-------------------------------------------------------------------

Fri Jan  6 06:57:25 UTC 2023 - Luciano Santos <luc14n0@opensuse.org>

- Mozilla Firefox 108.0.2

  * Fixes a crash that might occur when managing browser history

    (bmo#1806408).

- Drop merged-upstream mozilla-bmo1805809.patch.

-------------------------------------------------------------------

Wed Dec 21 16:05:26 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- add mozilla-bmo1805809.patch to fix build for x86-32 (boo#1206600)

-------------------------------------------------------------------

Tue Dec 20 07:58:58 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 108.0.1 (boo#1206507)

  * Fixes the default search engine being reset on upgrade for

    profiles which were previously copied from a different location

-------------------------------------------------------------------

Tue Dec 13 13:54:35 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 108.0

  https://www.mozilla.org/en-US/firefox/108.0/releasenotes/

  MFSA 2022-51 (bsc#1206242)

  * CVE-2022-46871 (bmo#1795697)

    libusrsctp library out of date

  * CVE-2022-46872 (bmo#1799156)

    Arbitrary file read from a compromised content process

  * CVE-2022-46873 (bmo#1644790)

    Firefox did not implement the CSP directive unsafe-hashes

  * CVE-2022-46874 (bmo#1746139)

    Drag and Dropped Filenames could have been truncated to

    malicious extensions

  * CVE-2022-46875 (bmo#1786188)

    Download Protections were bypassed by .atloc and .ftploc

    files on Mac OS

  * CVE-2022-46877 (bmo#1795139)

    Fullscreen notification bypass

  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,

    bmo#1801102, bmo#1801315, bmo#1802395)

    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6

  * CVE-2022-46879 (bmo#1736224, bmo#1793407, bmo#1794249, bmo#1795845,

    bmo#1797682, bmo#1797720, bmo#1798494, bmo#1799479)

    Memory safety bugs fixed in Firefox 108

- requires

  NSS >= 3.85

  rustc/cargo 1.65

-------------------------------------------------------------------

Thu Dec  8 08:42:14 UTC 2022 - Milachew <milachew@mail.lv>

- added translations to .desktop file.

-------------------------------------------------------------------

Thu Dec  1 21:13:32 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 107.0.1:

  * Fix an issue with accessing some sites reliably in Private

    Browsing mode or Strict ETP due to anti-adblockers

    (bmo#1717806)

  * Fix an issue where Color Management was not available for

    some users (bmo#1799391)

  * Fix an issue with text overlapping in the Settings Menu for

    some locales (bmo#1800379)

  * Fix an issue where the DevTools UI is not accessible when an

    alert dialog is displayed (bmo#1801840)

-------------------------------------------------------------------

Tue Nov 15 14:22:26 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 107.0

  MFSA 2022-47 (bsc#1205270)

 * CVE-2022-45403 (bmo#1762078)

    Service Workers might have learned size of cross-origin media files

  * CVE-2022-45404 (bmo#1790815)

    Fullscreen notification bypass

  * CVE-2022-45405 (bmo#1791314)

    Use-after-free in InputStream implementation

  * CVE-2022-45406 (bmo#1791975)

    Use-after-free of a JavaScript Realm

  * CVE-2022-45407 (bmo#1793314)

    Loading fonts on workers was not thread-safe

  * CVE-2022-45408 (bmo#1793829)

    Fullscreen notification bypass via windowName

  * CVE-2022-45409 (bmo#1796901)

    Use-after-free in Garbage Collection

  * CVE-2022-45410 (bmo#1658869)

    ServiceWorker-intercepted requests bypassed SameSite cookie policy

  * CVE-2022-45411 (bmo#1790311)

    Cross-Site Tracing was possible via non-standard override headers

  * CVE-2022-45412 (bmo#1791029)

    Symlinks may resolve to partially uninitialized buffers

  * CVE-2022-45413 (bmo#1791201)

    SameSite=Strict cookies could have been sent cross-site via

    intent URLs

  * CVE-2022-40674 (bmo#1791598)

    Use-after-free vulnerability in expat

  * CVE-2022-45415 (bmo#1793551)

    Downloaded file may have been saved with malicious extension

  * CVE-2022-45416 (bmo#1793676)

    Keystroke Side-Channel Leakage

  * CVE-2022-45417 (bmo#1794508)

    Service Workers in Private Browsing Mode may have been

    written to disk

  * CVE-2022-45418 (bmo#1795815)

    Custom mouse cursor could have been drawn over browser UI

  * CVE-2022-45419 (bmo#1716082)

    Deleting a security exception did not take effect immediately

  * CVE-2022-45420 (bmo#1792643)

    Iframe contents could be rendered outside the iframe

  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)

    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5

- requires

  * NSS >= 3.84

  * rust = 1.64

-------------------------------------------------------------------

Sat Nov  5 13:16:42 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 106.0.5

  * Addresses a crash experienced by users with Intel Gemini Lake

    CPUs (bmo#1702019)

- Mozilla Firefox 106.0.4

  * Fixed an issue with DRM Video playback (bmo#1797292)

  * Fixed broken layout of datetime input when switching

    types (bmo#1797139)

-------------------------------------------------------------------

Tue Nov  1 19:26:39 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 106.0.3

  * Fixes for other platforms

-------------------------------------------------------------------

Thu Oct 27 18:07:29 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 106.0.2

  * Fix missing content on some PDF forms (bmo#1794351)

  * Fix column width for the Notification sub-panel in Settings

    (bmo#1793558)

  * Fix a browser freeze with accessibility enabled on some sites

    such as the Proxmox Web UI (bmo#1793748)

  * Fix page reloading not working with Firefox View and not

    refreshing synced data (bmo#1792680, bmo#1794474)

-------------------------------------------------------------------

Sun Oct 23 07:34:50 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 106.0.1

  * Addresses a crash experienced by users with AMD Zen 1 CPUs

    (bmo#1796126)

-------------------------------------------------------------------

Sun Oct 16 20:08:21 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 106.0

  * support editing of PDFs

  * introduced Firefox View

  * major WebRTC update

    - Better screen sharing for Windows and Linux Wayland users

    - RTP performance and reliability improvements

    - Richer statistics

    - Cross-browser and service compatibility improvements

  * detailed releasenotes

    https://www.mozilla.org/en-US/firefox/106.0/releasenotes

  MFSA 2022-44 (bsc#1204421)

  * CVE-2022-42927 (bmo#1789128)

    Same-origin policy violation could have leaked cross-origin URLs

  * CVE-2022-42928 (bmo#1791520)

    Memory Corruption in JS Engine

  * CVE-2022-42929 (bmo#1789439)

    Denial of Service via window.print

  * CVE-2022-42930 (bmo#1789503)

    Race condition in DOM Workers

  * CVE-2022-42931 (bmo#1780571)

    Username saved to a plaintext file on disk

  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)

    Memory safety bugs fixed in Firefox

- added -msse2 flag to fix i386 build and workaround bmo#1795993

- fixed used buildflags

- renamed mozilla-i686-build.patch to mozilla-buildfixes.patch

  as it was extended with changes for other archs

-------------------------------------------------------------------

Sat Oct  8 13:41:12 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 105.0.3:

  * Fixes for other platforms

-------------------------------------------------------------------

Wed Oct  5 18:27:01 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Mozilla Firefox 105.0.2:

  * Fixed poor contrast on various menu items with certain

    themes on Linux systems (bmo#1792063)

  * Fixed the scrollbar appearing on the wrong side of

    `select` elements in right-to-left locales (bmo#1791219)

  * Fixed a possible deadlock when loading some sites in

    Troubleshoot Mode (bmo#1786259)

  * Fixed a bug causing some dynamic appearance changes to

    not appear when expected (bmo#1786521)

  * Fixed a bug causing theme styling to not be properly applied

    to sidebars for some add-ons in Private Browsing Mode

    (bmo#1787543)

-------------------------------------------------------------------

Thu Sep 22 22:12:39 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 105.0.1

  * Reverted focus behavior for new windows back to the content

    area instead of the address bar (bmo#1784692)

- added mozilla-i686-build.patch to avoid using avx2

-------------------------------------------------------------------

Sat Sep 17 21:01:10 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 105.0

  https://www.mozilla.org/en-US/firefox/105.0/releasenotes

  MFSA 2022-40 (bsc#1203477)

  * CVE-2022-40959 (bmo#1782211)

    Bypassing FeaturePolicy restrictions on transient pages

  * CVE-2022-40960 (bmo#1787633)

    Data-race when parsing non-UTF-8 URLs in threads

  * CVE-2022-40958 (bmo#1779993)

    Bypassing Secure Context restriction for cookies with __Host

    and __Secure prefix

  * CVE-2022-40961 (bmo#1784588)

    Stack-buffer overflow when initializing Graphics

  * CVE-2022-40956 (bmo#1770094)

    Content-Security-Policy base-uri bypass

  * CVE-2022-40957 (bmo#1777604)

    Incoherent instruction cache when building WASM on ARM64

  * CVE-2022-40962 (bmo#1767360, bmo#1776655, bmo#1777574,

    bmo#1784835, bmo#1785109, bmo#1786502, bmo#1789440)

    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3

- requires

  NSS 3.82

  Rust 1.63 (1.61)

- removed obsolete mozilla-glibc236.patch

-------------------------------------------------------------------

Fri Sep  9 05:59:03 UTC 2022 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Adjust memory requirements to fix build on aarch64

-------------------------------------------------------------------

Wed Sep  7 06:50:24 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 104.0.2 (boo#1203177)

  https://www.mozilla.org/en-US/firefox/104.0.2/releasenotes/

  * Fixed a bug making it impossible to use touch or a stylus to

    drag the scrollbar on pages (bmo#1787361)

  * Fixed an issue causing some users to crash in out-of-memory

    conditions (bmo#1774155)

  * Fixed an issue that would sometimes affect video & audio playback

    when loaded via a cross-origin iframe src attribute (bmo#1781759)

  * Fixed an issue that would sometimes affect video & audio playback

    when served with Content-Security-Policy: sandbox (bmo#1781063)

-------------------------------------------------------------------

Thu Sep  1 07:04:11 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 104.0.1

  * Addresses an issue with Youtube video playback that was

    affecting some users (boo#1203003)

-------------------------------------------------------------------

Sun Aug 21 11:12:14 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 104.0

  * https://www.mozilla.org/en-US/firefox/104.0/releasenotes

  MFSA 2022-33 (bsc#1202645)

  * CVE-2022-38472 (bmo#1769155)

    Address bar spoofing via XSLT error handling

  * CVE-2022-38473 (bmo#1771685)

    Cross-origin XSLT Documents would have inherited the parent's

    permissions

  * CVE-2022-38474 (bmo#1719511)

    Recording notification not shown when microphone was

    recording on Android

  * CVE-2022-38475 (bmo#1773266)

    Attacker could write a value to a zero-length array

  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159, bmo#1773363)

    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2

  * CVE-2022-38478 (bmo#1770630, bmo#1776658)

    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,

    and Firefox ESR 91.13

- requires

  NSPR 4.34.1

  NSS 3.81

  rust 1.62

-------------------------------------------------------------------

Sat Aug 13 06:25:20 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- added mozilla-glibc236.patch (bmo#1782988, boo#1202323)

-------------------------------------------------------------------

Tue Aug  9 08:46:29 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 103.0.2

  * Fixed menu shortcuts for users of the JAWS screen reader

  * Fixed an occasional non-overridable certificate error when

    accessing device configuration pages

-------------------------------------------------------------------

Tue Aug  2 08:05:28 UTC 2022 - Andreas Schwab <schwab@suse.de>

- The --disable-elf-hack option only exists on ARM and X86

-------------------------------------------------------------------

Mon Aug  1 10:45:16 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 103.0.1

  * Enabled hardware acceleration on newer AMD cards.

  * Fixed a crash on Firefox shutdown caused by a bug in the

    audio manager

-------------------------------------------------------------------

Wed Jul 27 07:13:07 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Mozilla Firefox 103.0

  https://www.mozilla.org/en-US/firefox/103.0/releasenotes

  MFSA 2022-28 (bsc#1201758)

  * CVE-2022-36319 (bmo#1737722)

    Mouse Position spoofing with CSS transforms

  * CVE-2022-36317 (bmo#1759951)

    Long URL would hang Firefox for Android

  * CVE-2022-36318 (bmo#1771774)

    Directory indexes for bundled resources reflected URL

    parameters

  * CVE-2022-36314 (bmo#1773894)

    Opening local <code>.lnk</code> files could cause unexpected

    network loads

  * CVE-2022-36315 (bmo#1762520)

    Preload Cache Bypasses Subresource Integrity

  * CVE-2022-36316 (bmo#1768583)

    Performance API leaked whether a cross-site resource is

    redirecting

  * CVE-2022-36320 (bmo#1759794, bmo#1760998)

    Memory safety bugs fixed in Firefox 103

  * CVE-2022-2505 (bmo#1769739, bmo#1772824)

    Memory safety bugs fixed in Firefox 103 and 102.1

- requires

  NSS >= 3.80

  rust = 1.61

  rust-cbindgen >= 0.24.3

-------------------------------------------------------------------

Wed Jul 13 07:54:21 UTC 2022 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Move %limit_build set before mozilla config to actually set the

  value of %jobs to MOZ_MAKE_FLAGS to fix build on aarch64

-------------------------------------------------------------------

Wed Jul  6 18:35:47 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>

- Firefox 102.0.1:

  * Fixed: Fixed bookmarks sidebar flashing white when opened in

    dark mode (bmo#1776157)

  * Fixed: Fixed multilingual spell checking not working with

    content in both English and a non-Latin alphabet

    (bmo#1773802)

  * Fixed: Developer tools:  Fixed an issue where the console

    output keep getting scrolled to the bottom when the last

    visible message is an evaluation result (bmo#1776262)

  * Fixed: Fixed *Delete cookies and site data when Firefox is

    closed* checkbox getting disabled on startup (bmo#1777419)

  * Fixed: Various stability fixes

-------------------------------------------------------------------

Sat Jun 25 12:51:46 UTC 2022 - Wolfgang Rosenauer <wr@rosenauer.org>

- Firefox 102.0

  * You can now disable automatic opening of the download panel

    every time a new download starts

  * Firefox now mitigates query parameter tracking when navigating

    sites in ETP strict mode

  * Improved security by moving audio decoding into a separate

    process with stricter sandboxing, thus improving process isolation

  * https://www.mozilla.org/en-US/firefox/102.0/releasenotes

  MFSA 2022-24 (bsc#1200793)

  * CVE-2022-34479 (bmo#1745595)

    A popup window could be resized in a way to overlay the

    address bar with web content

  * CVE-2022-34470 (bmo#1765951)

    Use-after-free in nsSHistory

  * CVE-2022-34468 (bmo#1768537)

    CSP sandbox header without `allow-scripts` can be bypassed

    via retargeted javascript: URI

  * CVE-2022-34482 (bmo#845880)

    Drag and drop of malicious image could have led to malicious

    executable and potential code execution

  * CVE-2022-34483 (bmo#1335845)

    Drag and drop of malicious image could have led to malicious

    executable and potential code execution

  * CVE-2022-34476 (bmo#1387919)

    ASN.1 parser could have been tricked into accepting malformed ASN.1

  * CVE-2022-34481 (bmo#1483699, bmo#1497246)

    Potential integer overflow in ReplaceElementsAt

  * CVE-2022-34474 (bmo#1677138)

    Sandboxed iframes could redirect to external schemes

  * CVE-2022-34469 (bmo#1721220)

    TLS certificate errors on HSTS-protected domains could be

    bypassed by the user on Firefox for Android

  * CVE-2022-34471 (bmo#1766047)

    Compromised server could trick a browser into an addon downgrade

  * CVE-2022-34472 (bmo#1770123)

    Unavailable PAC file resulted in OCSP requests being blocked

  * CVE-2022-34478 (bmo#1773717)

    Microsoft protocols can be attacked if a user accepts a prompt

  * CVE-2022-2200 (bmo#1771381)

    Undesired attributes could be set as part of prototype pollution

  * CVE-2022-34480 (bmo#1454072)

    Free of uninitialized pointer in lg_init

  * CVE-2022-34477 (bmo#1731614)

    MediaError message property leaked information on cross-

    origin same-site pages

  * CVE-2022-34475 (bmo#1757210)

    HTML Sanitizer could have been bypassed via same-origin

    script via use tags

  * CVE-2022-34473 (bmo#1770888)

    HTML Sanitizer could have been bypassed via use tags

  * CVE-2022-34484 (bmo#1763634, bmo#1772651)

    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11

  * CVE-2022-34485 (bmo#1768409, bmo#1768578)

    Memory safety bugs fixed in Firefox 102

- requires

  NSPR >= 4.34

  NSS >= 3.79

  rust = 1.60

- switch out skia-patches with webrender-patches for big endian

  removed:

  * mozilla-bmo1504834-part2.patch

  * mozilla-bmo1504834-part4.patch

  * mozilla-bmo1626236.patch

  added:

  * one_swizzle_to_rule_them_all.patch

  * svg-rendering.patch

- add some more returns to the no-return-patch

-------------------------------------------------------------------

Fri Jun 10 20:45:37 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>