-------------------------------------------------------------------

Sat Aug 22 06:52:01 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 80.0

  MFSA 2020-36 (bsc#1175686)

  * CVE-2020-15663 (bmo#1643199)

    Downgrade attack on the Mozilla Maintenance Service could

    have resulted in escalation of privilege

  * CVE-2020-15664 (bmo#1658214)

    Attacker-induced prompt for extension installation

  * CVE-2020-12401 (bmo#1631573)

    Timing-attack on ECDSA signature generation

  * CVE-2020-6829 (bmo#1631583)

    P-384 and P-521 vulnerable to an electro-magnetic side

    channel attack on signature generation

  * CVE-2020-12400 (bmo#1623116)

    P-384 and P-521 vulnerable to a side channel attack on

    modular inversion

  * CVE-2020-15665 (bmo#1651636)

    Address bar not reset when choosing to stay on a page after

    the beforeunload dialog is shown

  * CVE-2020-15666 (bmo#1450853)

    MediaError message property leaks cross-origin response

    status

  * CVE-2020-15667 (bmo#1653371)

    Heap overflow when processing an update file

  * CVE-2020-15668 (bmo#1651520)

    Data Race when reading certificate information

  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,

    bmo#1656957)

    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2

- requires

  * NSPR 4.27

  * NSS 3.55

- added mozilla-system-nspr.patch (bmo#1661096)

- exclude ga-IE locale as it's failing to build

- rollback parallelize locale build because it breaks bookmarks

  (boo#1167976)

- preserve original default bookmark file during langpack build

  (boo#1167976)

- add some ccache output during build

-------------------------------------------------------------------

Thu Aug 20 13:07:33 UTC 2020 - Martin Liška <mliska@suse.cz>

- Use new memoryperjob _constraints instead of %limit_build macro.

-------------------------------------------------------------------

Mon Aug 10 09:19:38 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- use ccache for build

- replace versioned RPM deps with requires_ge

- parallelize locale build

-------------------------------------------------------------------

Thu Aug  6 14:37:16 UTC 2020 - Yunhe Guo <i@guoyunhe.me>

- Change *.appdata.xml location to latest AppStream standard

-------------------------------------------------------------------

Thu Jul 23 21:00:34 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 79.0

  MFSA 2020-30 (bsc#1174538)

  * CVE-2020-15652 (bmo#1634872)

    Potential leak of redirect targets when loading scripts in a worker

  * CVE-2020-6514 (bmo#1642792)

    WebRTC data channel leaks internal address to peer

  * CVE-2020-15655 (bmo#1645204)

    Extension APIs could be used to bypass Same-Origin Policy

  * CVE-2020-15653 (bmo#1521542)

    Bypassing iframe sandbox when allowing popups

  * CVE-2020-6463 (bmo#1635293)

    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture

  * CVE-2020-15656 (bmo#1647293)

    Type confusion for special arguments in IonMonkey

  * CVE-2020-15658 (bmo#1637745)

    Overriding file type when saving to disk

  * CVE-2020-15657 (bmo#1644954)

    DLL hijacking due to incorrect loading path

  * CVE-2020-15654 (bmo#1648333)

    Custom cursor can overlay user interface

  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1638856,

    bmo#1643613, bmo#1644839, bmo#1645835, bmo#1646006, bmo#1646220,

    bmo#1646787, bmo#1649347, bmo#1650811, bmo#1651678)

    Memory safety bugs fixed in Firefox 79

- updated dependency requirements:

  * mozilla-nspr >= 4.26

  * mozilla-nss >= 3.54

  * rust >= 1.43

  * rust-cbindgen >= 0.14.3

- removed obsolete patch

  mozilla-bmo1463035.patch

-------------------------------------------------------------------

Tue Jul 21 21:31:20 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- fixed syntax issue in desktop file (boo#1174360)

-------------------------------------------------------------------

Fri Jul 17 15:07:45 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Add mozilla-libavcodec58_91.patch to link against updated

  soversion of libavcodec (58.91) with ffmpeg >= 4.3.

  (patch provided by Atri Bhattacharya <badshah400@gmail.com>

- enable MOZ_USE_XINPUT2 for TW (again) (boo#1173320)

  (Plasma 5.19.3 is now in TW)

-------------------------------------------------------------------

Sat Jul 11 11:08:06 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 78.0.2

  * Fixed an accessibility regression in reader mode (bmo#1650922)

  * Made the address bar more resilient to data corruption in the

    user profile (bmo#1649981)

  * Fixed a regression opening certain external applications (bmo#1650162)

  MFSA 2020-28

  * CVE pending (bmo#1644076)

    X-Frame-Options bypass using object or embed tags

- added desktop file actions

- do not use XINPUT2 for the moment until Plasma 5.19.3 has landed

  (boo#1173993)

- rework langpack integration (boo#1173991)

  * ship XPIs instead of directories

  * allow addon sideloading

  * mark signatures for langpacks non-mandatory

  * do not autodisable user profile scopes

- Google API key is not usable for geolocation service

- fix pipewire support for TW (boo#1172903)

-------------------------------------------------------------------

Wed Jul  1 07:15:02 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 78.0.1

  * Fixed an issue which could cause installed search engines to not

    be visible when upgrading from a previous release.

- enable MOZ_USE_XINPUT2 for TW (boo#1173320)

-------------------------------------------------------------------

Sun Jun 28 07:17:13 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 78.0

  * startup notifications now using Gtk instead of libnotify

  * PDF downloads now show an option to open the PDF directly in Firefox

  * Protections Dashboard (about:protections)

  * WebRTC not interrupted by screensaver anymore

  * disabled TLS 1.0 and 1.1 by default

  MFSA 2020-24 (bsc#1173576)

  * CVE-2020-12415 (bmo#1586630)

    AppCache manifest poisoning due to url encoded character processing

  * CVE-2020-12416 (bmo#1639734)

    Use-after-free in WebRTC VideoBroadcaster

  * CVE-2020-12417 (bmo#1640737)

    Memory corruption due to missing sign-extension for ValueTags

    on ARM64

  * CVE-2020-12418 (bmo#1641303)

    Information disclosure due to manipulated URL object

  * CVE-2020-12419 (bmo#1643874)

    Use-after-free in nsGlobalWindowInner

  * CVE-2020-12420 (bmo#1643437)

    Use-After-Free when trying to connect to a STUN server

  * CVE-2020-12402 (bmo#1631597)

    RSA Key Generation vulnerable to side-channel attack

  * CVE-2020-12421 (bmo#1308251)

    Add-On updates did not respect the same certificate trust

    rules as software updates

  * CVE-2020-12422 (bmo#1450353)

    Integer overflow in nsJPEGEncoder::emptyOutputBuffer

  * CVE-2020-12423 (bmo#1642400)

    DLL Hijacking due to searching %PATH% for a library

  * CVE-2020-12424 (bmo#1562600)

    WebRTC permission prompt could have been bypassed by a

    compromised content process

  * CVE-2020-12425 (bmo#1634738)

    Out of bound read in Date.parse()

  * CVE-2020-12426 (bmo#1608068, bmo#1609951, bmo#1631187, bmo#1637682)

    Memory safety bugs fixed in Firefox 78

- requires

  * NSS >= 3.53.1

  * nodejs >= 10.21

  * Gtk+3 >= 3.14

- removed obsolete patches

  * mozilla-s390-bigendian.patch

  * mozilla-bmo1634646.patch

- Add mozilla-pipewire-0-3.patch for openSUSE >= 15.2 to build

  WebRTC with pipewire support to enable screen sharing under

  Wayland; also add BuildRequires: pkgconfig(libpipewire-0.3)

  appropriately (boo#1172903).

- adding SLE12 compatibility in spec file

- add patches for s390x

  * mozilla-bmo1602730.patch (bmo#1602730)

  * mozilla-bmo1626236.patch (bmo#1626236)

  * mozilla-bmo998749.patch (bmo#998749)

  * mozilla-s390x-skia-gradient.patch

- update create-tar.sh

- Use same _constraints for ppc64 (BE) as ppc64le to avoid oom build failure

-------------------------------------------------------------------

Wed Jun 10 07:17:15 UTC 2020 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Exclude armv6, since it is unbuildable since about 3 years

-------------------------------------------------------------------

Wed Jun  3 21:39:11 UTC 2020 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 77.0.1

  * Disable automatic selection of DNS over HTTPS providers during

    a test to enable wider deployment in a more controlled way

    (bmo#1642723)

-------------------------------------------------------------------

Fri May 29 11:49:36 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 77.0

  * view and manage web certificates more easily on the new

    about:certificate page

  * improvements in accessibility

  * significant improvements to JavaScript debugging

  MFSA 2020-20 (bsc#1172402)

  * CVE-2020-12399 (bmo#1631576)

    Timing attack on DSA signatures in NSS library

    (fixed with external NSS >= 3.52.1)

  * CVE-2020-12405 (bmo#1631618)

    Use-after-free in SharedWorkerService

  * CVE-2020-12406 (bmo#1639590)

    JavaScript type confusion with NativeTypes

  * CVE-2020-12407 (bmo#1637112)

    WebRender leaking GPU memory when using border-image CSS

    directive

  * CVE-2020-12408 (bmo#1623888)

    URL spoofing when using IP addresses

  * CVE-2020-12409 (bmo#1619305, bmo#1632717)

    Memory safety bugs fixed in Firefox 77 and Firefox ESR 68.9

  * CVE-2020-12411 (bmo#1620972, bmo#1625333)

    Memory safety bugs fixed in Firefox 77

- requires

  * NSS >= 3.52.1

  * rust-cbindgen >= 1.14.1

  * clang >= 5

- added mozilla-bmo1634646.patch as part of fixing PGO build

  (still not working)

-------------------------------------------------------------------

Wed May 13 12:21:13 UTC 2020 - Michel Normand <normand@linux.vnet.ibm.com>

- change again _constraints for ppc64le use <physicalmemory>

  and increase limit_build in spec file to reduce max_jobs.

-------------------------------------------------------------------

Sat May  9 11:45:39 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 76.0.1

  * Fixed a bug causing some add-ons such as Amazon Assistant to see

    multiple onConnect events, impairing functionality (bmo#1635637)

-------------------------------------------------------------------

Fri May  1 11:59:58 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 76.0

  * Lockwise improvements

  * Improvements in Picture-in-Picture feature

  * Support Audio Worklets

  MFSA-2020-16 (bsc#1171186)

  * CVE-2020-12387 (bmo#1545345)

    Use-after-free during worker shutdown

  * CVE-2020-12388 (bmo#1618911)

    Sandbox escape with improperly guarded Access Tokens

  * CVE-2020-12389 (bmo#1554110)

    Sandbox escape with improperly separated process types

  * CVE-2020-6831 (bmo#1632241)

    Buffer overflow in SCTP chunk input validation

  * CVE-2020-12390 (bmo#1141959)

    Incorrect serialization of nsIPrincipal.origin for IPv6 addresses

  * CVE-2020-12391 (bmo#1457100)

    Content-Security-Policy bypass using object elements

  * CVE-2020-12392 (bmo#1614468)

    Arbitrary local file access with 'Copy as cURL'

  * CVE-2020-12393 (bmo#1615471)

    Devtools' 'Copy as cURL' feature did not fully escape

    website-controlled data, potentially leading to command injection

  * CVE-2020-12394 (bmo#1628288)

    URL spoofing in location bar when unfocussed

  * CVE-2020-12395 (bmo#1595886, bmo#1611482, bmo#1614704, bmo#1624098,

    bmo#1625749, bmo#1626382, bmo#1628076, bmo#1631508)

    Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8

  * CVE-2020-12396 (bmo#1339601, bmo#1611938, bmo#1620488,

    bmo#1622291, bmo#1627644)

    Memory safety bugs fixed in Firefox 76

- requires

  * NSS >= 3.51.1

  * nasm >= 2.14

- removed obsolete patch mozilla-bmo1622013.patch

- fix URI creation for KDE file selector integration (boo#1160331)

-------------------------------------------------------------------

Tue Apr  7 12:18:27 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 75.0

  * https://www.mozilla.org/en-US/firefox/75.0/releasenotes

  MFSA 2020-12 (bsc#1168874)

  * CVE-2020-6821 (bmo#1625404)

    Uninitialized memory could be read when using the WebGL

    copyTexSubImage method

  * CVE-2020-6822 (bmo#1544181)

    Out of bounds write in GMPDecodeData when processing large images

  * CVE-2020-6823 (bmo#1614919)

    Malicious Extension could obtain auth codes from OAuth login flows

  * CVE-2020-6824 (bmo#1621853)

    Generated passwords may be identical on the same site between

    separate private browsing sessions

  * CVE-2020-6825 (bmo#1572541,bmo#1620193,bmo#1620203)

    Memory safety bugs fixed in Firefox 75 and Firefox ESR 68.7

  * CVE-2020-6826 (bmo#1613009,bmo#1613195,bmo#1616734,bmo#1617488,

    bmo#1619229,bmo#1620719,bmo#1624897)

    Memory safety bugs fixed in Firefox 75

- removed obsolete patch

  mozilla-bmo1609538.patch

- requires

  * rust >= 1.41

  * rust-cbindgen >= 0.13.1

  * mozilla-nss >= 3.51

  * nodejs10 >= 10.19

- fix build issue in libvpx for i586 via mozilla-bmo1622013.patch

-------------------------------------------------------------------

Mon Apr  6 11:19:24 UTC 2020 - Michel Normand <normand@linux.vnet.ibm.com>

- increase _constraints memory for ppc64le

-------------------------------------------------------------------

Fri Apr  3 15:23:28 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 74.0.1

  MFSA 2020-11 (boo#1168630)

  * CVE-2020-6819 (bmo#1620818)

    Use-after-free while running the nsDocShell destructor

  * CVE-2020-6820 (bmo#1626728)

    Use-after-free when handling a ReadableStream

-------------------------------------------------------------------

Wed Mar 25 07:30:39 UTC 2020 - Marcus Meissner <meissner@suse.com>

- mozilla-sandbox-fips.patch: allow /proc/sys/crypto/fips_enabled

  to be read, as openssl 1.1.1 FIPS aborts if it cannot access it

  (bsc#1167132)

-------------------------------------------------------------------

Sat Mar  7 08:51:06 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 74.0

  * https://www.mozilla.org/en-US/firefox/74.0/releasenotes/

  MFSA 2020-08 (bsc#1166238)

  * CVE-2020-6805 (bmo#1610880)

    Use-after-free when removing data about origins

  * CVE-2020-6806 (bmo#1612308)

    BodyStream::OnInputStreamReady was missing protections against

    state confusion

  * CVE-2020-6807 (bmo#1614971)

    Use-after-free in cubeb during stream destruction

  * CVE-2020-6808 (bmo#1247968)

    URL Spoofing via javascript: URL

  * CVE-2020-6809 (bmo#1420296)

    Web Extensions with the all-urls permission could access local

    files

  * CVE-2020-6810 (bmo#1432856)

    Focusing a popup while in fullscreen could have obscured the

    fullscreen notification

  * CVE-2020-6811 (bmo#1607742)

    Devtools' 'Copy as cURL' feature did not fully escape

    website-controlled data, potentially leading to command injection

  * CVE-2019-20503 (bmo#1613765)

    Out of bounds reads in sctp_load_addresses_from_init

  * CVE-2020-6812 (bmo#1616661)

    The names of AirPods with personally identifiable information

    were exposed to websites with camera or microphone permission

  * CVE-2020-6813 (bmo#1605814)

    @import statements in CSS could bypass the Content Security

    Policy nonce feature

  * CVE-2020-6814 (bmo#1592078,bmo#1604847,bmo#1608256,bmo#1612636,

    bmo#1614339)

    Memory safety bugs fixed in Firefox 74 and Firefox ESR 68.6

  * CVE-2020-6815 (bmo#1181957,bmo#1557732,bmo#1557739,bmo#1611457,

    bmo#1612431)

    Memory and script safety bugs fixed in Firefox 74

- requires

  * NSPR 4.25

  * NSS 3.50

  * rust-cbindgen 0.13.0

- removed obsolete patches

  mozilla-bmo1610814.patch

  mozilla-cubeb-noreturn.patch

- add mozilla-bmo1609538.patch to fix wayland issues with mutter 3.36

  (bmo#1609538, boo#1166471)

-------------------------------------------------------------------

Wed Feb 26 08:12:00 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- big endian fixes

-------------------------------------------------------------------

Tue Feb 25 14:17:00 UTC 2020 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Fix build on aarch64/armv7 with:

  * mozilla-bmo1610814.patch (boo#1164845, bmo#1610814)

-------------------------------------------------------------------

Thu Feb 20 13:40:59 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 73.0.1

  * Resolved problems connecting to the RBC Royal Bank website

    (bmo#1613943)

  * Fixed Firefox unexpectedly exiting when leaving Print Preview mode

    (bmo#1611133)

  * Fixed crashes when playing encrypted content on some Linux systems

    (bmo#1614535, boo#1164646)

- start in wayland mode when running under wayland session

-------------------------------------------------------------------

Sun Feb  9 07:45:00 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 73.0

  * Added support for setting a default zoom level applicable for all

    web content

  * High-contrast mode has been updated to allow background images

  * Improved audio quality when playing back audio at a faster or

    slower speed

  * Added NextDNS as alternative option for DNS over HTTPS

  MFSA 2020-05 (bsc#1163368)

  * CVE-2020-6796 (bmo#1610426)

    Missing bounds check on shared memory read in the parent process

  * CVE-2020-6797 (bmo#1596668) (MacOS X only)

    Extensions granted downloads.open permission could open arbitrary

    applications on Mac OSX

  * CVE-2020-6798 (bmo#1602944)

    Incorrect parsing of template tag could result in JavaScript injection

  * CVE-2020-6799 (bmo#1606596) (Windows only)

    Arbitrary code execution when opening pdf links from other

    applications, when Firefox is configured as default pdf reader

  * CVE-2020-6800 (bmo#1595786,bmo#1596706,bmo#1598543,bmo#1604851,

    bmo#1608580,bmo#1608785,bmo#1605777)

    Memory safety bugs fixed in Firefox 73 and Firefox ESR 68.5

  * CVE-2020-6801 (bmo#1601024,bmo#1601712,bmo#1604836,bmo#1606492)

    Memory safety bugs fixed in Firefox 73

- updated requirements

  * rust >= 1.39

  * NSS >= 3.49.2

  * rust-cbindgen >= 0.12.0

- rebased patches

- removed obsolete patch

  * mozilla-bmo1601707.patch

- switched to cairo-gtk3-wayland build

  (to fully enable wayland MOZ_ENABLE_WAYLAND=1 needs to be set)

- disabled elfhack due to failing packager

  https://github.com/openSUSE/firefox-maintenance/issues/28

- disabled PGO due to build failure

  https://github.com/openSUSE/firefox-maintenance/issues/29

-------------------------------------------------------------------

Tue Jan 28 07:30:16 UTC 2020 - Stasiek Michalski <stasiek@michalski.cc>

- Use a symbolic icon from branding internals

- Pixmaps no longer required for the desktops

-------------------------------------------------------------------

Wed Jan 22 10:30:21 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 72.0.2

  * Various stability fixes

  * Fixed issues opening files with spaces in their path (bmo#1601905)

  * Fixed a hang opening about:logins when a master password is set

    (bmo#1606992)

  * Fixed a web compatibility issue with CSS Shadow Parts which

    shipped in Firefox 72 (bmo#1604989)

  * Fixed inconsistent playback performance for fullscreen 1080p

    videos on some systems (bmo#1608485)

-------------------------------------------------------------------

Tue Jan 21 12:59:54 UTC 2020 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Fix build for aarch64/ppc64le (do not update config.sub file

  for libbacktrace)

-------------------------------------------------------------------

Wed Jan  8 08:19:12 UTC 2020 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 72.0.1

  MFSA 2020-03 (bsc#1160498)

  * CVE-2019-17026 (bmo#1607443)