-------------------------------------------------------------------

Thu Dec  1 21:13:32 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 107.0.1:

  * Fix an issue with accessing some sites reliably in Private

    Browsing mode or Strict ETP due to anti-adblockers

    (bmo#1717806)

  * Fix an issue where Color Management was not available for

    some users (bmo#1799391)

  * Fix an issue with text overlapping in the Settings Menu for

    some locales (bmo#1800379)

  * Fix an issue where the DevTools UI is not accessible when an

    alert dialog is displayed (bmo#1801840)

-------------------------------------------------------------------

Tue Nov 15 14:22:26 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 107.0

  MFSA 2022-47 (bsc#1205270)

 * CVE-2022-45403 (bmo#1762078)

    Service Workers might have learned size of cross-origin media files

  * CVE-2022-45404 (bmo#1790815)

    Fullscreen notification bypass

  * CVE-2022-45405 (bmo#1791314)

    Use-after-free in InputStream implementation

  * CVE-2022-45406 (bmo#1791975)

    Use-after-free of a JavaScript Realm

  * CVE-2022-45407 (bmo#1793314)

    Loading fonts on workers was not thread-safe

  * CVE-2022-45408 (bmo#1793829)

    Fullscreen notification bypass via windowName

  * CVE-2022-45409 (bmo#1796901)

    Use-after-free in Garbage Collection

  * CVE-2022-45410 (bmo#1658869)

    ServiceWorker-intercepted requests bypassed SameSite cookie policy

  * CVE-2022-45411 (bmo#1790311)

    Cross-Site Tracing was possible via non-standard override headers

  * CVE-2022-45412 (bmo#1791029)

    Symlinks may resolve to partially uninitialized buffers

  * CVE-2022-45413 (bmo#1791201)

    SameSite=Strict cookies could have been sent cross-site via

    intent URLs

  * CVE-2022-40674 (bmo#1791598)

    Use-after-free vulnerability in expat

  * CVE-2022-45415 (bmo#1793551)

    Downloaded file may have been saved with malicious extension

  * CVE-2022-45416 (bmo#1793676)

    Keystroke Side-Channel Leakage

  * CVE-2022-45417 (bmo#1794508)

    Service Workers in Private Browsing Mode may have been

    written to disk

  * CVE-2022-45418 (bmo#1795815)

    Custom mouse cursor could have been drawn over browser UI

  * CVE-2022-45419 (bmo#1716082)

    Deleting a security exception did not take effect immediately

  * CVE-2022-45420 (bmo#1792643)

    Iframe contents could be rendered outside the iframe

  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)

    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5

- requires

  * NSS >= 3.84

  * rust = 1.64

-------------------------------------------------------------------

Sat Nov  5 13:16:42 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 106.0.5

  * Addresses a crash experienced by users with Intel Gemini Lake

    CPUs (bmo#1702019)

- Mozilla Firefox 106.0.4

  * Fixed an issue with DRM Video playback (bmo#1797292)

  * Fixed broken layout of datetime input when switching

    types (bmo#1797139)

-------------------------------------------------------------------

Tue Nov  1 19:26:39 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 106.0.3

  * Fixes for other platforms

-------------------------------------------------------------------

Thu Oct 27 18:07:29 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 106.0.2

  * Fix missing content on some PDF forms (bmo#1794351)

  * Fix column width for the Notification sub-panel in Settings

    (bmo#1793558)

  * Fix a browser freeze with accessibility enabled on some sites

    such as the Proxmox Web UI (bmo#1793748)

  * Fix page reloading not working with Firefox View and not

    refreshing synced data (bmo#1792680, bmo#1794474)

-------------------------------------------------------------------

Sun Oct 23 07:34:50 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 106.0.1

  * Addresses a crash experienced by users with AMD Zen 1 CPUs

    (bmo#1796126)

-------------------------------------------------------------------

Sun Oct 16 20:08:21 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 106.0

  * support editing of PDFs

  * introduced Firefox View

  * major WebRTC update

    - Better screen sharing for Windows and Linux Wayland users

    - RTP performance and reliability improvements

    - Richer statistics

    - Cross-browser and service compatibility improvements

  * detailed releasenotes

    https://www.mozilla.org/en-US/firefox/106.0/releasenotes

  MFSA 2022-44 (bsc#1204421)

  * CVE-2022-42927 (bmo#1789128)

    Same-origin policy violation could have leaked cross-origin URLs

  * CVE-2022-42928 (bmo#1791520)

    Memory Corruption in JS Engine

  * CVE-2022-42929 (bmo#1789439)

    Denial of Service via window.print

  * CVE-2022-42930 (bmo#1789503)

    Race condition in DOM Workers

  * CVE-2022-42931 (bmo#1780571)

    Username saved to a plaintext file on disk

  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)

    Memory safety bugs fixed in Firefox

- added -msse2 flag to fix i386 build and workaround bmo#1795993

- fixed used buildflags

- renamed mozilla-i686-build.patch to mozilla-buildfixes.patch

  as it was extended with changes for other archs

-------------------------------------------------------------------

Sat Oct  8 13:41:12 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 105.0.3:

  * Fixes for other platforms

-------------------------------------------------------------------

Wed Oct  5 18:27:01 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 105.0.2:

  * Fixed poor contrast on various menu items with certain

    themes on Linux systems (bmo#1792063)

  * Fixed the scrollbar appearing on the wrong side of

    `select` elements in right-to-left locales (bmo#1791219)

  * Fixed a possible deadlock when loading some sites in

    Troubleshoot Mode (bmo#1786259)

  * Fixed a bug causing some dynamic appearance changes to

    not appear when expected (bmo#1786521)

  * Fixed a bug causing theme styling to not be properly applied

    to sidebars for some add-ons in Private Browsing Mode

    (bmo#1787543)

-------------------------------------------------------------------

Thu Sep 22 22:12:39 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 105.0.1

  * Reverted focus behavior for new windows back to the content

    area instead of the address bar (bmo#1784692)

- added mozilla-i686-build.patch to avoid using avx2

-------------------------------------------------------------------

Sat Sep 17 21:01:10 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 105.0

  https://www.mozilla.org/en-US/firefox/105.0/releasenotes

  MFSA 2022-40 (bsc#1203477)

  * CVE-2022-40959 (bmo#1782211)

    Bypassing FeaturePolicy restrictions on transient pages

  * CVE-2022-40960 (bmo#1787633)

    Data-race when parsing non-UTF-8 URLs in threads

  * CVE-2022-40958 (bmo#1779993)

    Bypassing Secure Context restriction for cookies with __Host

    and __Secure prefix

  * CVE-2022-40961 (bmo#1784588)

    Stack-buffer overflow when initializing Graphics

  * CVE-2022-40956 (bmo#1770094)

    Content-Security-Policy base-uri bypass

  * CVE-2022-40957 (bmo#1777604)

    Incoherent instruction cache when building WASM on ARM64

  * CVE-2022-40962 (bmo#1767360, bmo#1776655, bmo#1777574,

    bmo#1784835, bmo#1785109, bmo#1786502, bmo#1789440)

    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3

- requires

  NSS 3.82

  Rust 1.63 (1.61)

- removed obsolete mozilla-glibc236.patch

-------------------------------------------------------------------

Fri Sep  9 05:59:03 UTC 2022 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Adjust memory requirements to fix build on aarch64

-------------------------------------------------------------------

Wed Sep  7 06:50:24 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 104.0.2 (boo#1203177)

  https://www.mozilla.org/en-US/firefox/104.0.2/releasenotes/

  * Fixed a bug making it impossible to use touch or a stylus to

    drag the scrollbar on pages (bmo#1787361)

  * Fixed an issue causing some users to crash in out-of-memory

    conditions (bmo#1774155)

  * Fixed an issue that would sometimes affect video & audio playback

    when loaded via a cross-origin iframe src attribute (bmo#1781759)

  * Fixed an issue that would sometimes affect video & audio playback

    when served with Content-Security-Policy: sandbox (bmo#1781063)

-------------------------------------------------------------------

Thu Sep  1 07:04:11 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 104.0.1

  * Addresses an issue with Youtube video playback that was

    affecting some users (boo#1203003)

-------------------------------------------------------------------

Sun Aug 21 11:12:14 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 104.0

  * https://www.mozilla.org/en-US/firefox/104.0/releasenotes

  MFSA 2022-33 (bsc#1202645)

  * CVE-2022-38472 (bmo#1769155)

    Address bar spoofing via XSLT error handling

  * CVE-2022-38473 (bmo#1771685)

    Cross-origin XSLT Documents would have inherited the parent's

    permissions

  * CVE-2022-38474 (bmo#1719511)

    Recording notification not shown when microphone was

    recording on Android

  * CVE-2022-38475 (bmo#1773266)

    Attacker could write a value to a zero-length array

  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159, bmo#1773363)

    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2

  * CVE-2022-38478 (bmo#1770630, bmo#1776658)

    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,

    and Firefox ESR 91.13

- requires

  NSPR 4.34.1

  NSS 3.81

  rust 1.62

-------------------------------------------------------------------

Sat Aug 13 06:25:20 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- added mozilla-glibc236.patch (bmo#1782988, boo#1202323)

-------------------------------------------------------------------

Tue Aug  9 08:46:29 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 103.0.2

  * Fixed menu shortcuts for users of the JAWS screen reader

  * Fixed an occasional non-overridable certificate error when

    accessing device configuration pages

-------------------------------------------------------------------

Tue Aug  2 08:05:28 UTC 2022 - Andreas Schwab <schwab@suse.de>

- The --disable-elf-hack option only exists on ARM and X86

-------------------------------------------------------------------

Mon Aug  1 10:45:16 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 103.0.1

  * Enabled hardware acceleration on newer AMD cards.

  * Fixed a crash on Firefox shutdown caused by a bug in the

    audio manager

-------------------------------------------------------------------

Wed Jul 27 07:13:07 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 103.0

  https://www.mozilla.org/en-US/firefox/103.0/releasenotes

  MFSA 2022-28 (bsc#1201758)

  * CVE-2022-36319 (bmo#1737722)

    Mouse Position spoofing with CSS transforms

  * CVE-2022-36317 (bmo#1759951)

    Long URL would hang Firefox for Android

  * CVE-2022-36318 (bmo#1771774)

    Directory indexes for bundled resources reflected URL

    parameters

  * CVE-2022-36314 (bmo#1773894)

    Opening local <code>.lnk</code> files could cause unexpected

    network loads

  * CVE-2022-36315 (bmo#1762520)

    Preload Cache Bypasses Subresource Integrity

  * CVE-2022-36316 (bmo#1768583)

    Performance API leaked whether a cross-site resource is

    redirecting

  * CVE-2022-36320 (bmo#1759794, bmo#1760998)

    Memory safety bugs fixed in Firefox 103

  * CVE-2022-2505 (bmo#1769739, bmo#1772824)

    Memory safety bugs fixed in Firefox 103 and 102.1

- requires

  NSS >= 3.80

  rust = 1.61

  rust-cbindgen >= 0.24.3

-------------------------------------------------------------------

Wed Jul 13 07:54:21 UTC 2022 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Move %limit_build set before mozilla config to actually set the

  value of %jobs to MOZ_MAKE_FLAGS to fix build on aarch64

-------------------------------------------------------------------

Wed Jul  6 18:35:47 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Firefox 102.0.1:

  * Fixed: Fixed bookmarks sidebar flashing white when opened in

    dark mode (bmo#1776157)

  * Fixed: Fixed multilingual spell checking not working with

    content in both English and a non-Latin alphabet

    (bmo#1773802)

  * Fixed: Developer tools:  Fixed an issue where the console

    output keep getting scrolled to the bottom when the last

    visible message is an evaluation result (bmo#1776262)

  * Fixed: Fixed *Delete cookies and site data when Firefox is

    closed* checkbox getting disabled on startup (bmo#1777419)

  * Fixed: Various stability fixes

-------------------------------------------------------------------

Sat Jun 25 12:51:46 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Firefox 102.0

  * You can now disable automatic opening of the download panel

    every time a new download starts

  * Firefox now mitigates query parameter tracking when navigating

    sites in ETP strict mode

  * Improved security by moving audio decoding into a separate

    process with stricter sandboxing, thus improving process isolation

  * https://www.mozilla.org/en-US/firefox/102.0/releasenotes

  MFSA 2022-24 (bsc#1200793)

  * CVE-2022-34479 (bmo#1745595)

    A popup window could be resized in a way to overlay the

    address bar with web content

  * CVE-2022-34470 (bmo#1765951)

    Use-after-free in nsSHistory

  * CVE-2022-34468 (bmo#1768537)

    CSP sandbox header without `allow-scripts` can be bypassed

    via retargeted javascript: URI

  * CVE-2022-34482 (bmo#845880)

    Drag and drop of malicious image could have led to malicious

    executable and potential code execution

  * CVE-2022-34483 (bmo#1335845)

    Drag and drop of malicious image could have led to malicious

    executable and potential code execution

  * CVE-2022-34476 (bmo#1387919)

    ASN.1 parser could have been tricked into accepting malformed ASN.1

  * CVE-2022-34481 (bmo#1483699, bmo#1497246)

    Potential integer overflow in ReplaceElementsAt

  * CVE-2022-34474 (bmo#1677138)

    Sandboxed iframes could redirect to external schemes

  * CVE-2022-34469 (bmo#1721220)

    TLS certificate errors on HSTS-protected domains could be

    bypassed by the user on Firefox for Android

  * CVE-2022-34471 (bmo#1766047)

    Compromised server could trick a browser into an addon downgrade

  * CVE-2022-34472 (bmo#1770123)

    Unavailable PAC file resulted in OCSP requests being blocked

  * CVE-2022-34478 (bmo#1773717)

    Microsoft protocols can be attacked if a user accepts a prompt

  * CVE-2022-2200 (bmo#1771381)

    Undesired attributes could be set as part of prototype pollution

  * CVE-2022-34480 (bmo#1454072)

    Free of uninitialized pointer in lg_init

  * CVE-2022-34477 (bmo#1731614)

    MediaError message property leaked information on cross-

    origin same-site pages

  * CVE-2022-34475 (bmo#1757210)

    HTML Sanitizer could have been bypassed via same-origin

    script via use tags

  * CVE-2022-34473 (bmo#1770888)

    HTML Sanitizer could have been bypassed via use tags

  * CVE-2022-34484 (bmo#1763634, bmo#1772651)

    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11

  * CVE-2022-34485 (bmo#1768409, bmo#1768578)

    Memory safety bugs fixed in Firefox 102

- requires

  NSPR >= 4.34

  NSS >= 3.79

  rust = 1.60

- switch out skia-patches with webrender-patches for big endian

  removed:

  * mozilla-bmo1504834-part2.patch

  * mozilla-bmo1504834-part4.patch

  * mozilla-bmo1626236.patch

  added:

  * one_swizzle_to_rule_them_all.patch

  * svg-rendering.patch

- add some more returns to the no-return-patch

-------------------------------------------------------------------

Fri Jun 10 20:45:37 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 101.0.1:

  * Fixed context menus not appearing when right-clicking

    Picture-in-Picture windows on some Linux systems (bmo#1771914)

  * Various stability fixes

-------------------------------------------------------------------

Sun May 29 08:02:45 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 101.0

  * Reading is now easier with the prefers-contrast media query,

    which allows sites to detect if the user has requested that web

    content is presented with a higher (or lower) contrast

  * All non-configured MIME types can now be assigned a custom

    action upon download completion

  * allows users to use as many microphones as you want, at the

    same time, during video conferencing. The most exciting benefit

    is that you can easily switch your microphones at any time

    (if your conferencing service provider enables this flexibility)

  MFSA 2022-20 (bsc#1200027)

  * CVE-2022-31736 (bmo#1735923)

    Cross-Origin resource's length leaked

  * CVE-2022-31737 (bmo#1743767)

    Heap buffer overflow in WebGL

  * CVE-2022-31738 (bmo#1756388)

    Browser window spoof using fullscreen mode

  * CVE-2022-31739 (bmo#1765049)

    Attacker-influenced path traversal when saving downloaded files

  * CVE-2022-31740 (bmo#1766806)

    Register allocation problem in WASM on arm64

  * CVE-2022-31741 (bmo#1767590)

    Uninitialized variable leads to invalid memory read

  * CVE-2022-31742 (bmo#1730434)

    Querying a WebAuthn token with a large number of allowCredential

    entries may have leaked cross-origin information

  * CVE-2022-31743 (bmo#1747388)

    HTML Parsing incorrectly ended HTML comments prematurely

  * CVE-2022-31744 (bmo#1757604)

    CSP bypass enabling stylesheet injection

  * CVE-2022-31745 (bmo#1760944)

    Incorrect Assertion caused by unoptimized array shift operations

  * CVE-2022-1919 (bmo#1761275)

    Memory Corruption when manipulating webp images

  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,

    bmo#1767365, bmo#1768559, bmo#1768734)

    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10

  * CVE-2022-31748 (bmo#1713773, bmo#1762201, bmo#1762469,

    bmo#1762770, bmo#1764878, bmo#1765226, bmo#1765782, bmo#1765973,

    bmo#1767177, bmo#1767181, bmo#1768232, bmo#1768251, bmo#1769869)