    Android intents can be used on Firefox for Android to open privileged files

  * MFSA 2015-125/CVE-2015-7191 (bmo#1208956) (Android only)

    XSS attack through intents on Firefox for Android

  * MFSA 2015-126/CVE-2015-7192 (bmo#1210023) (OS X only)

    Crash when accessing HTML tables with accessibility tools on OS X

  * MFSA 2015-127/CVE-2015-7193 (bmo#1210302)

    CORS preflight is bypassed when non-standard Content-Type headers

    are received

  * MFSA 2015-128/CVE-2015-7194 (bmo#1211262)

    Memory corruption in libjar through zip files

  * MFSA 2015-129/CVE-2015-7195 (bmo#1211871)

    Certain escaped characters in host of Location-header are being

    treated as non-escaped

  * MFSA 2015-130/CVE-2015-7196 (bmo#1140616)

    JavaScript garbage collection crash with Java applet

  * MFSA 2015-131/CVE-2015-7198/CVE-2015-7199/CVE-2015-7200

    (bmo#1188010, bmo#1204061, bmo#1204155)

    Vulnerabilities found through code inspection

  * MFSA 2015-132/CVE-2015-7197 (bmo#1204269)

    Mixed content WebSocket policy bypass through workers

  * MFSA 2015-133/CVE-2015-7181/CVE-2015-7182/CVE-2015-7183

    (bmo#1202868, bmo#1205157)

    NSS and NSPR memory corruption issues

    (fixed in mozilla-nspr and mozilla-nss packages)

- requires NSPR >= 4.10.10 and NSS >= 3.19.4

- removed obsolete patches

  * mozilla-arm-disable-edsp.patch

  * mozilla-icu-strncat.patch

  * mozilla-skia-be-le.patch

  * toolkit-download-folder.patch

- fixed build with enable-libproxy (bmo#1220399)

  * mozilla-libproxy.patch

-------------------------------------------------------------------

Thu Oct 15 08:25:54 UTC 2015 - wr@rosenauer.org

- update to Firefox 41.0.2 (bnc#950686)

  * MFSA 2015-115/CVE-2015-7184 (bmo#1208339, bmo#1212669)

    Cross-origin restriction bypass using Fetch

- added explicit appdata provides (bnc#949983)

-------------------------------------------------------------------

Sun Oct  4 09:20:56 UTC 2015 - wr@rosenauer.org

- do not build with --enable-stdcxx-compat

  (this starts to fail build on various toolchain combinations

  and is not required for openSUSE builds in general

-------------------------------------------------------------------

Thu Oct  1 09:49:57 UTC 2015 - wr@rosenauer.org

- update to Firefox 41.0.1

  * Fix a startup crash related to Yandex toolbar and Adblock Plus

    (bmo#1209124)

  * Fix potential hangs with Flash plugins (bmo#1185639)

  * Fix a regression in the bookmark creation (bmo#1206376)

  * Fix a startup crash with some Intel Media Accelerator 3150