# HG changeset patch # User Wolfgang Rosenauer # Date 1544477581 -3600 # Node ID e8d4a33582b89f1024a2a91369beccc8f9fbbe78 # Parent af29b3ac33ae9131479bd265c1cc70dd5705a9c6 60.4.0 diff -r af29b3ac33ae -r e8d4a33582b8 MozillaFirefox/MozillaFirefox.changes --- a/MozillaFirefox/MozillaFirefox.changes Tue Jun 26 07:37:04 2018 +0200 +++ b/MozillaFirefox/MozillaFirefox.changes Mon Dec 10 22:33:01 2018 +0100 @@ -1,7 +1,124 @@ ------------------------------------------------------------------- +Mon Dec 10 21:25:38 UTC 2018 - Wolfgang Rosenauer + +- Mozilla Firefox 60.4.0esr: + MFSA 2018-29 +- requires NSS >= 3.36.6 + +------------------------------------------------------------------- +Tue Oct 23 20:35:31 UTC 2018 - astieger@suse.com + +- Mozilla Firefox 60.3.0esr: + * Various stability and regression fixes + MFSA 2018-27 bsc#1112852 + * CVE-2018-12392 bmo#1492823 + Crash with nested event loops + * CVE-2018-12393 bmo#1495011 + Integer overflow during Unicode conversion while loading + JavaScript + * CVE-2018-12395 bmo#1467523 + WebExtension bypass of domain restrictions through header + rewriting + * CVE-2018-12396 bmo#1483602 + WebExtension content scripts can execute in disallowed + contexts + * CVE-2018-12397 bmo#1487478 + WebExtension local file access vulnerability + * CVE-2018-12389 bmo#1498460, bmo#1499198 + Memory safety bugs fixed in Firefox ESR 60.3 + * CVE-2018-12390 bmo#1487098 bmo#1487660 bmo#1490234 bmo#1496159 + bmo#1443748 bmo#1496340 bmo#1483905 bmo#1493347 bmo#1488803 + bmo#1498701 bmo#1498482 bmo#1442010 bmo#1495245 bmo#1483699 + bmo#1469486 bmo#1484905 bmo#1490561 bmo#1492524 bmo#1481844 + Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3 + +------------------------------------------------------------------- +Tue Oct 2 21:28:31 UTC 2018 - astieger@suse.com + +- Mozilla Firefox 60.2.2esr: + MFSA 2018-24 + * CVE-2018-12386 (bsc#1110506, bmo#1493900) + Type confusion in JavaScript allowed remote code execution + * CVE-2018-12387 (bsc#1110507, bmo#1493903) + Array.prototype.push stack pointer vulnerability may enable + exploits in the sandboxed content process + +------------------------------------------------------------------- +Thu Sep 27 10:51:37 UTC 2018 - olaf@aepfle.de + +- Avoid undefined behavior in IPC fd-passing code with + mozilla-bmo1436242.patch (boo#1094767, bmo#1436242) + +------------------------------------------------------------------- +Fri Sep 21 22:46:56 UTC 2018 - astieger@suse.com + +- Mozilla Firefox 60.2.1esr: + MFSA 2018-23 + * CVE-2018-12385 (boo#1109363, bmo#1490585) + Crash in TransportSecurityInfo due to cached data + * CVE-2018-12383 (boo#1107343, bmo#1475775) + Setting a master password did not delete unencrypted + previously stored passwords + * Fixed a startup crash affecting users migrating from older ESR + releases + * Clean up old NSS DB files after upgrading + +------------------------------------------------------------------- +Wed Sep 5 19:39:44 UTC 2018 - security@suse.com + +- Mozilla Firefox 60.2.0esr: + MFSA 2018-21 (bsc#1107343) + * CVE-2018-12377 (bmo#1470260) + Use-after-free in refresh driver timers + * CVE-2018-12378 (bmo#1459383) + Use-after-free in IndexedDB + * CVE-2017-16541 (bsc#1066489, bmo#1412081) + Proxy bypass using automount and autofs + * CVE-2018-12376 (bmo#69309,bmo#69914,bmo#50989,bmo#80092, + bmo#80517,bmo#81093,bmo#78575,bmo#71953,bmo#73161,bmo#66991, + bmo#68738,bmo#83120,bmo#67363,bmo#72925,bmo#66577,bmo#67889, + bmo#80521) + Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 +- unfuzz mozilla-kde.patch + +------------------------------------------------------------------- Sat Jun 23 13:10:32 UTC 2018 - wr@rosenauer.org - update to Firefox 60.1.0esr + MFSA 2018-16 (bsc#1098998) + * CVE-2018-12359 (bmo#1459162) + Buffer overflow using computed size of canvas element + * CVE-2018-12360 (bmo#1459693) + Use-after-free when using focus() + * CVE-2018-12361 (bmo#1463244) + Integer overflow in SwizzleData + * CVE-2018-12362 (bmo#1452375) + Integer overflow in SSSE3 scaler + * CVE-2018-5156 (bmo#1453127) + Media recorder segmentation fault when track type is changed during capture + * CVE-2018-12363 (bmo#1464784) + Use-after-free when appending DOM nodes + * CVE-2018-12364 (bmo#1436241) + CSRF attacks through 307 redirects and NPAPI plugins + * CVE-2018-12365 (bmo#1459206) + Compromised IPC child process can list local filenames + * CVE-2018-12371 (bmo#1465686) + Integer overflow in Skia library during edge builder allocation + * CVE-2018-12366 (bmo#1464039) + Invalid data handling during QCMS transformations + * CVE-2018-12367 (bmo#1462891) + Timing attack mitigation of PerformanceNavigationTiming + * CVE-2018-12369 (bmo#1454909) + WebExtension security permission checks bypassed by embedded experiments + * CVE-2018-5187 (bmo#1461324,bmo#1414829,bmo#1395246,bmo#1467938, + bmo#1461619,bmo#1425930,bmo#1438556,bmo#1454285,bmo#1459568, + bmo#1463884) + Memory safety bugs fixed in Firefox 60 and Firefox ESR 60.1 + * CVE-2018-5188 (bmo#1456189,bmo#1456975,bmo#1465898,bmo#1392739, + bmo#1451297,bmo#1464063,bmo#1437842,bmo#1442722,bmo#1452576, + bmo#1450688,bmo#1458264,bmo#1458270,bmo#1465108,bmo#1464829, + bmo#1464079,bmo#1463494,bmo#1458048) + Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9 - remove obsolete patches mozilla-enable-csd.patch mozilla-fix-skia-aarch64.patch diff -r af29b3ac33ae -r e8d4a33582b8 MozillaFirefox/MozillaFirefox.spec --- a/MozillaFirefox/MozillaFirefox.spec Tue Jun 26 07:37:04 2018 +0200 +++ b/MozillaFirefox/MozillaFirefox.spec Mon Dec 10 22:33:01 2018 +0100 @@ -19,10 +19,10 @@ # changed with every update %define major 60 -%define mainver %major.1.0 +%define mainver %major.4.0 %define update_channel esr %define branding 1 -%define releasedate 20180621121604 +%define releasedate 20181203164059 %define source_prefix firefox-%{mainver} # PIE, full relro (x86_64 for now) @@ -73,7 +73,7 @@ BuildRequires: libproxy-devel BuildRequires: makeinfo BuildRequires: mozilla-nspr-devel >= 4.19 -BuildRequires: mozilla-nss-devel >= 3.36.4 +BuildRequires: mozilla-nss-devel >= 3.36.6 BuildRequires: python-devel BuildRequires: python2-xml BuildRequires: rust >= 1.24 @@ -158,6 +158,7 @@ Patch10: mozilla-i586-domPrefs.patch Patch11: mozilla-bmo1464766.patch Patch13: mozilla-bmo1375074.patch +Patch14: mozilla-bmo1436242.patch # Firefox/browser Patch101: firefox-kde.patch Patch102: firefox-branded-icons.patch @@ -273,6 +274,7 @@ %endif %patch11 -p1 %patch13 -p1 +%patch14 -p1 # Firefox %patch101 -p1 %patch102 -p1 diff -r af29b3ac33ae -r e8d4a33582b8 MozillaFirefox/create-tar.sh --- a/MozillaFirefox/create-tar.sh Tue Jun 26 07:37:04 2018 +0200 +++ b/MozillaFirefox/create-tar.sh Mon Dec 10 22:33:01 2018 +0100 @@ -7,8 +7,8 @@ CHANNEL="esr60" BRANCH="releases/mozilla-$CHANNEL" -RELEASE_TAG="4ad4c31db9b1526aab8641be98fec8e0d63a4a7e" -VERSION="60.1.0" +RELEASE_TAG="6cc5fc0eaeaf9a9abcfc2722999ecdc6b539c23d" +VERSION="60.4.0" VERSION_SUFFIX="esr" LOCALE_FILE="firefox-$VERSION/browser/locales/l10n-changesets.json" diff -r af29b3ac33ae -r e8d4a33582b8 MozillaFirefox/mozilla-bmo1436242.patch --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/MozillaFirefox/mozilla-bmo1436242.patch Mon Dec 10 22:33:01 2018 +0100 @@ -0,0 +1,1 @@ +../mozilla-bmo1436242.patch \ No newline at end of file diff -r af29b3ac33ae -r e8d4a33582b8 MozillaFirefox/source-stamp.txt --- a/MozillaFirefox/source-stamp.txt Tue Jun 26 07:37:04 2018 +0200 +++ b/MozillaFirefox/source-stamp.txt Mon Dec 10 22:33:01 2018 +0100 @@ -1,2 +1,2 @@ -REV=4ad4c31db9b1 +REV=6cc5fc0eaeaf REPO=http://hg.mozilla.org/releases/mozilla-esr60 diff -r af29b3ac33ae -r e8d4a33582b8 mozilla-bmo1436242.patch --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/mozilla-bmo1436242.patch Mon Dec 10 22:33:01 2018 +0100 @@ -0,0 +1,52 @@ +https://bugzilla.redhat.com/show_bug.cgi?id=1577277 +https://hg.mozilla.org/mozilla-central/rev/6bb3adfa15c6 +https://bugzilla.mozilla.org/show_bug.cgi?id=1436242 +diff --git a/ipc/chromium/src/chrome/common/ipc_channel_posix.cc b/ipc/chromium/src/chrome/common/ipc_channel_posix.cc +--- a/ipc/chromium/src/chrome/common/ipc_channel_posix.cc ++++ b/ipc/chromium/src/chrome/common/ipc_channel_posix.cc +@@ -418,20 +418,37 @@ bool Channel::ChannelImpl::ProcessIncomi + const int* fds; + unsigned num_fds; + unsigned fds_i = 0; // the index of the first unused descriptor + + if (input_overflow_fds_.empty()) { + fds = wire_fds; + num_fds = num_wire_fds; + } else { +- const size_t prev_size = input_overflow_fds_.size(); +- input_overflow_fds_.resize(prev_size + num_wire_fds); +- memcpy(&input_overflow_fds_[prev_size], wire_fds, +- num_wire_fds * sizeof(int)); ++ // This code may look like a no-op in the case where ++ // num_wire_fds == 0, but in fact: ++ // ++ // 1. wire_fds will be nullptr, so passing it to memcpy is ++ // undefined behavior according to the C standard, even though ++ // the memcpy length is 0. ++ // ++ // 2. prev_size will be an out-of-bounds index for ++ // input_overflow_fds_; this is undefined behavior according to ++ // the C++ standard, even though the element only has its ++ // pointer taken and isn't accessed (and the corresponding ++ // operation on a C array would be defined). ++ // ++ // UBSan makes #1 a fatal error, and assertions in libstdc++ do ++ // the same for #2 if enabled. ++ if (num_wire_fds > 0) { ++ const size_t prev_size = input_overflow_fds_.size(); ++ input_overflow_fds_.resize(prev_size + num_wire_fds); ++ memcpy(&input_overflow_fds_[prev_size], wire_fds, ++ num_wire_fds * sizeof(int)); ++ } + fds = &input_overflow_fds_[0]; + num_fds = input_overflow_fds_.size(); + } + + // The data for the message we're currently reading consists of any data + // stored in incoming_message_ followed by data in input_buf_ (followed by + // other messages). + + + + + diff -r af29b3ac33ae -r e8d4a33582b8 mozilla-kde.patch --- a/mozilla-kde.patch Tue Jun 26 07:37:04 2018 +0200 +++ b/mozilla-kde.patch Mon Dec 10 22:33:01 2018 +0100 @@ -6,15 +6,11 @@ Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=140751 https://bugzilla.novell.com/show_bug.cgi?id=170055 -diff --git a/modules/libpref/Preferences.cpp b/modules/libpref/Preferences.cpp ---- a/modules/libpref/Preferences.cpp -+++ b/modules/libpref/Preferences.cpp -@@ -76,16 +76,17 @@ - #include "nsXPCOMCID.h" - #include "nsXPCOM.h" - #include "nsXULAppAPI.h" - #include "nsZipArchive.h" - #include "plbase64.h" +Index: firefox-60.2.0/modules/libpref/Preferences.cpp +=================================================================== +--- firefox-60.2.0.orig/modules/libpref/Preferences.cpp 2018-09-05 21:49:23.102829401 +0200 ++++ firefox-60.2.0/modules/libpref/Preferences.cpp 2018-09-05 21:49:31.498872824 +0200 +@@ -81,6 +81,7 @@ #include "PLDHashTable.h" #include "plstr.h" #include "prlink.h" @@ -22,17 +18,7 @@ #ifdef XP_WIN #include "windows.h" - #endif - - using namespace mozilla; - - #ifdef DEBUG -@@ -3868,25 +3869,37 @@ Preferences::InitInitialObjects() - // application pref files for backwards compatibility. - static const char* specialFiles[] = { - #if defined(XP_MACOSX) - "macprefs.js" - #elif defined(XP_WIN) +@@ -3873,6 +3874,7 @@ Preferences::InitInitialObjects() "winpref.js" #elif defined(XP_UNIX) "unix.js" @@ -40,9 +26,7 @@ #if defined(_AIX) , "aix.js" - #endif - #elif defined(XP_BEOS) - "beos.js" +@@ -3882,6 +3884,17 @@ Preferences::InitInitialObjects() #endif }; @@ -60,17 +44,7 @@ rv = pref_LoadPrefsInDir( defaultPrefDir, specialFiles, ArrayLength(specialFiles)); if (NS_FAILED(rv)) { - NS_WARNING("Error parsing application default preferences."); - } - - // Load jar:$app/omni.jar!/defaults/preferences/*.js - // or jar:$gre/omni.jar!/defaults/preferences/*.js. -@@ -3935,17 +3948,17 @@ Preferences::InitInitialObjects() - } - - nsCOMPtr path = do_QueryInterface(elem); - if (!path) { - continue; +@@ -3940,7 +3953,7 @@ Preferences::InitInitialObjects() } // Do we care if a file provided by this process fails to load? @@ -79,20 +53,11 @@ } } - #ifdef MOZ_WIDGET_ANDROID - // Set up the correct default for toolkit.telemetry.enabled. If this build - // has MOZ_TELEMETRY_ON_BY_DEFAULT *or* we're on the beta channel, telemetry - // is on by default, otherwise not. This is necessary so that beta users who - // are testing final release builds don't flipflop defaults. -diff --git a/modules/libpref/moz.build b/modules/libpref/moz.build ---- a/modules/libpref/moz.build -+++ b/modules/libpref/moz.build -@@ -27,16 +27,20 @@ XPIDL_MODULE = 'pref' - EXPORTS.mozilla += [ - 'Preferences.h', - ] - - UNIFIED_SOURCES += [ +Index: firefox-60.2.0/modules/libpref/moz.build +=================================================================== +--- firefox-60.2.0.orig/modules/libpref/moz.build 2018-09-05 21:49:23.106829422 +0200 ++++ firefox-60.2.0/modules/libpref/moz.build 2018-09-05 21:49:31.498872824 +0200 +@@ -32,6 +32,10 @@ UNIFIED_SOURCES += [ 'Preferences.cpp', ] @@ -103,20 +68,11 @@ include('/ipc/chromium/chromium-config.mozbuild') FINAL_LIBRARY = 'xul' - - DEFINES['OS_ARCH'] = CONFIG['OS_ARCH'] - DEFINES['MOZ_WIDGET_TOOLKIT'] = CONFIG['MOZ_WIDGET_TOOLKIT'] - if CONFIG['MOZ_ENABLE_WEBRENDER']: - DEFINES['MOZ_ENABLE_WEBRENDER'] = True -diff --git a/python/mozbuild/mozpack/chrome/flags.py b/python/mozbuild/mozpack/chrome/flags.py ---- a/python/mozbuild/mozpack/chrome/flags.py -+++ b/python/mozbuild/mozpack/chrome/flags.py -@@ -220,16 +220,17 @@ class Flags(OrderedDict): - 'contentaccessible': Flag, - 'os': StringFlag, - 'osversion': VersionFlag, - 'abi': StringFlag, - 'platform': Flag, +Index: firefox-60.2.0/python/mozbuild/mozpack/chrome/flags.py +=================================================================== +--- firefox-60.2.0.orig/python/mozbuild/mozpack/chrome/flags.py 2018-09-05 21:49:23.106829422 +0200 ++++ firefox-60.2.0/python/mozbuild/mozpack/chrome/flags.py 2018-09-05 21:49:31.498872824 +0200 +@@ -225,6 +225,7 @@ class Flags(OrderedDict): 'xpcnativewrappers': Flag, 'tablet': Flag, 'process': StringFlag, @@ -124,20 +80,11 @@ } RE = re.compile(r'([!<>=]+)') - def __init__(self, *flags): - ''' - Initialize a set of flags given in string form. - flags = Flags('contentaccessible=yes', 'appversion>=3.5') - ''' -diff --git a/python/mozbuild/mozpack/chrome/manifest.py b/python/mozbuild/mozpack/chrome/manifest.py ---- a/python/mozbuild/mozpack/chrome/manifest.py -+++ b/python/mozbuild/mozpack/chrome/manifest.py -@@ -34,16 +34,17 @@ class ManifestEntry(object): - 'platformversion', - 'os', - 'osversion', - 'abi', - 'xpcnativewrappers', +Index: firefox-60.2.0/python/mozbuild/mozpack/chrome/manifest.py +=================================================================== +--- firefox-60.2.0.orig/python/mozbuild/mozpack/chrome/manifest.py 2018-09-05 21:49:23.106829422 +0200 ++++ firefox-60.2.0/python/mozbuild/mozpack/chrome/manifest.py 2018-09-05 21:49:31.498872824 +0200 +@@ -39,6 +39,7 @@ class ManifestEntry(object): 'tablet', 'process', 'contentaccessible', @@ -145,20 +92,11 @@ ] def __init__(self, base, *flags): - ''' - Initialize a manifest entry with the given base path and flags. - ''' - self.base = base - self.flags = Flags(*flags) -diff --git a/toolkit/components/downloads/moz.build b/toolkit/components/downloads/moz.build ---- a/toolkit/components/downloads/moz.build -+++ b/toolkit/components/downloads/moz.build -@@ -41,10 +41,14 @@ EXTRA_JS_MODULES += [ - - if CONFIG['MOZ_PLACES']: - EXTRA_JS_MODULES += [ - 'DownloadHistory.jsm', - ] +Index: firefox-60.2.0/toolkit/components/downloads/moz.build +=================================================================== +--- firefox-60.2.0.orig/toolkit/components/downloads/moz.build 2018-09-05 21:49:23.106829422 +0200 ++++ firefox-60.2.0/toolkit/components/downloads/moz.build 2018-09-05 21:49:31.498872824 +0200 +@@ -46,5 +46,9 @@ if CONFIG['MOZ_PLACES']: FINAL_LIBRARY = 'xul' @@ -168,15 +106,11 @@ + with Files('**'): BUG_COMPONENT = ('Toolkit', 'Download Manager') -diff --git a/toolkit/content/jar.mn b/toolkit/content/jar.mn ---- a/toolkit/content/jar.mn -+++ b/toolkit/content/jar.mn -@@ -69,16 +69,18 @@ toolkit.jar: - content/global/bindings/checkbox.xml (widgets/checkbox.xml) - content/global/bindings/colorpicker.xml (widgets/colorpicker.xml) - content/global/bindings/datekeeper.js (widgets/datekeeper.js) - content/global/bindings/datepicker.js (widgets/datepicker.js) - content/global/bindings/datetimepopup.xml (widgets/datetimepopup.xml) +Index: firefox-60.2.0/toolkit/content/jar.mn +=================================================================== +--- firefox-60.2.0.orig/toolkit/content/jar.mn 2018-09-05 21:49:23.106829422 +0200 ++++ firefox-60.2.0/toolkit/content/jar.mn 2018-09-05 21:49:31.498872824 +0200 +@@ -74,6 +74,8 @@ toolkit.jar: content/global/bindings/datetimebox.xml (widgets/datetimebox.xml) content/global/bindings/datetimebox.css (widgets/datetimebox.css) * content/global/bindings/dialog.xml (widgets/dialog.xml) @@ -185,15 +119,10 @@ content/global/bindings/editor.xml (widgets/editor.xml) content/global/bindings/filefield.xml (widgets/filefield.xml) * content/global/bindings/findbar.xml (widgets/findbar.xml) - content/global/bindings/general.xml (widgets/general.xml) - content/global/bindings/groupbox.xml (widgets/groupbox.xml) - content/global/bindings/listbox.xml (widgets/listbox.xml) - content/global/bindings/menu.xml (widgets/menu.xml) - content/global/bindings/menulist.xml (widgets/menulist.xml) -diff --git a/toolkit/content/widgets/dialog-kde.xml b/toolkit/content/widgets/dialog-kde.xml -new file mode 100644 ---- /dev/null -+++ b/toolkit/content/widgets/dialog-kde.xml +Index: firefox-60.2.0/toolkit/content/widgets/dialog-kde.xml +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ firefox-60.2.0/toolkit/content/widgets/dialog-kde.xml 2018-09-05 21:49:31.498872824 +0200 @@ -0,0 +1,478 @@ + +