-------------------------------------------------------------------

- Mozilla Firefox 111.0.1 (boo#1209688)

  * Fixed a crash on macOS while pinch-zooming under some circumstances

    (bmo#1658986)

  * Fixed a bug causing Firefox to freeze on startup for some

    Windows users (bmo#1823159)

-------------------------------------------------------------------

Tue Mar 14 14:29:09 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 111.0

  * https://www.mozilla.org/en-US/firefox/111.0/releasenotes

  MFSA 2023-09 (bsc#1209173)

  * CVE-2023-28159 (bmo#1783561)

    Fullscreen Notification could have been hidden by download

    popups on Android

  * CVE-2023-25748 (bmo#1798798)

    Fullscreen Notification could have been hidden by window

    prompts on Android

  * CVE-2023-25749 (bmo#1810705)

    Firefox for Android may have opened third-party apps without

    a prompt

  * CVE-2023-25750 (bmo#1814733)

    Potential ServiceWorker cache leak during private browsing mode

  * CVE-2023-25751 (bmo#1814899)

    Incorrect code generation during JIT compilation

  * CVE-2023-28160 (bmo#1802385)

    Redirect to Web Extension files may have leaked local path

  * CVE-2023-28164 (bmo#1809122)

    URL being dragged from a removed cross-origin iframe into the

    same tab triggered navigation

  * CVE-2023-28161 (bmo#1811181)

    One-time permissions granted to a local file were extended to

    other local files loaded in the same tab

  * CVE-2023-28162 (bmo#1811327)

    Invalid downcast in Worklets

  * CVE-2023-25752 (bmo#1811627)

    Potential out-of-bounds when accessing throttled streams

  * CVE-2023-28163 (bmo#1817768)

    Windows Save As dialog resolved environment variables

  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904, bmo#1817442,

    bmo#1818674)

    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9

  * CVE-2023-28177 (bmo#1803109, bmo#1808832, bmo#1809542, bmo#1817336)

    Memory safety bugs fixed in Firefox 111

- ensure gcc11-c++ gets used on Leap 15.5

- requires NSS >= 3.88.1

- removed obsolete patches

  gcc13-fix.patch

  mozilla-bmo1810584.patch

- rebased patches

- update create-tar.sh

-------------------------------------------------------------------

Tue Mar  7 09:40:11 UTC 2023 - Martin Liška <mliska@suse.cz>

- Cherry-pick upstream changes for GCC 13 in gcc13-fix.patch.

-------------------------------------------------------------------

Mon Mar  6 20:09:41 UTC 2023 - Andreas Schwab <schwab@suse.de>

- Limit memory use on riscv64

-------------------------------------------------------------------

Sat Mar  4 16:03:22 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>

- Fix 32 bit build bmo#1810584 (add mozilla-bmo1810584.patch)

-------------------------------------------------------------------

Fri Mar  3 17:29:27 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 110.0.1 (boo#1208886)

  * Fixed clearing recent cookies clears all cookies

    (bmo#1816279)

  * Fixed WebGL crashes on Linux when ran inside a VMWare virtual

    machine (bmo#1807942)

  * Fixed a bug with CSP serialization causing bugs with the MitID

    Digital ID in Denmark (bmo#1819096)

-------------------------------------------------------------------

Wed Feb 15 09:56:46 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 110.0

  * https://www.mozilla.org/en-US/firefox/110.0/releasenotes

  MFSA 2023-05 (bsc#1208144)

  * CVE-2023-25728 (bmo#1790345)

    Content security policy leak in violation reports using iframes

  * CVE-2023-25730 (bmo#1794622)

    Screen hijack via browser fullscreen mode

  * CVE-2023-25743 (bmo#1800203)

    Fullscreen notification not shown in Firefox Focus

  * CVE-2023-0767 (bmo#1804640)

    Arbitrary memory write via PKCS 12 in NSS

  * CVE-2023-25735 (bmo#1810711)

    Potential use-after-free from compartment mismatch in SpiderMonkey

  * CVE-2023-25737 (bmo#1811464)

    Invalid downcast in SVGUtils::SetupStrokeGeometry

  * CVE-2023-25738 (bmo#1811852)

    Printing on Windows could potentially crash Firefox with some

    device drivers

  * CVE-2023-25739 (bmo#1811939)

    Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext

  * CVE-2023-25729 (bmo#1792138)

    Extensions could have opened external schemes without user knowledge

  * CVE-2023-25732 (bmo#1804564)

    Out of bounds memory write from EncodeInputStream

  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143, bmo#1812338)

    Opening local .url files could cause unexpected network loads

  * CVE-2023-25740 (bmo#1812354)

    Opening local .scf files could cause unexpected network loads

  * CVE-2023-25731 (bmo#1801542)

    Prototype pollution when rendering URLPreview

  * CVE-2023-25733 (bmo#1808632)

    Possible null pointer dereference in TaskbarPreviewCallback

  * CVE-2023-25736 (bmo#1811331)

    Invalid downcast in GetTableSelectionMode

  * CVE-2023-25741 (bmo#1437126, bmo#1812611, bmo#1813376)

    Same-origin policy leak via image drag and drop

  * CVE-2023-25742 (bmo#1813424)

    Web Crypto ImportKey crashes tab

  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)

    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8

  * CVE-2023-25745 (bmo#1688592, bmo#1797186, bmo#1804998,

    bmo#1806521, bmo#1813284)

    Memory safety bugs fixed in Firefox 110

- requires

  NSS = 3.87

  rust/cargo = 1.66

- update create-tar.sh

-------------------------------------------------------------------

Wed Feb  1 19:48:47 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 109.0.1

  * Fixed jank when loading pages containing a large number of

    emoji characters (bmo#1809081)

  * Fixed an issue causing authentication prompts to not appear

    when loading pages in some enterprise environments

    (bmo#1809151)

  * ixed inconsistent sizing of event listener checkboxes inside

    the Inspector developer tool (bmo#1811760)

-------------------------------------------------------------------

Mon Jan 16 06:54:09 UTC 2023 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 109.0

  MFSA 2023-01 (bsc#1207119)

  * CVE-2023-23597 (bmo#1538028)

    Logic bug in process allocation allowed to read arbitrary

    files

  * CVE-2023-23598 (bmo#1800425)

    Arbitrary file read from GTK drag and drop on Linux

  * CVE-2023-23599 (bmo#1777800)

    Malicious command could be hidden in devtools output on

    Windows

  * CVE-2023-23600 (bmo#1787034)

    Notification permissions persisted between Normal and Private

    Browsing on Android

  * CVE-2023-23601 (bmo#1794268)

    URL being dragged from cross-origin iframe into same tab

    triggers navigation

  * CVE-2023-23602 (bmo#1800890)

    Content Security Policy wasn't being correctly applied to

    WebSockets in WebWorkers

  * CVE-2023-23603 (bmo#1800832)

    Calls to <code>console.log</code> allowed bypasing Content

    Security Policy via format directive

  * CVE-2023-23604 (bmo#1802346)

    Creation of duplicate <code>SystemPrincipal</code> from less

    secure contexts

  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)

    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7

  * CVE-2023-23606 (bmo#1764974, bmo#1798591, bmo#1799201,

    bmo#1800446, bmo#1801248, bmo#1802100, bmo#1803393,

    bmo#1804626, bmo#1804971, bmo#1807004)

    Memory safety bugs fixed in Firefox 109

- requires NSS 3.86

- rebased patches

-------------------------------------------------------------------

Fri Jan  6 06:57:25 UTC 2023 - Luciano Santos <luc14n0@opensuse.org>

- Mozilla Firefox 108.0.2

  * Fixes a crash that might occur when managing browser history

    (bmo#1806408).

- Drop merged-upstream mozilla-bmo1805809.patch.

-------------------------------------------------------------------

Wed Dec 21 16:05:26 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- add mozilla-bmo1805809.patch to fix build for x86-32 (boo#1206600)

-------------------------------------------------------------------

Tue Dec 20 07:58:58 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 108.0.1 (boo#1206507)

  * Fixes the default search engine being reset on upgrade for

    profiles which were previously copied from a different location

-------------------------------------------------------------------

Tue Dec 13 13:54:35 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 108.0

  https://www.mozilla.org/en-US/firefox/108.0/releasenotes/

  MFSA 2022-51 (bsc#1206242)

  * CVE-2022-46871 (bmo#1795697)

    libusrsctp library out of date

  * CVE-2022-46872 (bmo#1799156)

    Arbitrary file read from a compromised content process

  * CVE-2022-46873 (bmo#1644790)

    Firefox did not implement the CSP directive unsafe-hashes

  * CVE-2022-46874 (bmo#1746139)

    Drag and Dropped Filenames could have been truncated to

    malicious extensions

  * CVE-2022-46875 (bmo#1786188)

    Download Protections were bypassed by .atloc and .ftploc

    files on Mac OS

  * CVE-2022-46877 (bmo#1795139)

    Fullscreen notification bypass

  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,

    bmo#1801102, bmo#1801315, bmo#1802395)

    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6

  * CVE-2022-46879 (bmo#1736224, bmo#1793407, bmo#1794249, bmo#1795845,

    bmo#1797682, bmo#1797720, bmo#1798494, bmo#1799479)

    Memory safety bugs fixed in Firefox 108

- requires

  NSS >= 3.85

  rustc/cargo 1.65

-------------------------------------------------------------------

Thu Dec  8 08:42:14 UTC 2022 - Milachew <milachew@mail.lv>

- added translations to .desktop file.

-------------------------------------------------------------------

Thu Dec  1 21:13:32 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 107.0.1:

  * Fix an issue with accessing some sites reliably in Private

    Browsing mode or Strict ETP due to anti-adblockers

    (bmo#1717806)

  * Fix an issue where Color Management was not available for

    some users (bmo#1799391)

  * Fix an issue with text overlapping in the Settings Menu for

    some locales (bmo#1800379)

  * Fix an issue where the DevTools UI is not accessible when an

    alert dialog is displayed (bmo#1801840)

-------------------------------------------------------------------

Tue Nov 15 14:22:26 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 107.0

  MFSA 2022-47 (bsc#1205270)

 * CVE-2022-45403 (bmo#1762078)

    Service Workers might have learned size of cross-origin media files

  * CVE-2022-45404 (bmo#1790815)

    Fullscreen notification bypass

  * CVE-2022-45405 (bmo#1791314)

    Use-after-free in InputStream implementation

  * CVE-2022-45406 (bmo#1791975)

    Use-after-free of a JavaScript Realm

  * CVE-2022-45407 (bmo#1793314)

    Loading fonts on workers was not thread-safe

  * CVE-2022-45408 (bmo#1793829)

    Fullscreen notification bypass via windowName

  * CVE-2022-45409 (bmo#1796901)

    Use-after-free in Garbage Collection

  * CVE-2022-45410 (bmo#1658869)

    ServiceWorker-intercepted requests bypassed SameSite cookie policy

  * CVE-2022-45411 (bmo#1790311)

    Cross-Site Tracing was possible via non-standard override headers

  * CVE-2022-45412 (bmo#1791029)

    Symlinks may resolve to partially uninitialized buffers

  * CVE-2022-45413 (bmo#1791201)

    SameSite=Strict cookies could have been sent cross-site via

    intent URLs

  * CVE-2022-40674 (bmo#1791598)

    Use-after-free vulnerability in expat

  * CVE-2022-45415 (bmo#1793551)

    Downloaded file may have been saved with malicious extension

  * CVE-2022-45416 (bmo#1793676)

    Keystroke Side-Channel Leakage

  * CVE-2022-45417 (bmo#1794508)

    Service Workers in Private Browsing Mode may have been

    written to disk

  * CVE-2022-45418 (bmo#1795815)

    Custom mouse cursor could have been drawn over browser UI

  * CVE-2022-45419 (bmo#1716082)

    Deleting a security exception did not take effect immediately

  * CVE-2022-45420 (bmo#1792643)

    Iframe contents could be rendered outside the iframe

  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)

    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5

- requires

  * NSS >= 3.84

  * rust = 1.64

-------------------------------------------------------------------

Sat Nov  5 13:16:42 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 106.0.5

  * Addresses a crash experienced by users with Intel Gemini Lake

    CPUs (bmo#1702019)

- Mozilla Firefox 106.0.4

  * Fixed an issue with DRM Video playback (bmo#1797292)

  * Fixed broken layout of datetime input when switching

    types (bmo#1797139)

-------------------------------------------------------------------

Tue Nov  1 19:26:39 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 106.0.3

  * Fixes for other platforms

-------------------------------------------------------------------

Thu Oct 27 18:07:29 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 106.0.2

  * Fix missing content on some PDF forms (bmo#1794351)

  * Fix column width for the Notification sub-panel in Settings

    (bmo#1793558)

  * Fix a browser freeze with accessibility enabled on some sites

    such as the Proxmox Web UI (bmo#1793748)

  * Fix page reloading not working with Firefox View and not

    refreshing synced data (bmo#1792680, bmo#1794474)

-------------------------------------------------------------------

Sun Oct 23 07:34:50 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 106.0.1

  * Addresses a crash experienced by users with AMD Zen 1 CPUs

    (bmo#1796126)

-------------------------------------------------------------------

Sun Oct 16 20:08:21 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 106.0

  * support editing of PDFs

  * introduced Firefox View

  * major WebRTC update

    - Better screen sharing for Windows and Linux Wayland users

    - RTP performance and reliability improvements

    - Richer statistics

    - Cross-browser and service compatibility improvements

  * detailed releasenotes

    https://www.mozilla.org/en-US/firefox/106.0/releasenotes

  MFSA 2022-44 (bsc#1204421)

  * CVE-2022-42927 (bmo#1789128)

    Same-origin policy violation could have leaked cross-origin URLs

  * CVE-2022-42928 (bmo#1791520)

    Memory Corruption in JS Engine

  * CVE-2022-42929 (bmo#1789439)

    Denial of Service via window.print

  * CVE-2022-42930 (bmo#1789503)

    Race condition in DOM Workers

  * CVE-2022-42931 (bmo#1780571)

    Username saved to a plaintext file on disk

  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)

    Memory safety bugs fixed in Firefox

- added -msse2 flag to fix i386 build and workaround bmo#1795993

- fixed used buildflags

- renamed mozilla-i686-build.patch to mozilla-buildfixes.patch

  as it was extended with changes for other archs

-------------------------------------------------------------------

Sat Oct  8 13:41:12 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 105.0.3:

  * Fixes for other platforms

-------------------------------------------------------------------

Wed Oct  5 18:27:01 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 105.0.2:

  * Fixed poor contrast on various menu items with certain

    themes on Linux systems (bmo#1792063)

  * Fixed the scrollbar appearing on the wrong side of

    `select` elements in right-to-left locales (bmo#1791219)

  * Fixed a possible deadlock when loading some sites in

    Troubleshoot Mode (bmo#1786259)

  * Fixed a bug causing some dynamic appearance changes to

    not appear when expected (bmo#1786521)

  * Fixed a bug causing theme styling to not be properly applied

    to sidebars for some add-ons in Private Browsing Mode

    (bmo#1787543)

-------------------------------------------------------------------

Thu Sep 22 22:12:39 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 105.0.1

  * Reverted focus behavior for new windows back to the content

    area instead of the address bar (bmo#1784692)

- added mozilla-i686-build.patch to avoid using avx2

-------------------------------------------------------------------

Sat Sep 17 21:01:10 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 105.0

  https://www.mozilla.org/en-US/firefox/105.0/releasenotes

  MFSA 2022-40 (bsc#1203477)

  * CVE-2022-40959 (bmo#1782211)

    Bypassing FeaturePolicy restrictions on transient pages

  * CVE-2022-40960 (bmo#1787633)

    Data-race when parsing non-UTF-8 URLs in threads

  * CVE-2022-40958 (bmo#1779993)

    Bypassing Secure Context restriction for cookies with __Host

    and __Secure prefix

  * CVE-2022-40961 (bmo#1784588)

    Stack-buffer overflow when initializing Graphics

  * CVE-2022-40956 (bmo#1770094)

    Content-Security-Policy base-uri bypass

  * CVE-2022-40957 (bmo#1777604)

    Incoherent instruction cache when building WASM on ARM64

  * CVE-2022-40962 (bmo#1767360, bmo#1776655, bmo#1777574,

    bmo#1784835, bmo#1785109, bmo#1786502, bmo#1789440)

    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3

- requires

  NSS 3.82

  Rust 1.63 (1.61)

- removed obsolete mozilla-glibc236.patch

-------------------------------------------------------------------

Fri Sep  9 05:59:03 UTC 2022 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Adjust memory requirements to fix build on aarch64

-------------------------------------------------------------------

Wed Sep  7 06:50:24 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 104.0.2 (boo#1203177)

  https://www.mozilla.org/en-US/firefox/104.0.2/releasenotes/

  * Fixed a bug making it impossible to use touch or a stylus to

    drag the scrollbar on pages (bmo#1787361)

  * Fixed an issue causing some users to crash in out-of-memory

    conditions (bmo#1774155)

  * Fixed an issue that would sometimes affect video & audio playback

    when loaded via a cross-origin iframe src attribute (bmo#1781759)

  * Fixed an issue that would sometimes affect video & audio playback

    when served with Content-Security-Policy: sandbox (bmo#1781063)

-------------------------------------------------------------------

Thu Sep  1 07:04:11 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 104.0.1

  * Addresses an issue with Youtube video playback that was

    affecting some users (boo#1203003)

-------------------------------------------------------------------

Sun Aug 21 11:12:14 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 104.0

  * https://www.mozilla.org/en-US/firefox/104.0/releasenotes

  MFSA 2022-33 (bsc#1202645)

  * CVE-2022-38472 (bmo#1769155)

    Address bar spoofing via XSLT error handling

  * CVE-2022-38473 (bmo#1771685)

    Cross-origin XSLT Documents would have inherited the parent's

    permissions

  * CVE-2022-38474 (bmo#1719511)

    Recording notification not shown when microphone was

    recording on Android

  * CVE-2022-38475 (bmo#1773266)

    Attacker could write a value to a zero-length array

  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159, bmo#1773363)

    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2

  * CVE-2022-38478 (bmo#1770630, bmo#1776658)

    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,

    and Firefox ESR 91.13

- requires

  NSPR 4.34.1

  NSS 3.81

  rust 1.62

-------------------------------------------------------------------

Sat Aug 13 06:25:20 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- added mozilla-glibc236.patch (bmo#1782988, boo#1202323)

-------------------------------------------------------------------

Tue Aug  9 08:46:29 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 103.0.2

  * Fixed menu shortcuts for users of the JAWS screen reader

  * Fixed an occasional non-overridable certificate error when

    accessing device configuration pages

-------------------------------------------------------------------

Tue Aug  2 08:05:28 UTC 2022 - Andreas Schwab <schwab@suse.de>

- The --disable-elf-hack option only exists on ARM and X86