-------------------------------------------------------------------

Sat Sep 19 20:23:29 UTC 2015 - wr@rosenauer.org

- update to Firefox 41.0 (bnc#947003)

  * MFSA 2015-96/CVE-2015-4500/CVE-2015-4501

    Miscellaneous memory safety hazards

  * MFSA 2015-97/CVE-2015-4503 (bmo#994337)

    Memory leak in mozTCPSocket to servers

  * MFSA 2015-98/CVE-2015-4504 (bmo#1132467)

    Out of bounds read in QCMS library with ICC V4 profile attributes

  * MFSA 2015-99/CVE-2015-4476 (bmo#1162372) (Android only)

    Site attribute spoofing on Android by pasting URL with unknown scheme

  * MFSA 2015-100/CVE-2015-4505 (bmo#1177861) (Windows only)

    Arbitrary file manipulation by local user through Mozilla updater

  * MFSA 2015-101/CVE-2015-4506 (bmo#1192226)

    Buffer overflow in libvpx while parsing vp9 format video

  * MFSA 2015-102/CVE-2015-4507 (bmo#1192401)

    Crash when using debugger with SavedStacks in JavaScript

  * MFSA 2015-103/CVE-2015-4508 (bmo#1195976)

    URL spoofing in reader mode

  * MFSA 2015-104/CVE-2015-4510 (bmo#1200004)

    Use-after-free with shared workers and IndexedDB

  * MFSA 2015-105/CVE-2015-4511 (bmo#1200148)

    Buffer overflow while decoding WebM video

  * MFSA 2015-106/CVE-2015-4509 (bmo#1198435)

    Use-after-free while manipulating HTML media content

  * MFSA 2015-107/CVE-2015-4512 (bmo#1170390)

    Out-of-bounds read during 2D canvas display on Linux 16-bit

    color depth systems

  * MFSA 2015-108/CVE-2015-4502 (bmo#1105045)

    Scripted proxies can access inner window

  * MFSA 2015-109/CVE-2015-4516 (bmo#904886)

    JavaScript immutable property enforcement can be bypassed

  * MFSA 2015-110/CVE-2015-4519 (bmo#1189814)

    Dragging and dropping images exposes final URL after redirects

  * MFSA 2015-111/CVE-2015-4520 (bmo#1200856, bmo#1200869)

    Errors in the handling of CORS preflight request headers

  * MFSA 2015-112/CVE-2015-4517/CVE-2015-4521/CVE-2015-4522/

    CVE-2015-7174/CVE-2015-7175/CVE-2015-7176/CVE-2015-7177/

    CVE-2015-7180

    Vulnerabilities found through code inspection

  * MFSA 2015-113/CVE-2015-7178/CVE-2015-7179 (bmo#1189860,

    bmo#1190526) (Windows only)

    Memory safety errors in libGLES in the ANGLE graphics library

  * MFSA 2015-114 (bmo#1167498, bmo#1153672) (Windows only)

    Information disclosure via the High Resolution Time API

- rebased patches

- removed obsolete patches

  * mozilla-arm64-libjpeg-turbo.patch

------------------------------------------------------------------

Thu Aug 27 06:03:51 UTC 2015 - wr@rosenauer.org

- update to Firefox 40.0.3 (bnc#943550)

  * Disable the asynchronous plugin initialization (bmo#1198590)

  * Fix a segmentation fault in the GStreamer support (bmo#1145230)

  * Fix a regression with some Japanese fonts used in the <input>

    field (bmo#1194055)

  * On some sites, the selection in a select combox box using the

    mouse could be broken (bmo#1194733)

  security fixes

  * MFSA 2015-94/CVE-2015-4497 (bmo#1164766, bmo#1175278)

    Use-after-free when resizing canvas element during restyling

  * MFSA 2015-95/CVE-2015-4498 (bmo#1042699)

    Add-on notification bypass through data URLs

-------------------------------------------------------------------

Fri Aug  7 07:49:49 UTC 2015 - wr@rosenauer.org

- update to Firefox 40.0 (bnc#940806)

  * Added protection against unwanted software downloads

  * Suggested Tiles show sites of interest, based on categories

    from your recent browsing history

  * Hello allows adding a link to conversations to provide context

    on what the conversation will be about

  * New style for add-on manager based on the in-content

    preferences style

  * Improved scrolling, graphics, and video playback performance

    with off main thread compositing (GNU/Linux only)

  * Graphic blocklist mechanism improved: Firefox version ranges

    can be specified, limiting the number of devices blocked

  security fixes:

  * MFSA 2015-79/CVE-2015-4473/CVE-2015-4474

    Miscellaneous memory safety hazards

  * MFSA 2015-80/CVE-2015-4475 (bmo#1175396)

    Out-of-bounds read with malformed MP3 file

  * MFSA 2015-81/CVE-2015-4477 (bmo#1179484)

    Use-after-free in MediaStream playback

  * MFSA 2015-82/CVE-2015-4478 (bmo#1105914)

    Redefinition of non-configurable JavaScript object properties

  * MFSA 2015-83/CVE-2015-4479/CVE-2015-4480/CVE-2015-4493

    Overflow issues in libstagefright

  * MFSA 2015-84/CVE-2015-4481 (bmo1171518)

    Arbitrary file overwriting through Mozilla Maintenance Service

    with hard links (only affected Windows)

  * MFSA 2015-85/CVE-2015-4482 (bmo#1184500)

    Out-of-bounds write with Updater and malicious MAR file

    (does not affect openSUSE RPM packages which do not ship the

     updater)

  * MFSA 2015-86/CVE-2015-4483 (bmo#1148732)

    Feed protocol with POST bypasses mixed content protections

  * MFSA 2015-87/CVE-2015-4484 (bmo#1171540)

    Crash when using shared memory in JavaScript

  * MFSA 2015-88/CVE-2015-4491 (bmo#1184009)

    Heap overflow in gdk-pixbuf when scaling bitmap images

  * MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948, bmo#1178148)

    Buffer overflows on Libvpx when decoding WebM video

  * MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489

    Vulnerabilities found through code inspection

  * MFSA 2015-91/CVE-2015-4490 (bmo#1086999)

    Mozilla Content Security Policy allows for asterisk wildcards

    in violation of CSP specification

  * MFSA 2015-92/CVE-2015-4492 (bmo#1185820)

    Use-after-free in XMLHttpRequest with shared workers

- added mozilla-no-stdcxx-check.patch

- removed obsolete patches

  * mozilla-add-glibcxx_use_cxx11_abi.patch

  * firefox-multilocale-chrome.patch

- rebased patches

- requires version 40 of the branding package

- removed browser/searchplugins/ location as it's not valid anymore

-------------------------------------------------------------------

Fri Aug  7 07:09:39 UTC 2015 - wr@rosenauer.org

- security update to Firefox 39.0.3 (bnc#940918)

  * MFSA 2015-78/CVE-2015-4495 (bmo#1179262, bmo#1178058)

    Same origin violation and local file stealing via PDF reader

-------------------------------------------------------------------

Wed Jul  1 06:43:02 UTC 2015 - wr@rosenauer.org

- update to Firefox 39.0 (bnc#935979)

  * Share Hello URLs with social networks

  * Support for 'switch' role in ARIA 1.1 (web accessibility)

  * SafeBrowsing malware detection lookups enabled for downloads

    (Mac OS X and Linux)

  * Support for new Unicode 8.0 skin tone emoji

  * Removed support for insecure SSLv3 for network communications

  * Disable use of RC4 except for temporarily whitelisted hosts

  * NPAPI Plug-in performance improved via asynchronous initialization

  security fixes:

  * MFSA 2015-59/CVE-2015-2724/CVE-2015-2725/CVE-2015-2726

    Miscellaneous memory safety hazards

  * MFSA 2015-60/CVE-2015-2727 (bmo#1163422)

    Local files or privileged URLs in pages can be opened into new tabs

  * MFSA 2015-61/CVE-2015-2728 (bmo#1142210)

    Type confusion in Indexed Database Manager

  * MFSA 2015-62/CVE-2015-2729 (bmo#1122218)

    Out-of-bound read while computing an oscillator rendering range in Web Audio

  * MFSA 2015-63/CVE-2015-2731 (bmo#1149891)

    Use-after-free in Content Policy due to microtask execution error

  * MFSA 2015-64/CVE-2015-2730 (bmo#1125025)

    ECDSA signature validation fails to handle some signatures correctly

    (this fix is shipped by NSS 3.19.1 externally)

  * MFSA 2015-65/CVE-2015-2722/CVE-2015-2733 (bmo#1166924, bmo#1169867)

    Use-after-free in workers while using XMLHttpRequest

  * MFSA 2015-66/CVE-2015-2734/CVE-2015-2735/CVE-2015-2736/CVE-2015-2737

    CVE-2015-2738/CVE-2015-2739/CVE-2015-2740

    Vulnerabilities found through code inspection

  * MFSA 2015-67/CVE-2015-2741 (bmo#1147497)

    Key pinning is ignored when overridable errors are encountered

  * MFSA 2015-68/CVE-2015-2742 (bmo#1138669)

    OS X crash reports may contain entered key press information

    (not relevant under Linux)

  * MFSA 2015-69/CVE-2015-2743 (bmo#1163109)

    Privilege escalation in PDF.js

  * MFSA 2015-70/CVE-2015-4000 (bmo#1138554)

    NSS accepts export-length DHE keys with regular DHE cipher suites

    (this fix is shipped by NSS 3.19.1 externally)

  * MFSA 2015-71/CVE-2015-2721 (bmo#1086145)

    NSS incorrectly permits skipping of ServerKeyExchange

    (this fix is shipped by NSS 3.19.1 externally)

- dropped mozilla-prefer_plugin_pref.patch as this feature is

  likely not worth maintaining further

- rebased patches

- require NSS 3.19.2

-------------------------------------------------------------------

Thu Jun 18 10:30:18 UTC 2015 - schwab@suse.de

- mozilla-arm64-libjpeg-turbo.patch: fix libjpeg-turbo configuration

-------------------------------------------------------------------

Sun Jun  7 07:09:12 UTC 2015 - wr@rosenauer.org

- update to Firefox 38.0.6

  * fixes bmo#1171730 which is not really relevant to oS builds

- fix KDE regression from 38.0.5 builds (bsc#933439)

-------------------------------------------------------------------

Sat May 23 21:13:49 UTC 2015 - wr@rosenauer.org

- update to Firefox 38.0.5

  * Keep track of articles and videos with Pocket

  * Clean formatting for articles and blog posts with Reader View

  * Share the active tab or window in a Hello conversation

- add changes file as source for SRPM (bsc#932142)

-------------------------------------------------------------------

Fri May 15 10:40:19 UTC 2015 - normand@linux.vnet.ibm.com

- add mozilla-add-glibcxx_use_cxx11_abi.patch grabbed from

  https://bugzilla.mozilla.org/show_bug.cgi?id=1153109

-------------------------------------------------------------------

Fri May 15 07:37:46 UTC 2015 - wr@rosenauer.org

- update to Firefox 38.0.1

  stability and regression fixes

  * Systems with first generation NVidia Optimus graphics cards

    may crash on start-up

  * Users who import cookies from Google Chrome can end up with

    broken websites

  * Large animated images may fail to play and may stop other

    images from loading

-------------------------------------------------------------------

Sun May 10 07:07:49 UTC 2015 - wr@rosenauer.org

- update to Firefox 38.0 (bnc#930622)

  * New tab-based preferences

  * Ruby annotation support

  * more info: https://www.mozilla.org/en-US/firefox/38.0/releasenotes/

  security fixes:

  * MFSA 2015-46/CVE-2015-2708/CVE-2015-2709

    Miscellaneous memory safety hazards

  * MFSA 2015-47/VE-2015-0797 (bmo#1080995)

    Buffer overflow parsing H.264 video with Linux Gstreamer

  * MFSA 2015-48/CVE-2015-2710 (bmo#1149542)

    Buffer overflow with SVG content and CSS

  * MFSA 2015-49/CVE-2015-2711 (bmo#1113431)

    Referrer policy ignored when links opened by middle-click and

    context menu

  * MFSA 2015-50/CVE-2015-2712 (bmo#1152280)

    Out-of-bounds read and write in asm.js validation

  * MFSA 2015-51/CVE-2015-2713 (bmo#1153478)

    Use-after-free during text processing with vertical text enabled

  * MFSA 2015-53/CVE-2015-2715 (bmo#988698)

    Use-after-free due to Media Decoder Thread creation during shutdown

  * MFSA 2015-54/CVE-2015-2716 (bmo#1140537)

    Buffer overflow when parsing compressed XML

  * MFSA 2015-55/CVE-2015-2717 (bmo#1154683)

    Buffer overflow and out-of-bounds read while parsing MP4 video

    metadata

  * MFSA 2015-56/CVE-2015-2718 (bmo#1146724)

    Untrusted site hosting trusted page can intercept webchannel

    responses

  * MFSA 2015-57/CVE-2011-3079 (bmo#1087565)

    Privilege escalation through IPC channel messages

- requires NSS 3.18.1

- removed obsolete patches:

  * mozilla-skia-bmo1136958.patch

- remove gnomevfs build options as it is removed from sources

- rebased patches

-------------------------------------------------------------------

Fri Apr 17 16:39:20 UTC 2015 - wr@rosenauer.org

- update to Firefox 37.0.2 (bnc#928116)

  * MFSA 2015-45/CVE-2015-2706 (bmo#1141081)

    Memory corruption during failed plugin initialization

-------------------------------------------------------------------

Fri Apr  3 08:27:24 UTC 2015 - wr@rosenauer.org

- update to Firefox 37.0.1 (bnc#926166)

  * MFSA 2015-43/CVE-2015-0798 (bmo#1147597) (Android only)

    Loading privileged content through Reader mode

  * MFSA 2015-44/CVE-2015-0799 (bmo#1148328)

    Certificate verification bypass through the HTTP/2 Alt-Svc header

-------------------------------------------------------------------

Sat Mar 28 09:46:48 UTC 2015 - wr@rosenauer.org

- update to Firefox 37.0 (bnc#925368)

  * Heartbeat user rating system

  * Yandex set as default search provider for the Turkish locale

  * Bing search now uses HTTPS for secure searching

  * Improved protection against site impersonation via OneCRL

    centralized certificate revocation

  * Opportunistically encrypt HTTP traffic where the server supports

    HTTP/2 AltSvc

  * some more behaviour changes for TLS

  security fixes:

  * MFSA 2015-30/CVE-2015-0814/CVE-2015-0815

    Miscellaneous memory safety hazards

  * MFSA 2015-31/CVE-2015-0813 (bmo#1106596))

    Use-after-free when using the Fluendo MP3 GStreamer plugin

  * MFSA 2015-32/CVE-2015-0812 (bmo#1128126)

    Add-on lightweight theme installation approval bypassed through

    MITM attack

  * MFSA 2015-33/CVE-2015-0816 (bmo#1144991)

    resource:// documents can load privileged pages

  * MFSA-2015-34/CVE-2015-0811 (bmo#1132468)

    Out of bounds read in QCMS library

  * MFSA-2015-35/CVE-2015-0810 (bmo#1125013)

    Cursor clickjacking with flash and images (OS X only)

  * MFSA-2015-36/CVE-2015-0808 (bmo#1109552)

    Incorrect memory management for simple-type arrays in WebRTC

  * MFSA-2015-37/CVE-2015-0807 (bmo#1111834)

    CORS requests should not follow 30x redirections after preflight

  * MFSA-2015-38/CVE-2015-0805/CVE-2015-0806 (bmo#1135511, bmo#1099437)

    Memory corruption crashes in Off Main Thread Compositing

  * MFSA-2015-39/CVE-2015-0803/CVE-2015-0804 (bmo#1134560)

    Use-after-free due to type confusion flaws

  * MFSA-2015-40/CVE-2015-0801 (bmo#1146339)

    Same-origin bypass through anchor navigation

  * MFSA-2015-41/CVE-2015-0800/CVE-2012-2808

    PRNG weakness allows for DNS poisoning on Android (only)

  * MFSA-2015-42/CVE-2015-0802 (bmo#1124898)

    Windows can retain access to privileged content on navigation

    to unprivileged pages

- removed obsolete patches

  * mozilla-bmo1088588.patch

  * mozilla-bmo1108834.patch

- requires NSPR 4.10.8

-------------------------------------------------------------------

Tue Mar 24 15:35:24 UTC 2015 - dvaleev@suse.com

- Fix builds with skia on Power

  mozilla-skia-be-le.patch (patch from #bmo1136958)

  mozilla-bmo1108834.patch

  mozilla-bmo1005535.patch

-------------------------------------------------------------------

Sat Mar 21 09:03:12 UTC 2015 - wr@rosenauer.org

- update to Firefox 36.0.4 (bnc#923534)

  * MFSA 2015-28/CVE-2015-0818 (bmo#1144988)

    Privilege escalation through SVG navigation

  * MFSA 2015-29/CVE-2015-0817 (bmo#1145255)

    Code execution through incorrect JavaScript bounds checking

    elimination

-------------------------------------------------------------------

Fri Mar 20 15:02:33 UTC 2015 - dimstar@opensuse.org

- Copy the icons to /usr/share/icons instead of symlinking them:

  in preparation for containerized apps (e.g. xdg-app) as well as

  AppStream metadata extraction, there are a couple locations that

  need to be real files for system integration (.desktop files,

  icons, mime-type info).

-------------------------------------------------------------------

Sat Mar  7 07:40:56 UTC 2015 - wr@rosenauer.org

- update to Firefox 36.0.1

  Bugfixes:

  * Disable the usage of the ANY DNS query type (bmo#1093983)

  * Hello may become inactive until restart (bmo#1137469)

  * Print preferences may not be preserved (bmo#1136855)

  * Hello contact tabs may not be visible (bmo#1137141)

  * Accept hostnames that include an underscore character ("_")

    (bmo#1136616)

  * WebGL may use significant memory with Canvas2d (bmo#1137251)

  * Option -remote has been restored (bmo#1080319)

- added mozilla-skia-bmo1136958.patch to fix build issues for

  ARM and PPC

-------------------------------------------------------------------

Fri Feb 20 22:53:39 UTC 2015 - wr@rosenauer.org

- update to Firefox 36.0 (bnc#917597)

  * mozilla-xremote-client was removed

  * added libclearkey.so media plugin

  * Pinned tiles on the new tab page can be synced

  * Support for the full HTTP/2 protocol. HTTP/2 enables a faster,

    more scalable, and more responsive web.

  * Locale added: Uzbek (uz)

  security fixes:

  * MFSA 2015-11/CVE-2015-0835/CVE-2015-0836

    Miscellaneous memory safety hazards

  * MFSA 2015-12/CVE-2015-0833 (bmo#945192)

    Invoking Mozilla updater will load locally stored DLL files

    (Windows only)

  * MFSA 2015-13/CVE-2015-0832 (bmo#1065909)

    Appended period to hostnames can bypass HPKP and HSTS protections

  * MFSA 2015-14/CVE-2015-0830 (bmo#1110488)

    Malicious WebGL content crash when writing strings

  * MFSA 2015-15/CVE-2015-0834 (bmo#1098314)

    TLS TURN and STUN connections silently fail to simple TCP connections

  * MFSA 2015-16/CVE-2015-0831 (bmo#1130514)

    Use-after-free in IndexedDB

  * MFSA 2015-17/CVE-2015-0829 (bmo#1128939)

    Buffer overflow in libstagefright during MP4 video playback

  * MFSA 2015-18/CVE-2015-0828 (bmo#1030667, bmo#988675)

    Double-free when using non-default memory allocators with a

    zero-length XHR

  * MFSA 2015-19/CVE-2015-0827 (bmo#1117304)

    Out-of-bounds read and write while rendering SVG content

  * MFSA 2015-20/CVE-2015-0826 (bmo#1092363)

    Buffer overflow during CSS restyling

  * MFSA 2015-21/CVE-2015-0825 (bmo#1092370)

    Buffer underflow during MP3 playback

  * MFSA 2015-22/CVE-2015-0824 (bmo#1095925)

    Crash using DrawTarget in Cairo graphics library

  * MFSA 2015-23/CVE-2015-0823 (bmo#1098497)

    Use-after-free in Developer Console date with OpenType Sanitiser

  * MFSA 2015-24/CVE-2015-0822 (bmo#1110557)

    Reading of local files through manipulation of form autocomplete

  * MFSA 2015-25/CVE-2015-0821 (bmo#1111960)

    Local files or privileged URLs in pages can be opened into new tabs

  * MFSA 2015-26/CVE-2015-0819 (bmo#1079554)

    UI Tour whitelisted sites in background tab can spoof foreground

    tabs

  * MFSA 2015-27CVE-2015-0820 (bmo#1125398)

    Caja Compiler JavaScript sandbox bypass

- rebased patches

- requires NSS 3.17.4

-------------------------------------------------------------------

Sat Jan 31 18:37:38 UTC 2015 - wr@rosenauer.org

- update to Firefox 35.0.1

  * With the Enhanced Steam extension, Firefox could crash (bmo#1123732)

  * Kerberos authentication did not work with alias (bmo#1108971)

  * SVG / CSS animation had a regression causing rendering issues on

    websites like openstreemap.org (bmo#1083079)

  * On Godaddy webmail, Firefox could crash (bmo#1113121)

  * document.baseURI did not get updated to document.location after

    base tag was removed from DOM for site with a CSP (bmo#1121857)

  * With a Right-to-left (RTL) version of Firefox, the text selection

    could be broken (bmo#1104036)

  * CSP had a change in behavior with regard to case sensitivity

    resources loading (bmo#1122445)

-------------------------------------------------------------------

Sat Jan 10 18:36:37 UTC 2015 - wr@rosenauer.org

- update to Firefox 35.0 (bnc#910669)

  notable features:

  * Firefox Hello with new rooms-based conversations model

  * Implemented HTTP Public Key Pinning Extension (for enhanced

    authentication of encrypted connections)

  security fixes:

  * MFSA 2015-01/CVE-2014-8634/CVE-2014-8635

    Miscellaneous memory safety hazards

  * MFSA 2015-02/CVE-2014-8637 (bmo#1094536)

    Uninitialized memory use during bitmap rendering

  * MFSA 2015-03/CVE-2014-8638 (bmo#1080987)

    sendBeacon requests lack an Origin header

  * MFSA 2015-04/CVE-2014-8639 (bmo#1095859)

    Cookie injection through Proxy Authenticate responses

  * MFSA 2015-05/CVE-2014-8640 (bmo#1100409)

    Read of uninitialized memory in Web Audio

  * MFSA 2015-06/CVE-2014-8641 (bmo#1108455)

    Read-after-free in WebRTC

  * MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only)

    Gecko Media Plugin sandbox escape

  * MFSA 2015-08/CVE-2014-8642 (bmo#1079658)

    Delegated OCSP responder certificates failure with

    id-pkix-ocsp-nocheck extension

  * MFSA 2015-09/CVE-2014-8636 (bmo#987794)

    XrayWrapper bypass through DOM objects

- rebased patches

- dropped explicit support for everything older than 12.3

  (including SLES11)

  * merge firefox-kde.patch and firefox-kde-114.patch

  * dropped mozilla-sle11.patch

- reworked specfile to build conditionally based on release channel

  either Firefox or Firefox Developer Edition

- added mozilla-openaes-decl.patch to fix implicit declarations

- obsolete tracker-miner-firefox < 0.15 because it leads to startup