-------------------------------------------------------------------

Tue Mar 27 06:40:25 UTC 2018 - wr@rosenauer.org

- update to Firefox 59.0.2

  * Invalid page rendering with hardware acceleration enabled (bmo#1435472)

  * Browser keyboard shortcuts (eg copy Ctrl+C) don't work on sites

    that use those keys with resistFingerprinting enabled (bmo#1433592)

  * High CPU / memory churn caused by third-party software on some

    computers (bmo#1446280)

  * Users who have configured an "automatic proxy configuration URL"

    and want to reload their proxy settings from the URL will find

    the Reload button disabled in the Connection Settings dialog when

    they select Preferences/Options>Network Proxy>Settings... (bmo#1445991)

  * URL Fragment Identifiers Break Service Worker Responses (bmo#1443850)

  * User's trying to cancel a print around the time it completes will

    continue to get intermittent crashes (bmo#1441598)

  * CVE-2018-5148 (bmo#1440717)

    Use-after-free in compositor

- removed obsolete patch mozilla-bmo1446062.patch

-------------------------------------------------------------------

Wed Mar 21 17:14:24 UTC 2018 - cgrobertson@suse.com

- Added patches:

  * mozilla-i586-DecoderDoctorLogger.patch - bmo#1447070

    fixes non-unified build error

  * mozilla-i586-domPrefs.patch - DOMPrefs.h

    fixes 32bit build error

-------------------------------------------------------------------

Fri Mar 16 06:40:11 UTC 2018 - wr@rosenauer.org

- update to Firefox 59.0.1 (bsc#1085671)

  MFSA 2018-08

  * CVE-2018-5146 (bmo#1446062)

    Vorbis audio processing out of bounds write

  * CVE-2018-5147 (bmo#1446365)

    Out of bounds memory write in libtremor

    (mozilla-bmo1446062.patch)

-------------------------------------------------------------------

Wed Mar 14 19:27:07 UTC 2018 - cgrobertson@suse.com

- Added patch:

  * mozilla-bmo1005535.patch:

    Enable skia_gpu on big endian platforms.

-------------------------------------------------------------------

Sun Mar 11 22:12:12 UTC 2018 - wr@rosenauer.org

- update to Firefox 59.0

  * Performance enhancements

  * Drag-and-drop to rearrange Top Sites on the Firefox Home page

  * added features for Firefox Screenshots

  * Enhanced WebExtensions API

  * Improved RTC capabilities

  MFSA 2018-06 (bsc#1085130)

  * CVE-2018-5127 (bmo#1430557)

    Buffer overflow manipulating SVG animatedPathSegList

  * CVE-2018-5128 (bmo#1431336)

    Use-after-free manipulating editor selection ranges

  * CVE-2018-5129 (bmo#1428947)

    Out-of-bounds write with malformed IPC messages

  * CVE-2018-5130 (bmo#1433005)

    Mismatched RTP payload type can trigger memory corruption

  * CVE-2018-5131 (bmo#1440775)

    Fetch API improperly returns cached copies of no-store/no-cache resources

  * CVE-2018-5132 (bmo#1408194)

    WebExtension Find API can search privileged pages

  * CVE-2018-5133 (bmo#1430511, bmo#1430974)

    Value of the app.support.baseURL preference is not properly sanitized

  * CVE-2018-5134 (bmo#1429379)

    WebExtensions may use view-source: URLs to bypass content restrictions

  * CVE-2018-5135 (bmo#1431371)

    WebExtension browserAction can inject scripts into unintended contexts

  * CVE-2018-5136 (bmo#1419166)

    Same-origin policy violation with data: URL shared workers

  * CVE-2018-5137 (bmo#1432870)

    Script content can access legacy extension non-contentaccessible resources

  * CVE-2018-5138 (bmo#1432624) (Android only)

    Android Custom Tab address spoofing through long domain names

  * CVE-2018-5140 (bmo#1424261)

    Moz-icon images accessible to web content through moz-icon: protocol

  * CVE-2018-5141 (bmo#1429093)

    DOS attack through notifications Push API

  * CVE-2018-5142 (bmo#1366357)

    Media Capture and Streams API permissions display incorrect origin

    with data: and blob: URLs

  * CVE-2018-5143 (bmo#1422643)

    Self-XSS pasting javascript: URL with embedded tab into addressbar

  * CVE-2018-5126

    Memory safety bugs fixed in Firefox 59

  * CVE-2018-5125

    Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7

- requires NSPR 4.18 and NSS 3.35

- requires rust >= 1.22.1

- removed obsolete patches:

  mozilla-alsa-sandbox.patch

  mozilla-enable-csd.patch

  firefox-no-default-ualocale.patch

- removed l10n_changesets.txt since same information is now in

  Firefox source tree (updated create-tar.sh now requires jq)

-------------------------------------------------------------------

Fri Feb  9 13:37:46 UTC 2018 - astieger@suse.com

- Mozilla Firefox 58.0.2:

  * Blocklisted graphics drivers related to off main thread painting

    crashes

  * Fix tab crash during printing

  * Fix clicking links and scrolling emails on Microsoft Hotmail

    and Outlook (OWA) webmail

-------------------------------------------------------------------

Fri Feb  9 12:06:31 UTC 2018 - wr@rosenauer.org

- correct requires and provides handling (boo#1076907)

-------------------------------------------------------------------

Tue Feb  6 07:03:42 UTC 2018 - fstrba@suse.com

- Added patch:

  * mozilla-alsa-sandbox.patch: Fix bmo#1430274, ALSA sound (still

    or again?) not working in Firefox 58 due to sandboxing.

-------------------------------------------------------------------

Mon Jan 29 22:32:21 UTC 2018 - wr@rosenauer.org

- update to Firefox 58.0.1

  MFSA 2018-05

  * Arbitrary code execution through unsanitized browser UI (bmo#1432966)

- use correct language packs

- readd mozilla-enable-csd.patch as it only lands for FF59 upstream

- allow larger number of nested elements (mozilla-bmo256180.patch)

-------------------------------------------------------------------

Tue Jan 23 20:40:57 UTC 2018 - wr@rosenauer.org

- update to Firefox 58.0 (bsc#1077291)

  * Added Nepali (ne-NP) locale

  * Added support for form autofill for credit card

  * Optimize page load by caching JavaScript internal representation

  MFSA 2018-02

  * CVE-2018-5091 (bmo#1423086)

    Use-after-free with DTMF timers

  * CVE-2018-5092 (bmo#1418074)

    Use-after-free in Web Workers

  * CVE-2018-5093 (bmo#1415291)

    Buffer overflow in WebAssembly during Memory/Table resizing

  * CVE-2018-5094 (bmo#1415883)

    Buffer overflow in WebAssembly with garbage collection on

    uninitialized memory

  * CVE-2018-5095 (bmo#1418447)

    Integer overflow in Skia library during edge builder allocation

  * CVE-2018-5097 (bmo#1387427)

    Use-after-free when source document is manipulated during XSLT

  * CVE-2018-5098 (bmo#1399400)

    Use-after-free while manipulating form input elements

  * CVE-2018-5099 (bmo#1416878)

    Use-after-free with widget listener

  * CVE-2018-5100 (bmo#1417405)

    Use-after-free when IsPotentiallyScrollable arguments are freed

    from memory

  * CVE-2018-5101 (bmo#1417661)

    Use-after-free with floating first-letter style elements

  * CVE-2018-5102 (bmo#1419363)

    Use-after-free in HTML media elements

  * CVE-2018-5103 (bmo#1423159)

    Use-after-free during mouse event handling

  * CVE-2018-5104 (bmo#1425000)

    Use-after-free during font face manipulation

  * CVE-2018-5105 (bmo#1390882)

    WebExtensions can save and execute files on local file system

    without user prompts

  * CVE-2018-5106 (bmo#1408708)

    Developer Tools can expose style editor information cross-origin

    through service worker

  * CVE-2018-5107 (bmo#1379276)

    Printing process will follow symlinks for local file access

  * CVE-2018-5108 (bmo#1421099)

    Manually entered blob URL can be accessed by subsequent private browsing tabs

  * CVE-2018-5109 (bmo#1405599)

    Audio capture prompts and starts with incorrect origin attribution

  * CVE-2018-5110 (bmo#1423275) (affects only OS X)

    Cursor can be made invisible on OS X

  * CVE-2018-5111 (bmo#1321619)

    URL spoofing in addressbar through drag and drop

  * CVE-2018-5112 (bmo#1425224)

    Extension development tools panel can open a non-relative URL in the panel

  * CVE-2018-5113 (bmo#1425267)

    WebExtensions can load non-HTTPS pages with browser.identity.launchWebAuthFlow

  * CVE-2018-5114 (bmo#1421324)

    The old value of a cookie changed to HttpOnly remains accessible to scripts

  * CVE-2018-5115 (bmo#1409449)

    Background network requests can open HTTP authentication in unrelated foreground tabs

  * CVE-2018-5116 (bmo#1396399)

    WebExtension ActiveTab permission allows cross-origin frame content access

  * CVE-2018-5117 (bmo#1395508)

    URL spoofing with right-to-left text aligned left-to-right

  * CVE-2018-5118 (bmo#1420049)

    Activity Stream images can attempt to load local content through file:

  * CVE-2018-5119 (bmo#1420507)

    Reader view will load cross-origin content in violation of CORS headers

  * CVE-2018-5121 (bmo#1402368) (affects only OS X)

    OS X Tibetan characters render incompletely in the addressbar

  * CVE-2018-5122 (bmo#1413841)

    Potential integer overflow in DoCrypt

  * CVE-2018-5090

    Memory safety bugs fixed in Firefox 58

  * CVE-2018-5089

    Memory safety bugs fixed in Firefox 58 and Firefox ESR 52.6

- requires NSS 3.34.1

- requires rust 1.21

- removed obsolete patches:

  mozilla-bindgen-systemlibs.patch

  mozilla-bmo1360278.patch

  mozilla-bmo1399611-csd.patch

  mozilla-rust-1.23.patch

- rebased patches

- updated man-page

-------------------------------------------------------------------

Tue Jan  9 18:48:02 UTC 2018 - wr@rosenauer.org

- fixed build with latest rust (mozilla-rust-1.23.patch)

-------------------------------------------------------------------

Thu Jan  4 12:23:41 UTC 2018 - wr@rosenauer.org

- update to Firefox 57.0.4

  MFSA 2018-1: Speculative execution side-channel attack ("Spectre")

  (boo#1074723)

-------------------------------------------------------------------

Wed Jan  3 08:29:38 UTC 2018 - wr@rosenauer.org

- fixed regression introduced Oct 10th which made Firefox crash

  when cancelling the KDE file dialog (boo#1069962)

-------------------------------------------------------------------

Fri Dec 29 19:52:34 UTC 2017 - astieger@suse.com

- Mozilla Firefox 57.0.3:

  * Fix a crash reporting issue that inadvertently sends background

    tab crash reports to Mozilla without user opt-in (bmo#1427111,

    bsc#1074235)

- Includes changes from 57.0.2:

  * fixes for platforms other than GNU/Linux

-------------------------------------------------------------------

Fri Dec  8 15:52:17 UTC 2017 - dimstar@opensuse.org

- Explicitly buildrequires python2-xml: The build system relies on

  it. We wrongly relied on other packages pulling it in for us.

-------------------------------------------------------------------

Thu Dec  7 11:12:31 UTC 2017 - dimstar@opensuse.org

- Escape the usage of %{VERSION} when calling out to rpm.

  RPM 4.14 has %{VERSION} defined as 'the main packages version'.

-------------------------------------------------------------------

Wed Nov 29 23:45:03 UTC 2017 - wr@rosenauer.org

- update to Firefox 57.0.1

  * CVE-2017-7843: Web worker in Private Browsing mode can write

    IndexedDB data (bsc#1072034, bmo#1410106)

  * CVE-2017-7844: Visited history information leak through SVG

    image (bsc#1072036, bmo#1420001)

  * Fix a video color distortion issue on YouTube and other video

    sites with some AMD devices (bmo#1417442)

  * Fix an issue with prefs.js when the profile path has non-ascii

    characters (bmo#1420427)

-------------------------------------------------------------------

Tue Nov 21 09:00:48 UTC 2017 - christophe@krop.fr

- Add mozilla-bmo1360278.patch

  Starting with Firefox 57, the context menu appears on key press.

  This patch creates a config entry to restore the

  old behaviour. Without the patch, the mouse gesture extensions

  require 2 clicks to work (bmo#1360278).

  The new config entry is named ui.context_menus.after_mouseup

  (default : false).

-------------------------------------------------------------------

Sat Nov 18 08:35:21 UTC 2017 - wr@rosenauer.org

- Allow experimental CSD for Gtk3 (bmo#1399611) if available and enabled

  widget.allow-client-side-decoration=true

  (mozilla-bmo1399611-csd.patch)

-------------------------------------------------------------------

Wed Nov 15 06:46:06 UTC 2017 - wr@rosenauer.org

- update to Firefox 57.0 (boo#1068101)

  * Firefox Quantum

  * Photon UI

  * Unified address and search bar

  * AMD VP9 hardware video decoder support

  * Added support for Date/Time input

  * stricter security sandbox blocking filesystem reading and

    writing on Linux systems

  * middle mouse paste in the content area no longer navigates to

    URLs by default on Unix systems

  MFSA 2017-24

  * CVE-2017-7828 (bmo#1406750. bmo#1412252)

    Use-after-free of PressShell while restyling layout

  * CVE-2017-7830 (bmo#1408990)

    Cross-origin URL information leak through Resource Timing API

  * CVE-2017-7831 (bmo#1392026)

    Information disclosure of exposed properties on JavaScript proxy

    objects

  * CVE-2017-7832 (bmo#1408782)

    Domain spoofing through use of dotless 'i' character followed

    by accent markers

  * CVE-2017-7833 (bmo#1370497)

    Domain spoofing with Arabic and Indic vowel marker characters

  * CVE-2017-7834 (bmo#1358009)

    data: URLs opened in new tabs bypass CSP protections

  * CVE-2017-7835 (bmo#1402363)

    Mixed content blocking incorrectly applies with redirects

  * CVE-2017-7836 (bmo#1401339)

    Pingsender dynamically loads libcurl on Linux and OS X

  * CVE-2017-7837 (bmo#1325923)

    SVG loaded as <img> can use meta tags to set cookies

  * CVE-2017-7838 (bmo#1399540)

    Failure of individual decoding of labels in international domain

    names triggers punycode display of entire IDN

  * CVE-2017-7839 (bmo#1402896)

    Control characters before javascript: URLs defeats self-XSS

    prevention mechanism

  * CVE-2017-7840 (bmo#1366420)

    Exported bookmarks do not strip script elements from user-supplied

    tags

  * CVE-2017-7842 (bmo#1397064)

    Referrer Policy is not always respected for <link> elements

  * CVE-2017-7827

    Memory safety bugs fixed in Firefox 57

  * CVE-2017-7826

    Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5

- requires NSPR 4.17, NSS 3.33 and rustc 1.19

- rebased patches

- added mozilla-bindgen-systemlibs.patch to allow stylo build

  with system libs (bmo#1341234)

- removed mozilla-language.patch since the whole locale code

  changed in Firefox and is relying on ICU now

- removed obsolete mozilla-ucontext.patch

-------------------------------------------------------------------

Sat Oct 28 06:30:37 UTC 2017 - wr@rosenauer.org

- update to Firefox 56.0.2

  * Disable Form Autofill completely on user request (bmo#1404531)

  * Fix for video-related crashes on Windows 7 (bmo#1409141)

  * Correct detection for 64-bit GSSAPI authentication (bmo#1409275)

  * Fix for shutdown crash (bmo#1404105)

-------------------------------------------------------------------

Tue Oct 10 11:47:49 UTC 2017 - wr@rosenauer.org

- update to Firefox 56.0.1

  * Block D3D11 when using Intel drivers on Windows 7 systems with

    partial AVX support (bmo#1403353)

  -> just to sync the version number

- enable stylo for TW (requires LLVM >= 3.9)

- queue KDE filepicker requests to avoid non-opening file dialogs

  happening in certain situations (contributed by Ignaz Forster)

- the placeholder dot in KDE file dialog in case of empty filenames

  was removed, apparently not required (anymore)

  (contributed by Ignaz Forster)

-------------------------------------------------------------------

Sun Oct  1 18:25:16 UTC 2017 - stefan.bruens@rwth-aachen.de

- Correct plugin directory for aarch64 (boo#1061207). The wrapper

  script was not detecting aarch64 as a 64 bit architecture, thus

  used /usr/lib/browser-plugins/.

-------------------------------------------------------------------

Sat Sep 30 20:10:50 UTC 2017 - zaitor@opensuse.org

- Drop libgnomeui-devel, and replace it with pkgconfig(gconf-2.0),

  pkgconfig(gtk+-2.0), pkgconfig(gtk+-unix-print-2.0),

  pkgconfig(glib-2.0), pkgconfig(gobject-2.0) and

  pkgconfig(gdk-x11-2.0) BuildRequires, align with what configure

  looks for.

-------------------------------------------------------------------

Thu Sep 28 08:28:29 UTC 2017 - wr@rosenauer.org

- update to Firefox 56.0 (boo#1060445)

  * Firefox Screenshots

  * Find Options/Preferences more quickly with new search function

  * Media is no longer auto-played when opened in a background tab

  * Enable CSS Grid Layout View

  MFSA 2017-21

  * CVE-2017-7793 (bmo#1371889)

    Use-after-free with Fetch API

  * CVE-2017-7817 (bmo#1356596) (Android-only)

    Firefox for Android address bar spoofing through fullscreen mode

  * CVE-2017-7818 (bmo#1363723)

    Use-after-free during ARIA array manipulation

  * CVE-2017-7819 (bmo#1380292)

    Use-after-free while resizing images in design mode

  * CVE-2017-7824 (bmo#1398381)

    Buffer overflow when drawing and validating elements with ANGLE

  * CVE-2017-7805 (bmo#1377618) (fixed via NSS requirement)

    Use-after-free in TLS 1.2 generating handshake hashes

  * CVE-2017-7812 (bmo#1379842)

    Drag and drop of malicious page content to the tab bar can open locally stored files

  * CVE-2017-7814 (bmo#1376036)

    Blob and data URLs bypass phishing and malware protection warnings

  * CVE-2017-7813 (bmo#1383951)

    Integer truncation in the JavaScript parser

  * CVE-2017-7825 (bmo#1393624, bmo#1390980) (OSX-only)

    OS X fonts render some Tibetan and Arabic unicode characters as spaces

  * CVE-2017-7815 (bmo#1368981)

    Spoofing attack with modal dialogs on non-e10s installations

  * CVE-2017-7816 (bmo#1380597)

    WebExtensions can load about: URLs in extension UI

  * CVE-2017-7821 (bmo#1346515)

    WebExtensions can download and open non-executable files without user interaction

  * CVE-2017-7823 (bmo#1396320)

    CSP sandbox directive did not create a unique origin

  * CVE-2017-7822 (bmo#1368859)

    WebCrypto allows AES-GCM with 0-length IV

  * CVE-2017-7820 (bmo#1378207)

    Xray wrapper bypass with new tab and web console

  * CVE-2017-7811

    Memory safety bugs fixed in Firefox 56

  * CVE-2017-7810

    Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4

- requires NSPR 4.16 and NSS 3.32.1

- rebased patches

-------------------------------------------------------------------

Thu Sep 28 07:53:13 UTC 2017 - dimstar@opensuse.org

- Add alsa-devel BuildRequires: we care for ALSA support to be

  built and thus need to ensure we get the dependencies in place.

  In the past, alsa-devel was pulled in by accident: we

  buildrequire libgnome-devel. This required esound-devel and that

  in turn pulled in alsa-devel for us. libgnome is being fixed to

  no longer require esound-devel.

-------------------------------------------------------------------

Mon Sep  4 18:27:44 UTC 2017 - wr@rosenauer.org

- update to Firefox 55.0.3

  * Fix an issue with addons when using a path containing non-ascii

    characters (bmo#1389160)

  * Fix file uploads to some websites, including YouTube (bmo#1383518)

- fix Google API key build integration

- add mozilla-ucontext.patch to fix Tumbleweed build

- do not enable XINPUT2 for now (boo#1053959)

-------------------------------------------------------------------

Fri Aug 11 08:32:30 UTC 2017 - wr@rosenauer.org

- update to Firefox 55.0.1

  * Fix a regression the tab restoration process (bmo#1388160)

  * Fix a problem causing What's new pages not to be displayed (bmo#1386224)

  * Fix a rendering issue with some PKCS#11 libraries (bmo#1388370)

  * Disable the predictor prefetch (bmo#1388160)

-------------------------------------------------------------------

Sat Aug  5 13:22:16 UTC 2017 - wr@rosenauer.org

- update to Firefox 55.0 (boo#1052829)

  * Browsing sessions with a high number of tabs are now restored

    in an instant

  * Sidebar (bookmarks, history, synced tabs) can now be moved to

    the right edge of the window

  * Fine-tune your browser performance from the Preferences/Options page.

  * Make screenshots of webpages, and save them locally or upload

    them to the cloud. This feature will undergo A/B testing and

    will not be visible for some users.

  * Added Belarusian (be) locale

  * Simplify print jobs from within print preview

  * Use virtual reality devices with the web with the introduction

    of WebVR

  * Search suggestions are now enabled by default for users who

    haven't explicitly opted-out

  * Search with any installed search engine directly from the