-------------------------------------------------------------------

Sat Sep 22 09:03:53 UTC 2018 - astieger@suse.com

- Mozilla Firefox 62.0.2:

  MFSA 2018-22

  * CVE-2018-12385 (boo#1109363, bmo#1490585)

    Crash in TransportSecurityInfo due to cached data

  * Unvisited bookmarks can once again be autofilled in the address

    bar

  * Fix WebGL rendering issues

  * Fix fallback on startup when a language pack is missing

  * Avoid crash when sharing a profile with newer (as yet

    unreleased) versions of Firefox

  * Do not undo removal of search engines when using a language

    pack

  * Fixed rendering of some web sites

  * Restored compatibility with some sites using deprecated TLS

    settings

- disable rust debug symbols to fix build on %ix86

-------------------------------------------------------------------

Mon Sep  3 10:47:43 UTC 2018 - wr@rosenauer.org

- update to Firefox 62.0

  * Firefox Home (the default New Tab) now allows users to display

    up to 4 rows of top sites, Pocket stories, and highlights

  * "Reopen in Container" tab menu option appears for users with

    Containers that lets them choose to reopen a tab in a different

    container

  * In advance of removing all trust for Symantec-issued certificates

    in Firefox 63, a preference was added that allows users to distrust

    certificates issued by Symantec. To use this preference, go to

    about:config in the address bar and set the preference

    "security.pki.distrust_ca_policy" to 2.

  * Support for CSS Shapes, allowing for richer web page layouts.

    This goes hand in hand with a brand new Shape Path Editor in the

    CSS inspector.

  * CSS Variable Fonts (OpenType Font Variations) support, which makes

    it possible to create beautiful typography with a single font file

  * Added Canadian English (en-CA) locale

  MFSA 2018-20 (bsc#1107343)

  * CVE-2018-12377 (bmo#1470260)

    Use-after-free in refresh driver timers

  * CVE-2018-12378 (bmo#1459383)

    Use-after-free in IndexedDB

  * CVE-2018-12379 (bmo#1473113) (updater is disabled for us)

    Out-of-bounds write with malicious MAR file

  * CVE-2017-16541 (bmo#1412081)

    Proxy bypass using automount and autofs

  * CVE-2018-12381 (bmo#1435319)

    Dragging and dropping Outlook email message results in page navigation

  * CVE-2018-12382 (bmo#1479311) (Android only)

    Addressbar spoofing with javascript URI on Firefox for Android

  * CVE-2018-12383 (bmo#1475775)

    Setting a master password post-Firefox 58 does not delete

    unencrypted previously stored passwords

  * CVE-2018-12375

    Memory safety bugs fixed in Firefox 62

  * CVE-2018-12376

    Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2

- requires NSS >= 3.38

- removed obsolete patch

  mozilla-bmo1464766.patch

-------------------------------------------------------------------

Thu Aug  9 14:22:00 UTC 2018 - wr@rosenauer.org

- update to Firefox 61.0.2

  * Improved website rendering with the Retained Display List feature

    enabled (bmo#1474402)

  * Fixed broken DevTools panels with certain extensions installed

    (bmo#1474379)

  * Fixed a crash for users with some accessibility tools enabled

    (bmo#1474007)

-------------------------------------------------------------------

Mon Jul  9 07:22:09 UTC 2018 - astieger@suse.com

- Mozilla Firefox 61.0.1:

  * Fix missing content on the New Tab Page and the Home section of

    the Preferences page (bmo#1471375)

  * Fixed loss of bookmarks under rare circumstances when upgrading

    from Firefox 60 (bmo#1472127)

  * Improved playback of Twitch 1080p video streams (bmo#1469257)

  * Web pages no longer lose focus when a browser popup window is

    opened (bmo#1471415)

  * Re-allowed downloading files from FTP sites via the "Save Link

    As" option when linked from HTTP pages (bmo#1470295)

  * Fixed extensions being unable to override the default homepage

    in certain situations (bmo#1466846)

-------------------------------------------------------------------

Sat Jun 23 07:25:51 UTC 2018 - wr@rosenauer.org

- update to Firefox 61.0

  * Performance enhancements

  * Various improvements for dark theme support will provide a more

    consistent experience across the entire Firefox UI

  * OpenSearch plugins offered by web pages can now be added from the

    page action menu for easier installation

  * Improved support for allowing WebExtensions to manage and hide tabs

  MFSA 2018-15 (bsc#1098998)

  * CVE-2018-12359 (bmo#1459162)

    Buffer overflow using computed size of canvas element

  * CVE-2018-12360 (bmo#1459693)

    Use-after-free when using focus()

  * CVE-2018-12361 (bmo#1463244)

    Integer overflow in SwizzleData

  * CVE-2018-12358 (bmo#1467852)

    Same-origin bypass using service worker and redirection

  * CVE-2018-12362 (bmo#1452375)

    Integer overflow in SSSE3 scaler

  * CVE-2018-5156 (bmo#1453127)

    Media recorder segmentation fault when track type is changed during capture

  * CVE-2018-12363 (bmo#1464784)

    Use-after-free when appending DOM nodes

  * CVE-2018-12364 (bmo#1436241)

    CSRF attacks through 307 redirects and NPAPI plugins

  * CVE-2018-12365 (bmo#1459206)

    Compromised IPC child process can list local filenames

  * CVE-2018-12371 (bmo#1465686) 

    Integer overflow in Skia library during edge builder allocation

  * CVE-2018-12366 (bmo#1464039)

    Invalid data handling during QCMS transformations

  * CVE-2018-12367 (bmo#1462891)

    Timing attack mitigation of PerformanceNavigationTiming

  * CVE-2018-12369 (bmo#1454909)

    WebExtension security permission checks bypassed by embedded experiments

  * CVE-2018-12370 (bmo#1456652)

    SameSite cookie protections bypassed when exiting Reader View

  * CVE-2018-5186 (bmo#1464872,bmo#1463329,bmo#1419373,bmo#1412882,

    bmo#1413033,bmo#1444673,bmo#1454448,bmo#1453505,bmo#1438671)

    Memory safety bugs fixed in Firefox 61

  * CVE-2018-5187 (bmo#1461324,bmo#1414829,bmo#1395246,bmo#1467938,

    bmo#1461619,bmo#1425930,bmo#1438556,bmo#1454285,bmo#1459568,

    bmo#1463884)

    Memory safety bugs fixed in Firefox 60 and Firefox ESR 60.1

  * CVE-2018-5188 (bmo#1456189,bmo#1456975,bmo#1465898,bmo#1392739,

    bmo#1451297,bmo#1464063,bmo#1437842,bmo#1442722,bmo#1452576,

    bmo#1450688,bmo#1458264,bmo#1458270,bmo#1465108,bmo#1464829,

    bmo#1464079,bmo#1463494,bmo#1458048)

    Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9

- requires NSS 3.37.3

- requires python >= 3.5 to build

- removed obsolete patches

  mozilla-i586-DecoderDoctorLogger.patch

  mozilla-i586-domPrefs.patch

  mozilla-fix-skia-aarch64.patch

  mozilla-bmo1375074.patch

  mozilla-enable-csd.patch

- patch for new no-return warnings (mozilla-no-return.patch)

- do not disable system installed locales (mozilla-bmo1464766.patch)

-------------------------------------------------------------------

Fri Jun  8 10:52:13 UTC 2018 - bjorn.lie@gmail.com

- Add conditional for pkgconfig(gconf-2.0) BuildRequires, and pass

  conditional --disable-gconf to configure: no longer pull in

  obsolete gconf2 for Tumbleweed.

-------------------------------------------------------------------

Thu Jun  7 12:11:06 UTC 2018 - wr@rosenauer.org

- update to Firefox 60.0.2

  * requires NSS 3.36.4

  MFSA 2018-14 (bsc#1096449)

  * CVE-2018-6126 (bmo#1462682)

    Heap buffer overflow rasterizing paths in SVG with Skia

-------------------------------------------------------------------

Wed Jun  6 18:57:52 UTC 2018 - guillaume.gardet@opensuse.org

- Add upstream patch to fix boo#1093059 instead of '-ffixed-x28'

  workaround:

  * mozilla-bmo1375074.patch

-------------------------------------------------------------------

Sat May 26 15:53:25 UTC 2018 - wr@rosenauer.org

- fixed "open with" option under KDE (boo#1094747)

- workaround crash on startup on aarch64 (boo#1093059)

  (contributed by guillaume.gardet@arm.com)

-------------------------------------------------------------------

Wed May 23 08:49:09 UTC 2018 - guillaume.gardet@opensuse.org

- Disable webrtc for aarch64 due to bmo#1434589

- Add patch to fix skia build on AArch64:

  * mozilla-fix-skia-aarch64.patch

-------------------------------------------------------------------

Thu May 17 14:01:18 UTC 2018 - wr@rosenauer.org

- update to Firefox 60.0.1

  * Avoid overly long cycle collector pauses with some add-ons installed

    (bmo#1449033)

  * After unckecking the "Sponsored Stories" option, the New Tab page

    now immediately stops displaying "Sponsored content" cards (bmo#1458906)

  * On touchscreen devices, fixed momentum scrolling on non-zoomable pages

    (bmo#1457743)

  * Use the right default background when opening tabs or windows in

    high contrast mode (bmo#1458956)

  * Restored translations of the Preferences panels when using a

    language pack (bmo#1461590)

-------------------------------------------------------------------

Mon May 14 13:37:38 UTC 2018 - pcerny@suse.com

- parellelise locales building

-------------------------------------------------------------------

Mon May  7 08:32:28 UTC 2018 - wr@rosenauer.org

- update to Firefox 60.0

  * Added a policy engine that allows customized Firefox deployments

    in enterprise environments, using Windows Group Policy or a

    cross-platform JSON file

  * Applied Quantum CSS to render browser UI

  * Added support for Web Authentication, allowing the use of USB

    tokens for authentication to web sites

  * Locale added: Occitan (oc)

  MFSA 2018-11 (bsc#1092548)

  * CVE-2018-5154 (bmo#1443092)

    Use-after-free with SVG animations and clip paths

  * CVE-2018-5155 (bmo#1448774)

    Use-after-free with SVG animations and text paths

  * CVE-2018-5157 (bmo#1449898)

    Same-origin bypass of PDF Viewer to view protected PDF files

  * CVE-2018-5158 (bmo#1452075)

    Malicious PDF can inject JavaScript into PDF Viewer

  * CVE-2018-5159 (bmo#1441941)

    Integer overflow and out-of-bounds write in Skia

  * CVE-2018-5160 (bmo#1436117)

    Uninitialized memory use by WebRTC encoder

  * CVE-2018-5152 (bmo#1415644, bmo#1427289)

    WebExtensions information leak through webRequest API

  * CVE-2018-5153 (bmo#1436809)

    Out-of-bounds read in mixed content websocket messages

  * CVE-2018-5163 (bmo#1426353)

    Replacing cached data in JavaScript Start-up Bytecode Cache

  * CVE-2018-5164 (bmo#1416045)

    CSP not applied to all multipart content sent with

    multipart/x-mixed-replace

  * CVE-2018-5166 (bmo#1437325)

    WebExtension host permission bypass through filterReponseData

  * CVE-2018-5167 (bmo#1447969)

    Improper linkification of chrome: and javascript: content in

    web console and JavaScript debugger

  * CVE-2018-5168 (bmo#1449548)

    Lightweight themes can be installed without user interaction

  * CVE-2018-5169 (bmo#1319157)

    Dragging and dropping link text onto home button can set home page

    to include chrome pages

  * CVE-2018-5172 (bmo#1436482)

    Pasted script from clipboard can run in the Live Bookmarks page

    or PDF viewer

  * CVE-2018-5173 (bmo#1438025)

    File name spoofing of Downloads panel with Unicode characters

  * CVE-2018-5174 (bmo#1447080) (Windows-only)

    Windows Defender SmartScreen UI runs with less secure behavior

    for downloaded files in Windows 10 April 2018 Update

  * CVE-2018-5175 (bmo#1432358)

    Universal CSP bypass on sites using strict-dynamic in their policies

  * CVE-2018-5176 (bmo#1442840)

    JSON Viewer script injection

  * CVE-2018-5177 (bmo#1451908)

    Buffer overflow in XSLT during number formatting

  * CVE-2018-5165 (bmo#1451452)

    Checkbox for enabling Flash protected mode is inverted in 32-bit

    Firefox

  * CVE-2018-5180 (bmo#1444086)

    heap-use-after-free in mozilla::WebGLContext::DrawElementsInstanced

  * CVE-2018-5181 (bmo#1424107)

    Local file can be displayed in noopener tab through drag and

    drop of hyperlink

  * CVE-2018-5182 (bmo#1435908)

    Local file can be displayed from hyperlink dragged and dropped

    on addressbar

  * CVE-2018-5151

    Memory safety bugs fixed in Firefox 60

  * CVE-2018-5150

    Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8

- removed obsolete patches

  0001-Bug-1435695-WebRTC-fails-to-build-with-GCC-8-r-dmino.patch

  mozilla-bmo1005535.patch

- requires NSPR 4.19 and NSS 3.36.1

- requires rust 1.24 or higher

- use upstream source archive and detached signature for

  source verification

-------------------------------------------------------------------

Thu May  3 14:33:37 UTC 2018 - guillaume.gardet@opensuse.org

- Fix armv7 build by:

  * adding RUSTFLAGS="-Cdebuginfo=0"

  * updating _constraints for %arm

-------------------------------------------------------------------

Wed May  2 20:46:37 UTC 2018 - wr@rosenauer.org

- do not try CSD on kwin (boo#1091592)

- fix build in openSUSE:Leap:42.3:Update, use gcc7

-------------------------------------------------------------------

Tue May  1 14:26:24 UTC 2018 - astieger@suse.com

- Mozilla Firefox 59.0.3:

  * fixes for platforms other than GNU/Linux

-------------------------------------------------------------------

Fri Apr 20 12:31:52 UTC 2018 - mliska@suse.cz

- Add 0001-Bug-1435695-WebRTC-fails-to-build-with-GCC-8-r-dmino.patch

  in order to fix boo#1090362.

-------------------------------------------------------------------

Mon Apr  2 00:55:45 UTC 2018 - badshah400@gmail.com

- Add back mozilla-enable-csd.patch: New rebased version from

  Fedora for version 59.0.x.

-------------------------------------------------------------------

Tue Mar 27 14:07:11 UTC 2018 - schwab@suse.de

- Reduce constraints on aarch64

-------------------------------------------------------------------

Tue Mar 27 06:40:25 UTC 2018 - wr@rosenauer.org

- update to Firefox 59.0.2

  * Invalid page rendering with hardware acceleration enabled (bmo#1435472)

  * Browser keyboard shortcuts (eg copy Ctrl+C) don't work on sites

    that use those keys with resistFingerprinting enabled (bmo#1433592)

  * High CPU / memory churn caused by third-party software on some

    computers (bmo#1446280)

  * Users who have configured an "automatic proxy configuration URL"

    and want to reload their proxy settings from the URL will find

    the Reload button disabled in the Connection Settings dialog when

    they select Preferences/Options>Network Proxy>Settings... (bmo#1445991)

  * URL Fragment Identifiers Break Service Worker Responses (bmo#1443850)

  * User's trying to cancel a print around the time it completes will

    continue to get intermittent crashes (bmo#1441598)

  MFSA 2018-10 (bsc#1087059)

  * CVE-2018-5148 (bmo#1440717)

    Use-after-free in compositor

- removed obsolete patch mozilla-bmo1446062.patch

-------------------------------------------------------------------

Wed Mar 21 17:14:24 UTC 2018 - cgrobertson@suse.com

- Added patches:

  * mozilla-i586-DecoderDoctorLogger.patch - bmo#1447070

    fixes non-unified build error

  * mozilla-i586-domPrefs.patch - DOMPrefs.h

    fixes 32bit build error

-------------------------------------------------------------------

Fri Mar 16 06:40:11 UTC 2018 - wr@rosenauer.org

- update to Firefox 59.0.1 (bsc#1085671)

  MFSA 2018-08

  * CVE-2018-5146 (bmo#1446062)

    Vorbis audio processing out of bounds write

  * CVE-2018-5147 (bmo#1446365)

    Out of bounds memory write in libtremor

    (mozilla-bmo1446062.patch)

-------------------------------------------------------------------

Wed Mar 14 19:27:07 UTC 2018 - cgrobertson@suse.com

- Added patch:

  * mozilla-bmo1005535.patch:

    Enable skia_gpu on big endian platforms.

-------------------------------------------------------------------

Sun Mar 11 22:12:12 UTC 2018 - wr@rosenauer.org

- update to Firefox 59.0

  * Performance enhancements

  * Drag-and-drop to rearrange Top Sites on the Firefox Home page

  * added features for Firefox Screenshots

  * Enhanced WebExtensions API

  * Improved RTC capabilities

  MFSA 2018-06 (bsc#1085130)

  * CVE-2018-5127 (bmo#1430557)

    Buffer overflow manipulating SVG animatedPathSegList

  * CVE-2018-5128 (bmo#1431336)

    Use-after-free manipulating editor selection ranges

  * CVE-2018-5129 (bmo#1428947)

    Out-of-bounds write with malformed IPC messages

  * CVE-2018-5130 (bmo#1433005)

    Mismatched RTP payload type can trigger memory corruption

  * CVE-2018-5131 (bmo#1440775)

    Fetch API improperly returns cached copies of no-store/no-cache resources

  * CVE-2018-5132 (bmo#1408194)

    WebExtension Find API can search privileged pages

  * CVE-2018-5133 (bmo#1430511, bmo#1430974)

    Value of the app.support.baseURL preference is not properly sanitized

  * CVE-2018-5134 (bmo#1429379)

    WebExtensions may use view-source: URLs to bypass content restrictions

  * CVE-2018-5135 (bmo#1431371)

    WebExtension browserAction can inject scripts into unintended contexts

  * CVE-2018-5136 (bmo#1419166)

    Same-origin policy violation with data: URL shared workers

  * CVE-2018-5137 (bmo#1432870)

    Script content can access legacy extension non-contentaccessible resources

  * CVE-2018-5138 (bmo#1432624) (Android only)

    Android Custom Tab address spoofing through long domain names

  * CVE-2018-5140 (bmo#1424261)

    Moz-icon images accessible to web content through moz-icon: protocol

  * CVE-2018-5141 (bmo#1429093)

    DOS attack through notifications Push API

  * CVE-2018-5142 (bmo#1366357)

    Media Capture and Streams API permissions display incorrect origin

    with data: and blob: URLs

  * CVE-2018-5143 (bmo#1422643)

    Self-XSS pasting javascript: URL with embedded tab into addressbar

  * CVE-2018-5126

    Memory safety bugs fixed in Firefox 59

  * CVE-2018-5125

    Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7

- requires NSPR 4.18 and NSS 3.35

- requires rust >= 1.22.1

- removed obsolete patches:

  mozilla-alsa-sandbox.patch

  mozilla-enable-csd.patch

  firefox-no-default-ualocale.patch

- removed l10n_changesets.txt since same information is now in

  Firefox source tree (updated create-tar.sh now requires jq)

-------------------------------------------------------------------

Fri Feb  9 13:37:46 UTC 2018 - astieger@suse.com

- Mozilla Firefox 58.0.2:

  * Blocklisted graphics drivers related to off main thread painting

    crashes

  * Fix tab crash during printing

  * Fix clicking links and scrolling emails on Microsoft Hotmail

    and Outlook (OWA) webmail

-------------------------------------------------------------------

Fri Feb  9 12:06:31 UTC 2018 - wr@rosenauer.org

- correct requires and provides handling (boo#1076907)

-------------------------------------------------------------------

Tue Feb  6 07:03:42 UTC 2018 - fstrba@suse.com

- Added patch:

  * mozilla-alsa-sandbox.patch: Fix bmo#1430274, ALSA sound (still

    or again?) not working in Firefox 58 due to sandboxing.

-------------------------------------------------------------------

Mon Jan 29 22:32:21 UTC 2018 - wr@rosenauer.org

- update to Firefox 58.0.1

  MFSA 2018-05

  * Arbitrary code execution through unsanitized browser UI (bmo#1432966)

- use correct language packs

- readd mozilla-enable-csd.patch as it only lands for FF59 upstream

- allow larger number of nested elements (mozilla-bmo256180.patch)

-------------------------------------------------------------------

Tue Jan 23 20:40:57 UTC 2018 - wr@rosenauer.org

- update to Firefox 58.0 (bsc#1077291)

  * Added Nepali (ne-NP) locale

  * Added support for form autofill for credit card

  * Optimize page load by caching JavaScript internal representation

  MFSA 2018-02

  * CVE-2018-5091 (bmo#1423086)

    Use-after-free with DTMF timers

  * CVE-2018-5092 (bmo#1418074)

    Use-after-free in Web Workers

  * CVE-2018-5093 (bmo#1415291)

    Buffer overflow in WebAssembly during Memory/Table resizing

  * CVE-2018-5094 (bmo#1415883)

    Buffer overflow in WebAssembly with garbage collection on

    uninitialized memory

  * CVE-2018-5095 (bmo#1418447)

    Integer overflow in Skia library during edge builder allocation