Hello community,
here is the log from the commit of package MozillaFirefox for
openSUSE:Leap:15.2 checked in at 2020-01-19 15:47:05
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Leap:15.2/MozillaFirefox (Old)
and /work/SRC/openSUSE:Leap:15.2/.MozillaFirefox.new.26092 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "MozillaFirefox"
Sun Jan 19 15:47:05 2020 rev:55 rq:764198 version:68.4.1
Changes:
--------
--- /work/SRC/openSUSE:Leap:15.2/MozillaFirefox/MozillaFirefox.changes
2020-01-15 14:45:25.105207507 +0100
+++
/work/SRC/openSUSE:Leap:15.2/.MozillaFirefox.new.26092/MozillaFirefox.changes
2020-01-19 15:47:28.353702135 +0100
@@ -1,0 +2,35 @@
+Thu Jan 9 06:37:13 UTC 2020 - Martin Sirringhaus <[email protected]>
+
+- Firefox Extended Support Release 68.4.1 ESR
+ * Fixed: Security fix
+ MFSA 2020-03 (bsc#1160498)
+ * CVE-2019-17026 (bmo#1607443)
+ IonMonkey type confusion with StoreElementHole and
+ FallibleStoreElement
+
+-------------------------------------------------------------------
+Tue Jan 7 14:28:41 UTC 2020 - Martin Sirringhaus <[email protected]>
+
+- Firefox Extended Support Release 68.4.0 ESR
+ * Fixed: Various security fixes
+ MFSA 2020-02 (bsc#1160305)
+ * CVE-2019-17015 (bmo#1599005)
+ Memory corruption in parent process during new content
+ process initialization on Windows
+ * CVE-2019-17016 (bmo#1599181)
+ Bypass of @namespace CSS sanitization during pasting
+ * CVE-2019-17017 (bmo#1603055)
+ Type Confusion in XPCVariant.cpp
+ * CVE-2019-17021 (bmo#1599008)
+ Heap address disclosure in parent process during content
+ process initialization on Windows
+ * CVE-2019-17022 (bmo#1602843)
+ CSS sanitization does not escape HTML tags
+ * CVE-2019-17024 (bmo#1507180, bmo#1595470, bmo#1598605,
+ bmo#1601826)
+ Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4
+- Removed patch that is now upstream: mozilla-bmo1511604.patch
+- Added patch to fix broken URL-bar on s390x:
+ mozilla-bmo1602730.patch
+
+-------------------------------------------------------------------
Old:
----
firefox-68.3.0esr.source.tar.xz
firefox-68.3.0esr.source.tar.xz.asc
l10n-68.3.0esr.tar.xz
mozilla-bmo1511604.patch
New:
----
firefox-68.4.1esr.source.tar.xz
firefox-68.4.1esr.source.tar.xz.asc
l10n-68.4.1esr.tar.xz
mozilla-bmo1602730.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ MozillaFirefox.spec ++++++
--- /var/tmp/diff_new_pack.aS5eVA/_old 2020-01-19 15:47:39.413708692 +0100
+++ /var/tmp/diff_new_pack.aS5eVA/_new 2020-01-19 15:47:39.413708692 +0100
@@ -26,8 +26,8 @@
# major 69
# mainver %major.99
%define major 68
-%define mainver %major.3.0
-%define orig_version 68.3.0
+%define mainver %major.4.1
+%define orig_version 68.4.1
%define orig_suffix esr
%define update_channel esr68
%define branding 1
@@ -42,12 +42,14 @@
%bcond_with only_print_mozconfig
+# rust/cargo have not been updated for i586. We are currently not shipping
these, so disable them for now
+ExcludeArch: i586
# Firefox only supports i686
-%ifarch %ix86
-ExclusiveArch: i586 i686
-BuildArch: i686
-%{expand:%%global optflags %(echo "%optflags"|sed -e s/i586/i686/) -march=i686
-mtune=generic}
-%endif
+#%ifarch %ix86
+#ExclusiveArch: i586 i686
+#BuildArch: i686
+#%{expand:%%global optflags %(echo "%optflags"|sed -e s/i586/i686/)
-march=i686 -mtune=generic}
+#%endif
# general build definitions
%define progname firefox
@@ -80,7 +82,7 @@
%else
BuildRequires: gcc-c++
%endif
-BuildRequires: cargo >= 1.36
+BuildRequires: cargo >= 1.34
BuildRequires: libXcomposite-devel
BuildRequires: libcurl-devel
BuildRequires: libidl-devel
@@ -104,7 +106,7 @@
# requirement to 3.4, as thats the python-version we have there
BuildRequires: python3 >= 3.4
BuildRequires: python-devel
-BuildRequires: rust >= 1.36
+BuildRequires: rust >= 1.34
BuildRequires: rust-cbindgen >= 0.8.7
BuildRequires: startup-notification-devel
BuildRequires: unzip
@@ -197,7 +199,7 @@
Patch17: mozilla-bmo1504834-part1.patch
Patch18: mozilla-bmo1504834-part2.patch
Patch19: mozilla-bmo1504834-part3.patch
-Patch20: mozilla-bmo1511604.patch
+Patch20: mozilla-bmo1602730.patch
Patch21: mozilla-bmo1554971.patch
Patch22: mozilla-nestegg-big-endian.patch
Patch24: mozilla-fix-top-level-asm.patch
++++++ _constraints ++++++
--- /var/tmp/diff_new_pack.aS5eVA/_old 2020-01-19 15:47:39.477708730 +0100
+++ /var/tmp/diff_new_pack.aS5eVA/_new 2020-01-19 15:47:39.481708732 +0100
@@ -30,4 +30,14 @@
</memory>
</hardware>
</overwrite>
+ <overwrite>
+ <conditions>
+ <arch>ppc64le</arch>
+ </conditions>
+ <hardware>
+ <disk>
+ <size unit="G">24</size>
+ </disk>
+ </hardware>
+ </overwrite>
</constraints>
++++++ firefox-68.3.0esr.source.tar.xz -> firefox-68.4.1esr.source.tar.xz ++++++
/work/SRC/openSUSE:Leap:15.2/MozillaFirefox/firefox-68.3.0esr.source.tar.xz
/work/SRC/openSUSE:Leap:15.2/.MozillaFirefox.new.26092/firefox-68.4.1esr.source.tar.xz
differ: char 15, line 1
++++++ l10n-68.3.0esr.tar.xz -> l10n-68.4.1esr.tar.xz ++++++
++++++ mozilla-bmo1511604.patch -> mozilla-bmo1602730.patch ++++++
--- /work/SRC/openSUSE:Leap:15.2/MozillaFirefox/mozilla-bmo1511604.patch
2020-01-15 14:45:31.849212541 +0100
+++
/work/SRC/openSUSE:Leap:15.2/.MozillaFirefox.new.26092/mozilla-bmo1602730.patch
2020-01-19 15:47:35.489706366 +0100
@@ -1,53 +1,28 @@
-# HG changeset patch
-# User A. Wilcox <[email protected]>
-# Date 1543674229 0
-# Sat Dec 01 14:23:49 2018 +0000
-# Node ID 0309ff19e46b126c527e633518d7de8570442114
-# Parent 5b5a6a164acbd4da6131808bd12e42e7b0a33c2a
-Bug 1511604 - Swizzle YCbCr->RGB data on big-endian machines
-Taken from https://bugzilla.mozilla.org/show_bug.cgi?id=1511604
-
-This is very closely related to mozilla-bmo1504834
-
-Again, input for skia is swizzled to LE, as skia only understands LE.
-
-diff -r 5b5a6a164acb gfx/ycbcr/YCbCrUtils.cpp
---- a/gfx/ycbcr/YCbCrUtils.cpp Mon Sep 09 17:59:29 2019 +0200
-+++ b/gfx/ycbcr/YCbCrUtils.cpp Tue Sep 10 08:22:10 2019 +0200
-@@ -3,7 +3,9 @@
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+diff -r 6ef20eee3f8f gfx/layers/basic/BasicCompositor.cpp
+--- a/gfx/layers/basic/BasicCompositor.cpp Thu Oct 31 09:11:56 2019 +0100
++++ b/gfx/layers/basic/BasicCompositor.cpp Wed Dec 11 16:16:09 2019 +0100
+@@ -693,9 +693,13 @@
-+#include "mozilla/EndianUtils.h"
- #include "gfx2DGlue.h"
-+#include "mozilla/gfx/Swizzle.h"
-
- #include "YCbCrUtils.h"
- #include "yuv_convert.h"
-@@ -236,6 +238,13 @@
- yuvtype,
- srcData.mYUVColorSpace);
+ RefPtr<SourceSurface> sourceMask;
+ Matrix maskTransform;
++ // Setting an alpha-mask here breaks the URL-bar on big endian (s390x)
++ // if the typed URL is too long for the textbox (automatic scrolling needed)
++#if MOZ_LITTLE_ENDIAN
+ if (aTransform.Is2D()) {
+ SetupMask(aEffectChain, dest, offset, sourceMask, maskTransform);
}
-+#if MOZ_BIG_ENDIAN
-+ // libyuv makes endian-correct result, which needs to be swapped to BGRX
-+ if (aDestFormat != SurfaceFormat::R5G6B5_UINT16)
-+ gfx::SwizzleData(aDestBuffer, aStride, gfx::SurfaceFormat::X8R8G8B8,
-+ aDestBuffer, aStride, gfx::SurfaceFormat::B8G8R8X8,
-+ srcData.mPicSize);
+#endif
- }
- void
-@@ -257,6 +266,12 @@
- aSrcStrideYA,
- aSrcStrideUV,
- aDstStrideARGB);
-+#if MOZ_BIG_ENDIAN
-+ // libyuv makes endian-correct result, which needs to be swapped to BGRA
-+ gfx::SwizzleData(aDstARGB, aDstStrideARGB, gfx::SurfaceFormat::A8R8G8B8,
-+ aDstARGB, aDstStrideARGB, gfx::SurfaceFormat::B8G8R8A8,
-+ IntSize(aWidth, aHeight));
-+#endif
- }
+ CompositionOp blendMode = CompositionOp::OP_OVER;
+ if (Effect* effect =
+diff -r 6ef20eee3f8f gfx/layers/composite/CompositableHost.cpp
+--- a/gfx/layers/composite/CompositableHost.cpp Thu Oct 31 09:11:56
2019 +0100
++++ b/gfx/layers/composite/CompositableHost.cpp Wed Dec 11 16:16:09
2019 +0100
+@@ -91,6 +91,7 @@
+ }
+ MOZ_ASSERT(source);
- } // namespace gfx
++ // Alternatively: Comment out these lines where the alpha-mask is set
+ RefPtr<EffectMask> effect =
+ new EffectMask(source, source->GetSize(), aTransform);
+ aEffects.mSecondaryEffects[EffectTypes::MASK] = effect;
++++++ tar_stamps ++++++
--- /var/tmp/diff_new_pack.aS5eVA/_old 2020-01-19 15:47:39.981709029 +0100
+++ /var/tmp/diff_new_pack.aS5eVA/_new 2020-01-19 15:47:39.985709031 +0100
@@ -1,10 +1,10 @@
PRODUCT="firefox"
CHANNEL="esr68"
-VERSION="68.3.0"
+VERSION="68.4.1"
VERSION_SUFFIX="esr"
-PREV_VERSION="68.2.0"
+PREV_VERSION="68.4.0"
PREV_VERSION_SUFFIX="esr"
#SKIP_LOCALES="" # Uncomment to skip l10n and compare-locales-generation
RELEASE_REPO="https://hg.mozilla.org/releases/mozilla-esr68";
-RELEASE_TAG="fd17b62d5247816244c319271800ef1df2697c82"
-RELEASE_TIMESTAMP="20191126000427"
+RELEASE_TAG="8b51bf38ddbb00131188d833c1441bb37128634b"
+RELEASE_TIMESTAMP="20200107212959"
