Hello community, here is the log from the commit of package MozillaFirefox for openSUSE:Factory checked in at 2017-05-04 08:52:10 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/MozillaFirefox (Old) and /work/SRC/openSUSE:Factory/.MozillaFirefox.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "MozillaFirefox" Thu May 4 08:52:10 2017 rev:252 rq:491715 version:52.1.0 Changes: -------- --- /work/SRC/openSUSE:Factory/MozillaFirefox/MozillaFirefox.changes 2017-04-11 09:29:00.114054225 +0200 +++ /work/SRC/openSUSE:Factory/.MozillaFirefox.new/MozillaFirefox.changes 2017-05-04 08:52:14.183313640 +0200 @@ -1,0 +2,90 @@ +Wed Apr 12 21:43:16 UTC 2017 - [email protected] + +- update to Firefox 52.1.0esr (boo#1035082) + MFSA 2017-12 + * CVE-2017-5443 (bmo#1342661) + Out-of-bounds write during BinHex decoding + * CVE-2017-5429 (bmo#1341096, bmo#1342823, bmo#1343261, bmo#1348894, + bmo#1348941, bmo#1349340, bmo#1350844, bmo#1352926, bmo#1353088) + Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and + Firefox ESR 52.1 + * CVE-2017-5464 (bmo#1347075) + Memory corruption with accessibility and DOM manipulation + * CVE-2017-5465 (bmo#1347617) + Out-of-bounds read in ConvolvePixel + * CVE-2017-5466 (bmo#1353975) + Origin confusion when reloading isolated data:text/html URL + * CVE-2017-5467 (bmo#1347262) + Memory corruption when drawing Skia content + * CVE-2017-5460 (bmo#1343642) + Use-after-free in frame selection + * CVE-2017-5461 (bmo#1344380) + Out-of-bounds write in Base64 encoding in NSS + * CVE-2017-5448 (bmo#1346648) + Out-of-bounds write in ClearKeyDecryptor + * CVE-2017-5449 (bmo#1340127) + Crash during bidirectional unicode manipulation with animation + * CVE-2017-5446 (bmo#1343505) + Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data + * CVE-2017-5447 (bmo#1343552) + Out-of-bounds read during glyph processing + * CVE-2017-5444 (bmo#1344461) + Buffer overflow while parsing application/http-index-format content + * CVE-2017-5445 (bmo#1344467) + Uninitialized values used while parsing application/http-index-format + content + * CVE-2017-5442 (bmo#1347979) + Use-after-free during style changes + * CVE-2017-5469 (bmo#1292534) + Potential Buffer overflow in flex-generated code + * CVE-2017-5440 (bmo#1336832) + Use-after-free in txExecutionState destructor during XSLT processing + * CVE-2017-5441 (bmo#1343795) + Use-after-free with selection during scroll events + * CVE-2017-5439 (bmo#1336830) + Use-after-free in nsTArray Length() during XSLT processing + * CVE-2017-5438 (bmo#1336828) + Use-after-free in nsAutoPtr during XSLT processing + * CVE-2017-5437 (bmo#1343453) + Vulnerabilities in Libevent library + * CVE-2017-5436 (bmo#1345461) + Out-of-bounds write with malicious font in Graphite 2 + * CVE-2017-5435 (bmo#1350683) + Use-after-free during transaction processing in the editor + * CVE-2017-5434 (bmo#1349946) + Use-after-free during focus handling + * CVE-2017-5433 (bmo#1347168) + Use-after-free in SMIL animation functions + * CVE-2017-5432 (bmo#1346654) + Use-after-free in text input selection + * CVE-2017-5430 (bmo#1329796, bmo#1337418, bmo#1339722, bmo#1340482, + bmo#1342101, bmo#1344081, bmo#1344305, bmo#1344686, bmo#1346140, + bmo#1346419, bmo#1348143, bmo#1349621, bmo#1349719, bmo#1353476) + Memory safety bugs fixed in Firefox 53 and Firefox ESR 52.1 + * CVE-2017-5459 (bmo#1333858) + Buffer overflow in WebGL + * CVE-2017-5462 (bmo#1345089) + DRBG flaw in NSS + * CVE-2017-5455 (bmo#1341191) + Sandbox escape through internal feed reader APIs + * CVE-2017-5454 (bmo#1349276) + Sandbox escape allowing file system read access through file + picker + * CVE-2017-5456 (bmo#1344415) + Sandbox escape allowing local file system access + * CVE-2017-5451 (bmo#1273537) + Addressbar spoofing with onblur event +- requires NSS 3.28.4 +- rebased patches + +------------------------------------------------------------------- +Mon Apr 3 06:28:34 UTC 2017 - [email protected] + +- switch package to use ESR52 branch + * enables plugin support by default + * service workers are disabled by default + * push notifications are disabled by default + * WebAssembly (wasm) is disabled + * Less use of multiprocess architecture Electrolysis (e10s) + ++------------------------------------------------------------------- Old: ---- firefox-52.0.2-source.tar.xz l10n-52.0.2.tar.xz New: ---- firefox-52.1.0-source.tar.xz l10n-52.1.0.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ MozillaFirefox.spec ++++++ --- /var/tmp/diff_new_pack.3NaALi/_old 2017-05-04 08:52:30.700984179 +0200 +++ /var/tmp/diff_new_pack.3NaALi/_new 2017-05-04 08:52:30.704983616 +0200 @@ -19,9 +19,9 @@ # changed with every update %define major 52 -%define mainver %major.0.2 -%define update_channel release -%define releasedate 20170324000000 +%define mainver %major.1.0 +%define update_channel esr52 +%define releasedate 20170413000000 # PIE, full relro (x86_64 for now) %define build_hardened 1 @@ -82,7 +82,7 @@ BuildRequires: libproxy-devel BuildRequires: makeinfo BuildRequires: mozilla-nspr-devel >= 4.13.1 -BuildRequires: mozilla-nss-devel >= 3.28.3 +BuildRequires: mozilla-nss-devel >= 3.28.4 BuildRequires: nss-shared-helper-devel BuildRequires: python-devel BuildRequires: startup-notification-devel ++++++ compare-locales.tar.xz ++++++ ++++++ create-tar.sh ++++++ --- /var/tmp/diff_new_pack.3NaALi/_old 2017-05-04 08:52:30.924952593 +0200 +++ /var/tmp/diff_new_pack.3NaALi/_new 2017-05-04 08:52:30.924952593 +0200 @@ -5,10 +5,10 @@ # "moz_source_stamp": "c1de04f39fa956cfce83f6065b0e709369215ed5" # http://ftp.mozilla.org/pub/firefox/candidates/48.0-candidates/build2/l10n_changesets.txt -CHANNEL="release" +CHANNEL="esr52" BRANCH="releases/mozilla-$CHANNEL" -RELEASE_TAG="FIREFOX_52_0_2_RELEASE" -VERSION="52.0.2" +RELEASE_TAG="3ea0e075203185d7f2d42f439455e97735bd1b20" +VERSION="52.1.0" # mozilla if [ -d mozilla ]; then @@ -54,7 +54,7 @@ echo "reading changeset information for $locale" _changeset=$(grep ^$locale l10n_changesets.txt | awk '{ print $2; }') echo "fetching $locale changeset $_changeset ..." - hg clone http://hg.mozilla.org/releases/l10n/mozilla-$CHANNEL/$locale l10n/$locale + hg clone http://hg.mozilla.org/releases/l10n/mozilla-release/$locale l10n/$locale [ "$RELEASE_TAG" == "default" ] || hg -R l10n/$locale up -C -r $_changeset ;; esac ++++++ firefox-52.0.2-source.tar.xz -> firefox-52.1.0-source.tar.xz ++++++ /work/SRC/openSUSE:Factory/MozillaFirefox/firefox-52.0.2-source.tar.xz /work/SRC/openSUSE:Factory/.MozillaFirefox.new/firefox-52.1.0-source.tar.xz differ: char 26, line 1 ++++++ l10n-52.0.2.tar.xz -> l10n-52.1.0.tar.xz ++++++ /work/SRC/openSUSE:Factory/MozillaFirefox/l10n-52.0.2.tar.xz /work/SRC/openSUSE:Factory/.MozillaFirefox.new/l10n-52.1.0.tar.xz differ: char 26, line 1 ++++++ mozilla-kde.patch ++++++ --- /var/tmp/diff_new_pack.3NaALi/_old 2017-05-04 08:52:31.120924956 +0200 +++ /var/tmp/diff_new_pack.3NaALi/_new 2017-05-04 08:52:31.120924956 +0200 @@ -1,5 +1,5 @@ # HG changeset patch -# Parent 5c8ae59424f5318bf7a387257771bf95d3893063 +# Parent 5f1979729aa3c6bc50f7097202991e73be677e5e Description: Add KDE integration to Firefox (toolkit parts) Author: Wolfgang Rosenauer <[email protected]> Author: Lubos Lunak <[email protected]> @@ -276,7 +276,7 @@ diff --git a/toolkit/content/jar.mn b/toolkit/content/jar.mn --- a/toolkit/content/jar.mn +++ b/toolkit/content/jar.mn -@@ -71,29 +71,33 @@ toolkit.jar: +@@ -70,29 +70,33 @@ toolkit.jar: content/global/bindings/button.xml (widgets/button.xml) content/global/bindings/checkbox.xml (widgets/checkbox.xml) content/global/bindings/colorpicker.xml (widgets/colorpicker.xml) @@ -310,18 +310,6 @@ content/global/bindings/scale.xml (widgets/scale.xml) content/global/bindings/scrollbar.xml (widgets/scrollbar.xml) content/global/bindings/scrollbox.xml (widgets/scrollbox.xml) -@@ -113,9 +117,9 @@ toolkit.jar: - content/global/bindings/videocontrols.css (widgets/videocontrols.css) - * content/global/bindings/wizard.xml (widgets/wizard.xml) - #ifdef XP_MACOSX - content/global/macWindowMenu.js - #endif - content/global/svg/svgBindings.xml (/layout/svg/resources/content/svgBindings.xml) - content/global/gmp-sources/eme-adobe.json (gmp-sources/eme-adobe.json) - content/global/gmp-sources/openh264.json (gmp-sources/openh264.json) -- content/global/gmp-sources/widevinecdm.json (gmp-sources/widevinecdm.json) -\ No newline at end of file -+ content/global/gmp-sources/widevinecdm.json (gmp-sources/widevinecdm.json) diff --git a/toolkit/content/widgets/dialog-kde.xml b/toolkit/content/widgets/dialog-kde.xml new file mode 100644 --- /dev/null ++++++ source-stamp.txt ++++++ --- /var/tmp/diff_new_pack.3NaALi/_old 2017-05-04 08:52:31.184915931 +0200 +++ /var/tmp/diff_new_pack.3NaALi/_new 2017-05-04 08:52:31.188915367 +0200 @@ -1,2 +1,2 @@ -REV=e81854d6ce91 -REPO=http://hg.mozilla.org/releases/mozilla-release +REV=3ea0e0752031 +REPO=http://hg.mozilla.org/releases/mozilla-esr52
