# HG changeset patch # User Wolfgang Rosenauer # Date 1484773583 -3600 # Node ID b61e849fe4517459c0a6ee937f3e4467555d2824 # Parent 3cc9f17ca9bb5f2eff4a13cb47293dd56a8e6156# Parent 7f60766aae160245b89f750b15d560243bacb274 merge branch changes into default diff -r 3cc9f17ca9bb -r b61e849fe451 MozillaFirefox/MozillaFirefox.changes --- a/MozillaFirefox/MozillaFirefox.changes Mon Aug 01 14:45:11 2016 +0200 +++ b/MozillaFirefox/MozillaFirefox.changes Wed Jan 18 22:06:23 2017 +0100 @@ -1,7 +1,233 @@ ------------------------------------------------------------------- +Mon Dec 12 21:18:41 UTC 2016 - wr@rosenauer.org + +- update to Firefox 50.1.0 (boo#) + +------------------------------------------------------------------- +Fri Dec 9 17:57:22 UTC 2016 - cgrobertson@novell.com + +- added patch mozilla-aarch64-startup-crash.patch (bsc#1011922) + +------------------------------------------------------------------- +Thu Dec 1 02:49:45 UTC 2016 - wr@rosenauer.org + +- update to Firefox 50.0.2 + * Firefox crashes with 3rd party Chinese IME when using IME text + (50.0.1) + security fixes (in 50.0.1): (boo#1012807) + * MFSA 2016-91 + CVE-2016-9078: data: URL can inherit wrong origin after an + HTTP redirect (bmo#1317641) + security fixes (in 50.0.2) (boo#1012964) + * MFSA 2016-92 + CVE-2016-9079: Use-after-free in SVG Animation (bmo#1321066) + +------------------------------------------------------------------- +Mon Nov 14 21:07:03 UTC 2016 - wr@rosenauer.org + +- update to Firefox 50.0 (boo#1009026) + * requires NSS 3.26.2 + new features + * Updates to keyboard shortcuts + Set a preference to have Ctrl+Tab cycle through tabs in recently + used order + View a page in Reader Mode by using Ctrl+Alt+R + * Added option to Find in page that allows users to limit search to + whole words only + * Added download protection for a large number of executable file + types on Windows, Mac and Linux + * Fixed rendering of dashed and dotted borders with rounded corners + (border-radius) + * Added a built-in Emoji set for operating systems without native + Emoji fonts (Windows 8.0 and lower and Linux) + * Blocked versions of libavcodec older than 54.35.1 + * additional locale + security fixes: + * MFSA 2016-89 + CVE-2016-5296: Heap-buffer-overflow WRITE in rasterize_edges_1 + (bmo#1292443) + CVE-2016-5292: URL parsing causes crash (bmo#1288482) + CVE-2016-5293: Write to arbitrary file with updater and moz + maintenance service using updater.log hardlink + (Windows only) (bmo#1246945) + CVE-2016-5294: Arbitrary target directory for result files of + update process (Windows only) (bmo#1246972) + CVE-2016-5297: Incorrect argument length checking in Javascript + (bmo#1303678) + CVE-2016-9064: Addons update must verify IDs match between + current and new versions (bmo#1303418) + CVE-2016-9065: Firefox for Android location bar spoofing usingfullscreen + (Android only) (bmo#1306696) + CVE-2016-9066: Integer overflow leading to a buffer overflow in + nsScriptLoadHandler (bmo#1299686) + CVE-2016-9067: heap-use-after-free in nsINode::ReplaceOrInsertBefore + (bmo#1301777, bmo#1308922 (CVE-2016-9069)) + CVE-2016-9068: heap-use-after-free in nsRefreshDriver (bmo#1302973) + CVE-2016-9072: 64-bit NPAPI sandbox isn't enabled on fresh profile + (bmo#1300083) (Windows only) + CVE-2016-9075: WebExtensions can access the mozAddonManager API + and use it to gain elevated privileges (bmo#1295324) + CVE-2016-9077: Canvas filters allow feDisplacementMaps to be applied + to cross-origin images, allowing timing attacks on them + (bmo#1298552) + CVE-2016-5291: Same-origin policy violation using local HTML file + and saved shortcut file (bmo#1292159) + CVE-2016-5295: Mozilla Maintenance Service: Ability to read + arbitrary files as SYSTEM (Windows only) (bmo#1247239) + CVE-2016-5298: SSL indicator can mislead the user about the real + URL visited (bmo#1227538) (Android only) + CVE-2016-5299: Firefox AuthToken in broadcast protected with + signature-level permission can be accessed by an + application installed beforehand that defines the + same permissions (bmo#1245791) (Android only) + CVE-2016-9061: API Key (glocation) in broadcast protected with + signature-level permission can be accessed by an + application installed beforehand that defines the + same permissions (Android only) (bmo#1245795) + CVE-2016-9062: Private browsing browser traces (android) in + browser.db and wal file (Android only) (bmo#1294438) + CVE-2016-9070: Sidebar bookmark can have reference to chrome window + (bmo#1281071) + CVE-2016-9073: windows.create schema doesn't specify "format": "relativeUrl" + (bmo#1289273) + CVE-2016-9074: Insufficient timing side-channel resistance in + divSpoiler (bmo#1293334) (fixed via NSS 3.26.1) + CVE-2016-9076: select dropdown menu can be used for URL bar + spoofing on e10s (bmo#1276976) + CVE-2016-9063: Possible integer overflow to fix inside XML_Parse + in expat (bmo#1274777) + CVE-2016-9071: Probe browser history via HSTS/301 redirect + CSP + (bmo#1285003) + CVE-2016-5289: Memory safety bugs fixed in Firefox 50 + CVE-2016-5290: Memory safety bugs fixed in Firefox 50 and Firefox ESR 45.5 +- make aarch64 build more similar to x86_64 build (remove conditionals + that don't seem to be necessary anymore) + +------------------------------------------------------------------- +Mon Oct 24 09:41:17 UTC 2016 - astieger@suse.com + +- Mozilla Firefox 49.0.2: + * CVE-2016-5287: Crash in nsTArray_base (bsc#1006475) + * CVE-2016-5288: Web content can read cache entries (bsc#1006476) + * Asynchronous rendering of the Flash plugins is now enabled by + default + * Change D3D9 default fallback preference to prevent graphical + artifacts + * Network issue prevents some users from seeing the Firefox UI on + startup + * Web compatibility issue with file uploads + * Web compatibility issue with Array.prototype.values + * Diagnostic information on timing for tab switching + * Fix a Canvas filters graphics issue affecting HTML5 apps + +------------------------------------------------------------------- +Wed Oct 12 20:42:28 UTC 2016 - badshah400@gmail.com + +- Drop mozilla-gtk3_20.patch; obsoleted by Firefox version 49.0 + and fixes have been incorporated by upstream. + +------------------------------------------------------------------- +Fri Sep 23 20:36:39 UTC 2016 - astieger@suse.com + +- Mozilla Firefox 49.0.1: + * Mitigate a startup crash issue caused by Websense - bmo#1304783 + +------------------------------------------------------------------- +Tue Sep 20 07:09:52 UTC 2016 - wr@rosenauer.org + +- update to Firefox 49.0 (boo#999701) + new features + * Updated Firefox Login Manager to allow HTTPS pages to use saved + HTTP logins. + * Added features to Reader Mode that make it easier on the eyes and + the ears + * Improved video performance for users on systems that support + SSE3 without hardware acceleration + * Added context menu controls to HTML5 audio and video that let users + loops files or play files at 1.25x speed + * Improvements in about:memory reports for tracking font memory usage + security related + * MFSA 2016-85 + CVE-2016-2827 (bmo#1289085) - Out-of-bounds read in + mozilla::net::IsValidReferrerPolicy + CVE-2016-5270 (bmo#1291016) - Heap-buffer-overflow in + nsCaseTransformTextRunFactory::TransformString + CVE-2016-5271 (bmo#1288946) - Out-of-bounds read in + PropertyProvider::GetSpacingInternal + CVE-2016-5272 (bmo#1297934) - Bad cast in nsImageGeometryMixin + CVE-2016-5273 (bmo#1280387) - crash in + mozilla::a11y::HyperTextAccessible::GetChildOffset + CVE-2016-5276 (bmo#1287721) - Heap-use-after-free in + mozilla::a11y::DocAccessible::ProcessInvalidationList + CVE-2016-5274 (bmo#1282076) - use-after-free in + nsFrameManager::CaptureFrameState + CVE-2016-5277 (bmo#1291665) - Heap-use-after-free in nsRefreshDriver::Tick + CVE-2016-5275 (bmo#1287316) - global-buffer-overflow in + mozilla::gfx::FilterSupport::ComputeSourceNeededRegions + CVE-2016-5278 (bmo#1294677) - Heap-buffer-overflow in + nsBMPEncoder::AddImageFrame + CVE-2016-5279 (bmo#1249522) - Full local path of files is available + to web pages after drag and drop + CVE-2016-5280 (bmo#1289970) - Use-after-free in + mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap + CVE-2016-5281 (bmo#1284690) - use-after-free in DOMSVGLength + CVE-2016-5282 (bmo#932335) - Don't allow content to request favicons + from non-whitelisted schemes + CVE-2016-5283 (bmo#928187) -