| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: MozillaFirefox | Distribution: openSUSE Tumbleweed |
| Version: 149.0.2 | Vendor: openSUSE |
| Release: 1.1 | Build date: Tue Apr 7 07:09:07 2026 |
| Group: Productivity/Networking/Web/Browsers | Build host: reproducible |
| Size: 274149210 | Source RPM: MozillaFirefox-149.0.2-1.1.src.rpm |
| Packager: https://bugs.opensuse.org | |
| Url: http://www.mozilla.org/ | |
| Summary: Mozilla Firefox Web Browser | |
Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions.
MPL-2.0
* Tue Apr 07 2026 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 149.0.2
MFSA 2026-25
* CVE-2026-5732 (bmo#2017867)
Incorrect boundary conditions, integer overflow in the
Graphics: Text component
* CVE-2026-5733 (bmo#2022554)
Incorrect boundary conditions in the Graphics: WebGPU component
* CVE-2026-5731 (bmo#2021894, bmo#2022225, bmo#2022252, bmo#2022294,
bmo#2023007, bmo#2023130, bmo#2023191, bmo#2023364, bmo#2023829,
bmo#2024074, bmo#2024417, bmo#2024433, bmo#2024436, bmo#2024437,
bmo#2024453, bmo#2024461, bmo#2024462, bmo#2024472, bmo#2024474,
bmo#2024477, bmo#2025364, bmo#2025401, bmo#2025402, bmo#2025472,
bmo#2026287, bmo#2026299, bmo#2026305, bmo#2026426)
Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR
140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and
Thunderbird 149.0.2
* CVE-2026-5734 (bmo#2022369, bmo#2023026, bmo#2023545, bmo#2023555,
bmo#2023958, bmo#2025422, bmo#2025468, bmo#2025492, bmo#2025505)
Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird
ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2
* CVE-2026-5735 (bmo#2025475, bmo#2025477)
Memory safety bugs fixed in Firefox 149.0.2 and Thunderbird
149.0.2
* Enterprise: Introduced a new enterprise policy that allows
administrators to directly manage and control AI-related
features within Firefox. (bmo#2019983)
* Enterprise: Fixed an issue where enterprise policies for the
browser homepage and start page were not being applied
correctly. (bmo#2027888)
* Enterprise: Introduced a new enterprise policy that allows
administrators to prevent the built-in VPN and IP protection
features from being available to users. (bmo#2022365)
* Fixed: Fixed an issue where certain parts of web pages, such
as drop-down menus and specific styles, did not appear
correctly when printing. (bmo#2026109)
* Fixed: Fixed an issue where some website error pages
displayed generic connection messages instead of the specific
error code and description provided by the server. (bmo#2023800)
* Fixed: Fixed a crash that occurred when using certain
security keys or WebAuthn features for two-factor
authentication. (bmo#2026688)
* Fixed: Fixed an issue on Linux where the browser toolbar
could become unresponsive to mouse clicks after dragging a
tab when using Wayland. (bmo#2022238)
* Fixed: Fixed a layout issue where text inside certain
graphics (SVG) appeared shifted or misaligned from its
intended position. (bmo#2024647)
* Fixed: Fixed an issue where the "Send to device" option
failed to work when used from the Open Tabs section in
Firefox View. (bmo#2023201)
* Fri Mar 27 2026 Manfred Hollstein <manfred.h@gmx.net>
- Building on Leap definitely needs to be clang based; define
clang_build appropriately. To make clang find a suitable STL
library, explicitly BuildRequire libstdc++6-devel-gcc?? which
corresponds to the version of which gcc would be used.
* Thu Mar 26 2026 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 149.0
https://www.firefox.com/en-US/firefox/149.0/releasenotes
MFSA 2026-20 (bsc#1260083)
* CVE-2026-4684 (bmo#2011129)
Race condition, use-after-free in the Graphics: WebRender
component
* CVE-2026-4685 (bmo#2016349)
Incorrect boundary conditions in the Graphics: Canvas2D
component
* CVE-2026-4686 (bmo#2016351)
Incorrect boundary conditions in the Graphics: Canvas2D
component
* CVE-2026-4687 (bmo#2016368)
Sandbox escape due to incorrect boundary conditions in the
Telemetry component
* CVE-2026-4688 (bmo#2016373)
Sandbox escape due to use-after-free in the Disability Access
APIs component
* CVE-2026-4689 (bmo#2016374)
Sandbox escape due to incorrect boundary conditions, integer
overflow in the XPCOM component
* CVE-2026-4690 (bmo#2016375)
Sandbox escape due to incorrect boundary conditions, integer
overflow in the XPCOM component
* CVE-2026-4691 (bmo#2017512)
Use-after-free in the CSS Parsing and Computation component
* CVE-2026-4692 (bmo#2017643)
Sandbox escape in the Responsive Design Mode component
* CVE-2026-4693 (bmo#2018102)
Incorrect boundary conditions in the Audio/Video: Playback
component
* CVE-2026-4694 (bmo#2018430)
Incorrect boundary conditions, integer overflow in the
Graphics component
* CVE-2026-4695 (bmo#2020030)
Incorrect boundary conditions in the Audio/Video: Web Codecs
component
* CVE-2026-4696 (bmo#2020190)
Use-after-free in the Layout: Text and Fonts component
* CVE-2026-4697 (bmo#2020422)
Incorrect boundary conditions in the Audio/Video: Web Codecs
component
* CVE-2026-4698 (bmo#2020906)
JIT miscompilation in the JavaScript Engine: JIT component
* CVE-2026-4699 (bmo#2021863)
Incorrect boundary conditions in the Layout: Text and Fonts
component
* CVE-2026-4700 (bmo#2003766)
Mitigation bypass in the Networking: HTTP component
* CVE-2026-4701 (bmo#2009303)
Use-after-free in the JavaScript Engine component
* CVE-2026-4722 (bmo#2010097)
Privilege escalation in the IPC component
* CVE-2026-4702 (bmo#2013560)
JIT miscompilation in the JavaScript Engine component
* CVE-2026-4723 (bmo#2013573)
Use-after-free in the JavaScript Engine component
* CVE-2026-4724 (bmo#2014865)
Undefined behavior in the Audio/Video component
* CVE-2026-4704 (bmo#2014868)
Denial-of-service in the WebRTC: Signaling component
* CVE-2026-4705 (bmo#2014873)
Undefined behavior in the WebRTC: Signaling component
* CVE-2026-4706 (bmo#2015091)
Incorrect boundary conditions in the Graphics: Canvas2D
component
* CVE-2026-4707 (bmo#2015267)
Incorrect boundary conditions in the Graphics: Canvas2D
component
* CVE-2026-4708 (bmo#2015268)
Incorrect boundary conditions in the Graphics component
* CVE-2026-4709 (bmo#2016329, bmo#2016342)
Incorrect boundary conditions in the Audio/Video: GMP
component
* CVE-2026-4710 (bmo#2016370)
Incorrect boundary conditions in the Audio/Video component
* CVE-2026-4711 (bmo#2017002)
Use-after-free in the Widget: Cocoa component
* CVE-2026-4725 (bmo#2017108)
Sandbox escape due to use-after-free in the Graphics:
Canvas2D component
* CVE-2026-4712 (bmo#2017666)
Information disclosure in the Widget: Cocoa component
* CVE-2026-4713 (bmo#2018113)
Incorrect boundary conditions in the Graphics component
* CVE-2026-4714 (bmo#2018126)
Incorrect boundary conditions in the Audio/Video component
* CVE-2026-4715 (bmo#2018405)
Uninitialized memory in the Graphics: Canvas2D component
* CVE-2026-4716 (bmo#2018592)
Incorrect boundary conditions, uninitialized memory in the
JavaScript Engine component
* CVE-2026-4717 (bmo#2021695)
Privilege escalation in the Netmonitor component
* CVE-2026-4726 (bmo#1955311)
Denial-of-service in the XML component
* CVE-2025-59375 (bmo#1988467)
Denial-of-service in the XML component
* CVE-2026-4727 (bmo#2008112)
Denial-of-service in the Libraries component in NSS
* CVE-2026-4728 (bmo#2013179)
Spoofing issue in the Privacy: Anti-Tracking component
* CVE-2026-4718 (bmo#2014864)
Undefined behavior in the WebRTC: Signaling component
* CVE-2026-4719 (bmo#2016367)
Incorrect boundary conditions in the Graphics: Text component
* CVE-2026-4720 (bmo#2004652, bmo#2019372, bmo#2021922,
bmo#2022567, bmo#2022733)
Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird
ESR 140.9, Firefox 149 and Thunderbird 149
* CVE-2026-4729 (bmo#1944033, bmo#1997282, bmo#2009213,
bmo#2011412, bmo#2021925, bmo#2022034)
Memory safety bugs fixed in Firefox 149 and Thunderbird 149
* CVE-2026-4721 (bmo#2013762, bmo#2015291, bmo#2016591,
bmo#2016661, bmo#2016664, bmo#2017303, bmo#2017894,
bmo#2018090, bmo#2018196, bmo#2018379, bmo#2019112,
bmo#2022090, bmo#2022243, bmo#2022351, bmo#2022478,
bmo#2022676)
Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR
140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149
- requires NSS >= 3.121
- removed obsolete mozilla-breakpad.patch
- build using rust 1.93
- fix the .spec file to not fail when trying to remove a non
existing firefox-l10n.js during installation
* Thu Mar 19 2026 Josef Melcr <josef.melcr@suse.com>
- Fix PGO builds with GCC
* add mozilla-sandbox-lto.patch
* Sun Mar 15 2026 Aaron Puchert <aaronpuchert@alice-dsl.net>
- Use current Clang on Tumbleweed.
* Tue Mar 10 2026 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 148.0.2
* https://www.firefox.com/en-US/firefox/148.0.2/releasenotes
MFSA 2026-19 (boo#)
* CVE-2026-3846 (bmo#2018400)
Same-origin policy bypass in the CSS Parsing and Computation
component
* CVE-2026-3847 (bmo#2017513, bmo#2017622, bmo#2019341)
Memory safety bugs fixed in Firefox 148.0.2
* Fixed an issue where searches entered in the Firefox Home
search field were incorrectly redirected to the address bar for
some users who had disabled search handoff behavior via
advanced settings. (bmo#2017049)
* Fixed an issue where some web-based rich text editors stopped
applying formatting, such as bold or italic. (bmo#2020927)
* Fixed an issue where videos could autoplay unexpectedly on
YouTube despite autoplay being blocked, particularly impacting
screen reader users. (bmo#2020233)
* Fixed an issue that caused some absolutely positioned elements
meant to be centered, for example, using `margin: auto with
inset: 0`, to appear left-aligned on initial load.
(bmo#2017440)
* Fixed an issue where the “Switch to Tab” suggestion in the
address bar appeared blank for pages without a title.
(bmo#2020341)
* Mon Feb 23 2026 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 148.0
* https://www.firefox.com/en-US/firefox/148.0/releasenotes
MFSA 2026-13 (bsc#1258568)
* CVE-2026-2757 (bmo#2001637)
Incorrect boundary conditions in the WebRTC: Audio/Video component
* CVE-2026-2794 (bmo#2008365)
Information disclosure due to uninitialized memory in Firefox
and Firefox Focus for Android
* CVE-2026-2758 (bmo#2009608)
Use-after-free in the JavaScript: GC component
* CVE-2026-2759 (bmo#2010933)
Incorrect boundary conditions in the Graphics: ImageLib component
* CVE-2026-2795 (bmo#2010940)
Use-after-free in the JavaScript: GC component
* CVE-2026-2760 (bmo#2011062)
Sandbox escape due to incorrect boundary conditions in the
Graphics: WebRender component
* CVE-2026-2761 (bmo#2011063)
Sandbox escape in the Graphics: WebRender component
* CVE-2026-2762 (bmo#2011649)
Integer overflow in the JavaScript: Standard Library component
* CVE-2026-2763 (bmo#2012018)
Use-after-free in the JavaScript Engine component
* CVE-2026-2764 (bmo#2012608)
JIT miscompilation, use-after-free in the JavaScript Engine:
JIT component
* CVE-2026-2796 (bmo#2013165)
JIT miscompilation in the JavaScript: WebAssembly component
* CVE-2026-2797 (bmo#2013561)
Use-after-free in the JavaScript: GC component
* CVE-2026-2765 (bmo#2013562)
Use-after-free in the JavaScript Engine component
* CVE-2026-2766 (bmo#2013583)
Use-after-free in the JavaScript Engine: JIT component
* CVE-2026-2767 (bmo#2013741)
Use-after-free in the JavaScript: WebAssembly component
* CVE-2026-2768 (bmo#2014101)
Sandbox escape in the Storage: IndexedDB component
* CVE-2026-2798 (bmo#2014136)
Use-after-free in the DOM: Core & HTML component
* CVE-2026-2769 (bmo#2014550)
Use-after-free in the Storage: IndexedDB component
* CVE-2026-2799 (bmo#2014551)
Use-after-free in the DOM: Core & HTML component
* CVE-2026-2770 (bmo#2014585)
Use-after-free in the DOM: Bindings (WebIDL) component
* CVE-2026-2771 (bmo#2014593)
Undefined behavior in the DOM: Core & HTML component
* CVE-2026-2772 (bmo#2014827)
Use-after-free in the Audio/Video: Playback component
* CVE-2026-2773 (bmo#2014832)
Incorrect boundary conditions in the Web Audio component
* CVE-2026-2774 (bmo#2014883)
Integer overflow in the Audio/Video component
* CVE-2026-2775 (bmo#2015199)
Mitigation bypass in the DOM: HTML Parser component
* CVE-2026-2776 (bmo#2015266)
Sandbox escape due to incorrect boundary conditions in the
Telemetry component in External Software
* CVE-2026-2777 (bmo#2015305)
Privilege escalation in the Messaging System component
* CVE-2026-2778 (bmo#2016358)
Sandbox escape due to incorrect boundary conditions in the
DOM: Core & HTML component
* CVE-2026-2779 (bmo#1164141)
Incorrect boundary conditions in the Networking: JAR component
* CVE-2026-2800 (bmo#1988145)
Spoofing issue in the WebAuthn component in Firefox for Android
* CVE-2026-2780 (bmo#2007829)
Privilege escalation in the Netmonitor component
* CVE-2026-2781 (bmo#2009552)
Integer overflow in the Libraries component in NSS
* CVE-2026-2801 (bmo#2009901)
Incorrect boundary conditions in the JavaScript: WebAssembly
component
* CVE-2026-2782 (bmo#2010743)
Privilege escalation in the Netmonitor component
* CVE-2026-2783 (bmo#2010943)
Information disclosure due to JIT miscompilation in the
JavaScript Engine: JIT component
* CVE-2026-2802 (bmo#2011069)
Race condition in the JavaScript: GC component
* CVE-2026-2803 (bmo#2012012)
Information disclosure, mitigation bypass in the Settings UI
component
* CVE-2026-2784 (bmo#2012984)
Mitigation bypass in the DOM: Security component
* CVE-2026-2785 (bmo#2013549)
Invalid pointer in the JavaScript Engine component
* CVE-2026-2804 (bmo#2013584)
Use-after-free in the JavaScript: WebAssembly component
* CVE-2026-2786 (bmo#2013612)
Use-after-free in the JavaScript Engine component
* CVE-2026-2805 (bmo#2014549)
Invalid pointer in the DOM: Core & HTML component
* CVE-2026-2787 (bmo#2014560)
Use-after-free in the DOM: Window and Location component
* CVE-2026-2788 (bmo#2014824)
Incorrect boundary conditions in the Audio/Video: GMP component
* CVE-2026-2789 (bmo#2015179)
Use-after-free in the Graphics: ImageLib component
* CVE-2026-2806 (bmo#2006199)
Uninitialized memory in the Graphics: Text component
* CVE-2026-2790 (bmo#2008426)
Same-origin policy bypass in the Networking: JAR component
* CVE-2026-2791 (bmo#2015220)
Mitigation bypass in the Networking: Cache component
* CVE-2026-2807 (bmo#1756056, bmo#1999402, bmo#2004872,
bmo#2006037, bmo#2012855)
Memory safety bugs fixed in Firefox 148 and Thunderbird 148
* CVE-2026-2792 (bmo#2008912, bmo#2010050, bmo#2010275, bmo#2012331)
Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird
ESR 140.8, Firefox 148 and Thunderbird 148
* CVE-2026-2793 (bmo#2015196, bmo#2016423, bmo#2016498)
Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR
140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148
- requires NSS 3.120.1
- added mozilla-breakpad.patch to fix build
* Tue Feb 17 2026 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 147.0.4
* Fixed an issue that could cause the New Tab Page to appear
blank for some users (bmo#2014616)
MFSA 2026-10 (bsc#1258231)
* CVE-2026-2447 (bmo#2014390)
Heap buffer overflow in libvpx
* Sun Feb 08 2026 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 147.0.3
* Interoperability improvements for the CSS anchor positioning
and Navigation web APIs
* Fix a regression where `position: sticky` elements on some
webpages could appear stuck or fail to update while
mousewheel-scrolling after certain `:hover` interactions
(bmo#2010481)
* Fix an issue where the Firefox Developer Tools could fail to
re-open after using the Inspector’s node picker and reloading
a page containing cross-origin iframes (bmo#2003810)
* Fix an issue where the DNS over HTTPS provider settings section
could appear as a blank box, preventing users from seeing the
current setting or changing it (bmo#2010501)
* Wed Jan 28 2026 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 147.0.2
* Resolved various issues with missing or impaired browser
functionality when using XDG Base Directories on Linux. (bmo#2011300)
* Fixed an issue causing excess passkey prompts to appear when
logging into some sites. (bmo#2010919)
* Fixed an issue that could lead to sites being incorrectly
flagged as malicious by SafeBrowsing. (bmo#2010956)
MFSA 2026-06 (bsc#1257363)
* CVE-2026-24868 (bmo#2007302)
Mitigation bypass in the Privacy: Anti-Tracking component
* CVE-2026-24869 (bmo#2008698)
Use-after-free in the Layout: Scrolling and Overflow component
* Tue Jan 20 2026 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 147.0.1
* Fixed compatibility problems with websites that use the new
Compression Dictionaries technology, such as ChatGPT, by
temporarily disabling the feature. (bmo#2010712)
* Fixed an issue where an unnecessary empty directory was created
on Linux systems. (bmo#2001887)
* Fixed an issue where time formats could cause certain
websites to display incorrectly. (bmo#2010411)
- drop mozilla-bmo2008777.patch, included
* Sun Jan 11 2026 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 147.0
https://www.firefox.com/en-US/firefox/147.0/releasenotes
MFSA 2026-01 (bsc#1256340)
* CVE-2026-0877 (bmo#1999257)
Mitigation bypass in the DOM: Security component
* CVE-2026-0878 (bmo#2003989)
Sandbox escape due to incorrect boundary conditions in the
Graphics: CanvasWebGL component
* CVE-2026-0879 (bmo#2004602)
Sandbox escape due to incorrect boundary conditions in the
Graphics component
* CVE-2026-0880 (bmo#2005014)
Sandbox escape due to integer overflow in the Graphics
component
* CVE-2026-0881 (bmo#2005845)
Sandbox escape in the Messaging System component
* CVE-2026-0882 (bmo#1924125)
Use-after-free in the IPC component
* CVE-2026-0883 (bmo#1989340)
Information disclosure in the Networking component
* CVE-2026-0884 (bmo#2003588)
Use-after-free in the JavaScript Engine component
* CVE-2026-0885 (bmo#2003607)
Use-after-free in the JavaScript: GC component
* CVE-2026-0886 (bmo#2005658)
Incorrect boundary conditions in the Graphics component
* CVE-2026-0887 (bmo#2006500)
Clickjacking issue, information disclosure in the PDF Viewer
component
* CVE-2026-0888 (bmo#1985996)
Information disclosure in the XML component
* CVE-2026-0889 (bmo#1999084)
Denial-of-service in the DOM: Service Workers component
* CVE-2026-0890 (bmo#2005081)
Spoofing issue in the DOM: Copy & Paste and Drag & Drop
component
* CVE-2026-0891 (bmo#1964722, bmo#2000981, bmo#2003100,
bmo#2003278)
Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird
ESR 140.7, Firefox 147 and Thunderbird 147
* CVE-2026-0892 (bmo#1986912, bmo#1996718, bmo#1999633,
bmo#2001081, bmo#2004443)
Memory safety bugs fixed in Firefox 147 and Thunderbird 147
- requires NSS >= 3.119
- Added upstream patch mozilla-bmo2008777.patch to fix KDE crash (boo#1256513)
* Thu Dec 18 2025 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 146.0.1
https://www.firefox.com/en-US/firefox/146.0.1/releasenotes/
MFSA 2025-98 (boo#1255367)
* CVE-2025-14860 (bmo#2000597)
Use-after-free in the Disability Access APIs component
* CVE-2025-14861 (bmo#1996570, bmo#1999700)
Memory safety bugs fixed in Firefox 146.0.
* Improved overall stability by fixing crashes related
to browsing, graphics, and accessibility features.
(bmo#2001160, bmo#1998185, bmo#1998188)
* Fixed an issue where fingerprinting protection caused
incorrect font rendering on popular websites. (bmo#2000429)
* Fixed crashes related to media playback and GMP process
shutdown. (bmo#2002697)
* Fixed an issue where desktop profile shortcuts were being
unintentionally removed when changing copied profile
settings. (bmo#1998209)
* Improved sidebar text contrast when using vertical tabs with
certain themes. (bmo#2006091)
* When restoring from a backup, the restore success message will
appear over the new tab page instead of one of the tabs
restored from a backup, to avoid cases where the restored tab
canceled the restore success message. (bmo#2003307)
* Tue Dec 09 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 146.0
https://www.firefox.com/en-US/firefox/146.0/releasenotes/
MFSA 2025-92 (bsc#1254551)
* CVE-2025-14321 (bmo#1992760)
Use-after-free in the WebRTC: Signaling component
* CVE-2025-14322 (bmo#1996473)
Sandbox escape due to incorrect boundary conditions in the
Graphics: CanvasWebGL component
* CVE-2025-14323 (bmo#1996555)
Privilege escalation in the DOM: Notifications component
* CVE-2025-14324 (bmo#1996840)
JIT miscompilation in the JavaScript Engine: JIT component
* CVE-2025-14325 (bmo#1998050)
JIT miscompilation in the JavaScript Engine: JIT component
* CVE-2025-14326 (bmo#1840666)
Use-after-free in the Audio/Video: GMP component
* CVE-2025-14327 (bmo#1970743)
Spoofing issue in the Downloads Panel component
* CVE-2025-14328 (bmo#1996761)
Privilege escalation in the Netmonitor component
* CVE-2025-14329 (bmo#1997018)
Privilege escalation in the Netmonitor component
* CVE-2025-14330 (bmo#1997503)
JIT miscompilation in the JavaScript Engine: JIT component
* CVE-2025-14331 (bmo#2000218)
Same-origin policy bypass in the Request Handling component
* CVE-2025-14332 (bmo#1963153, bmo#1985058, bmo#1995637, bmo#1997118)
Memory safety bugs fixed in Firefox 146 and Thunderbird 146
* CVE-2025-14333 (bmo#1966501, bmo#1997639)
Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
ESR 140.6, Firefox 146 and Thunderbird 146
- requires
NPSR 4.38.2
NSS 3.118
rust-cbindgen 0.29.1
- switched back using gcc
- rebased patches
* Sun Nov 30 2025 Manfred Hollstein <manfred.h@gmx.net>
- If clang_build is set, ensure to define CC and CXX accordingly.
- Use clang19-devel on Leap.
* Wed Nov 26 2025 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 145.0.2
* Fixed an issue that prevented typing in Baidu’s search box when
using Chinese IMEs on Windows. (bmo#2000479)
* Sat Nov 22 2025 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 145.0.1
* Fixed: Fixed an issue causing breakage on sites using
Three.js. (bmo#1995939)
* Fixed: Fixed Web compatibility issues with Rogers. Rogers
customers would see a broken iframe with "Firefox Can’t Open
This Page" when viewing bills, rather than the billing info.
(bmo#1996823)
* Fixed: Fixed an issue in the Web Developer Tools preventing
copy all or save all requests as HAR. (bmo#1995694)
* Sun Nov 09 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 145.0
* New: Add, edit, and delete comments to make your own notes in
PDFs (summaries, questions, tasks, etc.). The comment sidebar
helps you scan all your comments and quickly jump to them,
which is handy for long or heavily marked-up PDFs.
* New: This version introduces a new phase of privacy
protections, building on our research on reducing browser
fingerprinting. These new defenses cut the percentage of
users seen as unique almost in half, ensuring a safer and
more private browsing experience in Private Browsing or when
using *Enhanced Tracking Protection* set to *Strict*.
* New: Need a reminder of what tabs are in a group? Hover over
the tab group name to get a preview of the tabs inside
without opening it. (bmo#1992228)
* New: You can now access and manage your saved passwords right
from the sidebar—no need to open a new tab or window. Stay on
the page you’re on and get to your logins faster.
* New: Copy Link to Highlight allows users to share arbitrary
sections of a page with others by copying a link through the
context menu with a given selection
* New: The Translations feature has an improved experience when
translating between languages with different script
directions.
* New: New brand-inspired wallpapers are available for New Tab
on desktop, with versions for both light and dark mode.
* New: With the new Open links from apps next to your active
tab setting, you can have links from other applications open
next to your active tab instead of at the end of the tab
strip.
* New: Enhanced Bounce Tracking Protection’s stateless mode is
now enabled by default in ETP Strict, blocking more advanced
tracking techniques based on redirection
* New: For most Windows users, the existing desktop shortcut
for launching Firefox has been replaced with the desktop
launcher, a small program that will launch Firefox if it is
installed, but if it is not installed will prompt the user to
install Firefox. This will provide an easy installation point
for Firefox users who acquire a new Windows device, where
Firefox will not be installed by default, but the desktop
launcher program may have synced via OneDrive or other cloud
storage product. Learn more.
* Changed: Firefox no longer supports 32-bit Linux systems. We
recommend installing the 64-bit version for continued updates
and support.
* Changed: Horizontal tabs are now slightly more rounded to
match the look of vertical tabs. Buttons and text inputs,
including the address bar, have also been updated for
consistency. (bmo#1988794)
* Changed: When no extensions are installed, clicking the
Extensions button now shows a message highlighting how
extensions can enhance your browsing, with links to the
Firefox Add-ons store. (bmo#1778684)
* Changed: Local translation models are now compressed with
Zstandard, reducing download sizes and on-device storage
consumption. As always, all Firefox translations happen
securely and privately on your local device, unlike other
browsers that translate using cloud services.
* Changed: We updated default automation preferences to better
support Agentic browsing, reducing the steps agents need to
complete a task and chances for the agent to get stuck.
(bmo#1991970)
* HTML5: Support has been added for the `Atomics.waitAsync`
proposal, which is a non-blocking, asynchronous version of
`Atomics.wait`. This allow synchronization of threads based
upon the value in a shared memory location, for more details
please consult our MDN documentation.
* HTML5: Firefox now supports the new `Integrity-Policy` header
for enforcing sub-resource integrity for scripts. Further
implementation of this header is underway.
* HTML5: Added Matroska support for the most commonly used
codecs: AVC, HEVC, VP8, VP9, AV1, AAC, Opus, and Vorbis.
(bmo#1991752)
* HTML5: The text-autospace property is now supported, allowing
automatic spacing adjustments between characters from
different scripts.
* HTML5: The WebGPU DOM API (spec; MDN) is now available on
macOS 26 (Tahoe) on Apple Silicon. For details, see the
Mozilla Graphics Team Blog.
* Developer: Microsoft UI Automation phased release rollout at
100%. Microsoft UI Automation is the new accessibility
framework for Microsoft Windows. This will provide better
assistive technology (AT) support and performance on Windows
for current and future assistive technologies.
* Enterprise: You can find information about policy updates and
enterprise specific bug fixes in the Firefox for Enterprise
145 Release Notes.
* Fixed: Various security fixes.
MFSA 2025-87 (bsc#1253188)
* CVE-2025-13021 (bmo#1986431)
Incorrect boundary conditions in the Graphics: WebGPU
component
* CVE-2025-13022 (bmo#1988488)
Incorrect boundary conditions in the Graphics: WebGPU
component
* CVE-2025-13012 (bmo#1991458)
Race condition in the Graphics component
* CVE-2025-13023 (bmo#1992032)
Sandbox escape due to incorrect boundary conditions in the
Graphics: WebGPU component
* CVE-2025-13016 (bmo#1992130)
Incorrect boundary conditions in the JavaScript: WebAssembly
component
* CVE-2025-13024 (bmo#1992902)
JIT miscompilation in the JavaScript Engine: JIT component
* CVE-2025-13025 (bmo#1994022)
Incorrect boundary conditions in the Graphics: WebGPU
component
* CVE-2025-13026 (bmo#1994441)
Sandbox escape due to incorrect boundary conditions in the
Graphics: WebGPU component
* CVE-2025-13017 (bmo#1980904)
Same-origin policy bypass in the DOM: Notifications component
* CVE-2025-13018 (bmo#1984940)
Mitigation bypass in the DOM: Security component
* CVE-2025-13019 (bmo#1988412)
Same-origin policy bypass in the DOM: Workers component
* CVE-2025-13013 (bmo#1991945)
Mitigation bypass in the DOM: Core & HTML component
* CVE-2025-13020 (bmo#1995686)
Use-after-free in the WebRTC: Audio/Video component
* CVE-2025-13014 (bmo#1994241)
Use-after-free in the Audio/Video component
* CVE-2025-13015 (bmo#1994164)
Spoofing issue in Firefox
* CVE-2025-13027 (bmo#1987237, bmo#1990079, bmo#1991715,
bmo#1994994)
Memory safety bugs fixed in Firefox 145 and Thunderbird 145
- Remove upstreamed patch mozilla-bmo998749.patch
* Wed Oct 29 2025 Martin Sirringhaus <martin.sirringhaus@suse.com>
- Mozilla Firefox 144.0.2
* Fixed: Fixed an issue where the list of available locales in
`about:settings` contained more locales than were downloaded
or currently supported. (bmo#1994642)
* Fixed: Fixed an issue where using the keyboard to open the
Unified Search dropdown was inconsistent. The dropdown now
expands properly, allowing users to select a search engine
using the keyboard. (bmo#1979826)
* Fixed: Fixed an issue where curated photo collections on
Microsoft OneDrive's Photos “For You” page failed to load,
showing a gray screen instead of content. Collections now
display as expected. (bmo#1986533)
* Fixed: Fixed a startup crash affecting Windows users with
Avast or other security software installed. (bmo#1992678)
* Fixed: Fixed an issue on macOS where the emoji picker
shortcut and menu entry stopped working after switching
between apps. (bmo#1980815)
* Fixed: Fixed an issue on macOS where dragging images from
Firefox into third-party apps like Preview could fail or
behave unexpectedly. (bmo#1995345)
* Fixed: Fixed performance and video playback issues on macOS
26 (Tahoe) that occurred when the system was under heavy
load. (bmo#1995638)
* Fixed: Fixed a browser hang on macOS 26 (Tahoe) that could
occur when bookmark folders contained loops or repeated
references to themselves. (bmo#1995621)
* Fixed: Security fix.
MFSA 2025-86 (bsc#1252815)
* CVE-2025-12380 (bmo#1993113)
Use-after-free in WebGPU internals triggered from a
compromised child process
- Removed upstreamed mozilla-bmo1990430.patch
* Sun Oct 19 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- fix miscompilation with gcc and using it for build
(mozilla-bmo1990430.patch)
* Sun Oct 12 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 144.0
please check https://www.firefox.com/en-US/firefox/144.0/releasenotes
for all news
MFSA 2025-81 (bsc#1251263)
* CVE-2025-11708 (bmo#1988931)
Use-after-free in MediaTrackGraphImpl::GetInstance()
* CVE-2025-11709 (bmo#1989127)
Out of bounds read/write in a privileged process triggered by
WebGL textures
* CVE-2025-11710 (bmo#1989899)
Cross-process information leaked due to malicious IPC messages
* CVE-2025-11711 (bmo#1989978)
Some non-writable Object properties could be modified
* CVE-2025-11716 (bmo#1818679)
Sandboxed iframes allowed links to open in external apps
(Android only)
* CVE-2025-11717 (bmo#1872601)
The password edit screen was not hidden in Android card view
* CVE-2025-11712 (bmo#1979536)
An OBJECT tag type attribute overrode browser behavior on web
resources without a content-type
* CVE-2025-11718 (bmo#1980808)
Address bar could be spoofed on Android using visibilitychange
* CVE-2025-11713 (bmo#1986142)
Potential user-assisted code execution in “Copy as cURL” command
* CVE-2025-11719 (bmo#1991950)
Use-after-free caused by the native messaging web extension
API on Windows
* CVE-2025-11720 (bmo#1979534, bmo#1984370)
Spoofing risk in Android custom tabs
* CVE-2025-11714 (bmo#1973699, bmo#1989945, bmo#1990970,
bmo#1991040, bmo#1992113)
Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
* CVE-2025-11715 (bmo#1983838, bmo#1987624, bmo#1988244,
bmo#1988912, bmo#1989734, bmo#1990085, bmo#1991899)
Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
ESR 140.4, Firefox 144 and Thunderbird 144
* CVE-2025-11721 (bmo#1986816)
Memory safety bug fixed in Firefox 144 and Thunderbird 144
- requires
NSS >= 3.116
rust = 1.88
(upstream uses 1.89 already which is not available everywhere)
- switched to clang build temporarily because of bmo#1990430
and use clang 20 max (21 fails to build)
- stop building for i586 as it failing to build and Mozilla
officially discontinues any 32bit support for Linux with 145
https://blog.mozilla.org/futurereleases/2025/09/05/firefox-32-bit-linux-support-to-end-in-2026/
* Tue Sep 30 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 143.0.3
https://www.firefox.com/en-US/firefox/143.0.3/releasenotes
MFSA 2025-80 (bsc#1250678
* CVE-2025-11152 (bmo#1987246)
Sandbox escape due to integer overflow in the Graphics: Canvas2D component
* CVE-2025-11153 (bmo#1987481)
JIT miscompilation in the JavaScript Engine: JIT component
* Sat Sep 20 2025 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 143.0.1:
https://www.firefox.com/en-US/firefox/143.0.1/releasenotes
* Fixed a tab crash experienced by some users caused by DLL
injection (bmo#1872261)
* Sun Sep 14 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 143.0
https://www.firefox.com/en-US/firefox/143.0/releasenotes
MFSA 2025-73 (bsc#1249391)
* CVE-2025-10527 (bmo#1984825)
Sandbox escape due to use-after-free in the Graphics: Canvas2D component
* CVE-2025-10528 (bmo#1986185)
Sandbox escape due to undefined behavior, invalid pointer in
the Graphics: Canvas2D component
* CVE-2025-10529 (bmo#1970490)
Same-origin policy bypass in the Layout component
* CVE-2025-10530 (bmo#1974025)
Spoofing issue in the WebAuthn component in Firefox for Android
* CVE-2025-10531 (bmo#1978453)
Mitigation bypass in the Web Compatibility: Tooling component
* CVE-2025-10532 (bmo#1979502)
Incorrect boundary conditions in the JavaScript: GC component
* CVE-2025-10533 (bmo#1980788)
Integer overflow in the SVG component
* CVE-2025-10534 (bmo#1665334)
Spoofing issue in the Site Permissions component
* CVE-2025-10535 (bmo#1979918)
Information disclosure, mitigation bypass in the Privacy
component in Firefox for Android
* CVE-2025-10536 (bmo#1981502)
Information disclosure in the Networking: Cache component
* CVE-2025-10537 (bmo#1938220, bmo#1980730, bmo#1981280,
bmo#1981283, bmo#1984505, bmo#1985067)
Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
ESR 140.3, Firefox 143 and Thunderbird 143
- requires
NSPR 4.37
NSS 3.115.1
- remove obsolete mozilla-nongnome-proxies.patch
* Fri Sep 05 2025 Manfred Hollstein <manfred.h@gmx.net>
- Update MozillaFirefox.desktop from a fresh Factory/Tumbleweed
build.
* Sat Aug 30 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 142.0.1
* Dragging multiple non-adjacent tabs in horizontal tab strip mode
now correctly moves them together as a group. (bmo#1982933)
* Dragging multiple tabs no longer causes toolbar unresponsiveness
or visual glitches. (bmo#1984342)
* Fixed an issue where the text cursor appeared in the wrong
location. (bmo#1984045)
* Fixed a crash related to gamepad use, particularly on macOS
(bmno#1870379)
* Fixed an issue where the expand on hover feature in the sidebar
would sometimes stop working. (bmo#1982129)
* Fixed a crash in KDE Plasma when using certain custom window
decorations. (bmo#1984823)
* Thu Aug 21 2025 Manfred Hollstein <manfred.h@gmx.net>
- Mozilla Firefox 142
https://www.mozilla.org/en-US/firefox/142.0/releasenotes/
MFSA 2025-64 (bsc#1248162)
* CVE-2025-9179 (bmo#1979527)
Sandbox escape due to invalid pointer in the Audio/Video: GMP
component
* CVE-2025-9180 (bmo#1979782)
Same-origin policy bypass in the Graphics: Canvas2D component
* CVE-2025-9181 (bmo#1977130)
Uninitialized memory in the JavaScript Engine component
* CVE-2025-9186 (bmo#1445758)
Spoofing issue in the Address Bar component of Firefox Focus
for Android
* CVE-2025-9182 (bmo#1975837)
Denial-of-service due to out-of-memory in the Graphics:
WebRender component
* CVE-2025-9183 (bmo#1976102)
Spoofing issue in the Address Bar component
* CVE-2025-9187 (bmo#1825621, bmo#1970079, bmo#1976736,
bmo#1979072)
Memory safety bugs fixed in Firefox 142 and Thunderbird 142
* CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
bmo#1979955)
Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
ESR 140.2, Firefox 142 and Thunderbird 142
* CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Refresh mozilla-pgo.patch
- requires NSS 3.114
* Tue Aug 05 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 141.0.2
* Fixed a startup crash experienced by some Linux users with outdated
NVIDIA drivers. (bmo#1978911)
* Fixed a regression that caused canvas objects to be draggable,
causing web compatibility issues. (bmo#1978673)
* Fixed a crash in the Web Developer Tools panel that could occur
when inspecting pages with <iframe> elements. (bmo#1975277)
* Fixed minor visual issues across the user interface.
(bmo#1974269, bmo#1976031, bmo#1974876, bmo#1976701)
* Firefox wouldn't start on some systems where GTK+ was built
without Wayland support. (bmo#1978620)
* Fixed an issue where clicking a pinned tab could steal focus from
the content area, disrupting keyboard navigation. (bmo#1977005)
* Sun Jul 27 2025 Andreas Schwab <schwab@suse.de>
- Update memory constraints
* Sun Jul 20 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 141.0
* https://www.mozilla.org/en-US/firefox/141.0/releasenotes/
MFSA 2025-56 (bsc#1246664)
* CVE-2025-8027 (bmo#1968423)
JavaScript engine only wrote partial return value to stack
* CVE-2025-8028 (bmo#1971581)
Large branch table could lead to truncated instruction
* CVE-2025-8041 (bmo#1670725)
Incorrect URL truncation in Firefox for Android
* CVE-2025-8042 (bmo#1791322)
Sandboxed iframe could start downloads
* CVE-2025-8029 (bmo#1928021)
javascript: URLs executed on object and embed tags
* CVE-2025-8036 (bmo#1960834)
DNS rebinding circumvents CORS
* CVE-2025-8037 (bmo#1964767)
Nameless cookies shadow secure cookies
* CVE-2025-8030 (bmo#1968414)
Potential user-assisted code execution in “Copy as cURL” command
* CVE-2025-8043 (bmo#1970209)
Incorrect URL truncation
* CVE-2025-8031 (bmo#1971719)
Incorrect URL stripping in CSP reports
* CVE-2025-8032 (bmo#1974407)
XSLT documents could bypass CSP
* CVE-2025-8038 (bmo#1808979)
CSP frame-src was not correctly enforced for paths
* CVE-2025-8039 (bmo#1970997)
Search terms persisted in URL bar
* CVE-2025-8033 (bmo#1973990)
Incorrect JavaScript state machine for generators
* CVE-2025-8044 (bmo#1933572, bmo#1971116)
Memory safety bugs fixed in Firefox 141 and Thunderbird 141
* CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
* CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
ESR 140.1, Firefox 141 and Thunderbird 141
* CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
141 and Thunderbird 141
- requires NSS 3.113
* Sun Jun 29 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 140.0.2
* Fixed a startup crash on Windows experienced by some users
(bmo#1974259)
- Mozilla Firefox 140.0.1
* Fixed text contrast issues in the sidebar with some dark themes
(bmo#1971487)
* Fixed a startup crash experienced by some users caused by DLL
injection (mbo#1973947)
* Tue Jun 24 2025 Manfred Hollstein <manfred.h@gmx.net>
- Firefox 140.0 Release
* New: Vertical Tabs: You can now keep more — or fewer — pinned
tabs in view for quicker access to important windows. Just
drag the divider to resize your pinned tabs section.
* New: Custom Search Engines: Firefox now supports adding even
more search engines. To add a custom engine, right-click a
search field of a supported website and select “Add Search
Engine”, or go to Settings > Search > Add (below the search
shortcuts table) to manually enter a search URL.
* New: Firefox Extensions: Customize your toolbar with the
option to remove the extensions shortcut, giving you more
control over your browser. When the button is hidden, you can
access the extensions panel again at any time from the
Firefox menu by clicking the Extensions menu item.
* New: You can now unload tabs by right-clicking on a tab (or
multiple selected tabs) and selecting "Unload Tab". This can
speed up performance by reducing Firefox's memory and CPU
usage.
* New: Full-Page Translations now prioritizes translating only
the content near your current view, improving speed and
responsiveness. Content outside your view is skipped unless
you scroll to it, reducing unnecessary resource usage.
* New: Firefox builds in Arabic now come with a built-in Arabic
dictionary for the Firefox spellchecker.
* New: Address autofill enabled for users in Italy, Poland, and
Austria.
* Changed: The Pocket toolbar icon, as well as the Pocket
integrations on New Tab, have been removed per the service
shutdown announcement.
* HTML5: Added platform support for aria-keyshortcuts in Linux,
macOS, and Windows.
* HTML5: Added support for the CookieStore API, an asynchronous
cookie API for scripts running in HTML documents and service
workers.
* HTML5: Added support for the Custom Highlight API, which
allows styling arbitrary text ranges. Support for text-
decoration is not included and is planned for an upcoming
release.
* HTML5: Added support for the pointerrawupdate event. This
event provides lower-latency access to pointer movements by
firing as soon as the pointer data is available, typically
before the main `pointermove` event. Unlike `pointermove`, it
performs an additional hit test to determine the target and
fires more frequently, which may impact performance even if
only a listener is added. This event is intended for
applications that require high-precision input handling and
cannot achieve smooth interaction using coalesced
`pointermove` events alone.
* HTML5: Service Workers are now available in Private Browsing
Mode. This enhancement builds on our efforts to support
IndexedDB and the DOM Cache API in Private Browsing through
encrypted storage. With this change, more websites,
especially those that rely on background tasks, will be able
to benefit from Service workers.
* HTML5: Firefox now applies a uniform user agent (UA) style to
`<h1>` elements, regardless of whether they are used inside
`<article>`, `<aside>`, `<nav>`, or `<section>`.
* HTML5: Firefox will now escape less-than (`<`) and greater-
than (`>`) symbols when serializing HTML attributes, making
certain mXSS attacks on websites more difficult.
* Developer: Improved the search feature in the Inspector panel
to help developers more effectively search the DOM of the
current page. Sorting the results by the number of matching
elements, support “pseudo” selector state, etc.
* Enterprise: You can find information about policy updates and
enterprise specific bug fixes in the Firefox for Enterprise
140 Release Notes.
* Fixed: Various security fixes.
- Mozilla Firefox 140.0
https://www.mozilla.org/en-US/firefox/140.0/releasenotes/
MFSA 2025-51 (bsc#1244670)
* CVE-2025-6424 (bmo#1966423)
Use-after-free in FontFaceSet
* CVE-2025-6425 (bmo#1717672)
The WebCompat WebExtension shipped with Firefox exposed a
persistent UUID
* CVE-2025-6426 (bmo#1964385)
No warning when opening executable terminal files on macOS
* CVE-2025-6427 (bmo#1966927)
connect-src Content Security Policy restriction could be
bypassed
* CVE-2025-6428 (bmo#1970151)
Firefox for Android opened URLs specified in a link
querystring parameter
* CVE-2025-6429 (bmo#1970658)
Incorrect parsing of URLs could have allowed embedding of
youtube.com
* CVE-2025-6430 (bmo#1971140)
Content-Disposition header ignored when a file is included in
an embed or object tag
* CVE-2025-6431 (bmo#1942716)
The prompt in Firefox for Android that asks before opening a
link in an external application could be bypassed
* CVE-2025-6432 (bmo#1943804)
DNS Requests leaked outside of a configured SOCKS proxy
* CVE-2025-6433 (bmo#1954033)
WebAuthn would allow a user to sign a challenge on a webpage
with an invalid TLS certificate
* CVE-2025-6434 (bmo#1955182)
HTTPS-Only exception screen lacked anti-clickjacking delay
* CVE-2025-6435 (bmo#1950056, bmo#1961777)
Save as in Devtools could download files without sanitizing
the extension
* CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
bmo#1966505, bmo#1970764)
Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- requires
NSS >= 3.112
cargo/rust 1.86
* Wed Jun 11 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- Firefox 139.0.4 Release
* Fixed: Fixed Firefox freezing when switching between apps or
opening certain panels within the browser. (Bug 1969253 & Bug
1969346)
* Fixed: Fixed difficult selection of drop-down menu options in
the Firefox preferences page when selected via the in-page
search. (bmo#1968949)
* Fixed: Fixed various selection issues when triple-clicking
text in some situations. (Bug 1969100 & Bug 1969432)
* Fixed: Fixed an incorrect filename being used when setting an
image as the desktop wallpaper on Windows. (bmo#1969793)
* Fixed: Various security fixes.
- Mozilla Firefox 139.0.4
https://www.mozilla.org/en-US/firefox/139.0.4/releasenotes/
MFSA 2025-47 (bsc#1244468)
* CVE-2025-49709 (bmo#1966083)
Memory corruption in canvas surfaces
* CVE-2025-49710 (bmo#1970095)
Integer overflow in OrderedHashTable
* Tue Jun 03 2025 Guillaume GARDET <guillaume.gardet@opensuse.org>
- Fix %{progdir}/crashhelper packaging
* Sat May 31 2025 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 139.0.1
https://www.mozilla.org/en-US/firefox/139.0.1/releasenotes/
* Fixed graphics corruption with certain NVIDIA graphics adapters
and multiple monitors running at mixed refresh rates after
updating to Firefox 139. (bmo#1968876)
* Mon May 26 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 139.0
https://www.mozilla.org/en-US/firefox/139.0/releasenotes/
MFSA 2025-42 (bsc#1243353)
* MFSA-TMP-2025-0001 (bmo#1962421)
Double-free in libvpx encoder
* CVE-2025-5263 (bmo#1960745)
Error handling for script execution was incorrectly isolated
from web content
* CVE-2025-5264 (bmo#1950001)
Potential local code execution in “Copy as cURL” command
* CVE-2025-5265 (bmo#1962301)
Potential local code execution in “Copy as cURL” command
* CVE-2025-5266 (bmo#1965628)
Script element events leaked cross-origin resource status
* CVE-2025-5270 (bmo#1910298)
SNI was sometimes unencrypted
* CVE-2025-5271 (bmo#1920348)
Devtools' preview ignored CSP headers
* CVE-2025-5267 (bmo#1954137)
Clickjacking vulnerability could have led to leaking saved
payment card details
* CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499, bmo#1962634)
Memory safety bugs fixed in Firefox 139, Thunderbird 139,
Firefox ESR 128.11, and Thunderbird 128.11
* CVE-2025-5272 (bmo#1726254, bmo#1742738, bmo#1960121)
Memory safety bugs fixed in Firefox 139 and Thunderbird 139
* Sun May 18 2025 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 138.0.4
MFSA 2025-36 (bsc#1243303)
* CVE-2025-4918 (bmo#1966612)
Out-of-bounds access when resolving Promise objects
* CVE-2025-4919 (bmo#1966614)
Out-of-bounds access when optimizing linear sums
* Fixed: Fixed a crash that could occur when viewing websites
that use WebGL. (bmo#1961191)
* Fixed: Fixed an issue where the browser could repeatedly
crash when certain SVG effects (like blur or drop shadow)
were applied to very small areas. (bmo#1924241)
(bmo#1924241)
* Fixed: On Linux, fixed an issue where video playback would
appear washed-out on Wayland when HDR support was
unavailable. (bmo#1961610)
* Fixed: Fixed an issue where the "Match Case" shortcut `Alt+C`
in the find-in-page toolbar did not toggle the checkbox as
expected. (bmo#1952611)
* Fri May 16 2025 Bernhard Wiedemann <bwiedemann@suse.com>
- Replace usage of %jobs for reproducible builds (boo#1237231)
* Mon May 12 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 138.0.1
* Fixed an issue which caused a blank page to be shown for Home
and New Tab pages for some users. (bmo#1963537)
* Added a workaround for a bug in outlook.office.com/outlook.live.com
where attachment filenames are incorrectly prefixed with UTF-8
when saved. (bmo#1961710)
* Sat May 10 2025 Christian Boltz <suse-beta@cboltz.de>
- build on s390x needs 15G memory, adjust _constraints
* Tue Apr 29 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 138.0
https://www.mozilla.org/en-US/firefox/138.0/releasenotes/
MFSA 2025-28 (bsc#1241621)
* CVE-2025-2817 (bmo#1917536)
Privilege escalation in Firefox Updater
* CVE-2025-4082 (bmo#1937097)
WebGL shader attribute memory corruption in Firefox for macOS
* CVE-2025-4083 (bmo#1958350)
Process isolation bypass using "javascript:" URI links in
cross-origin frames
* CVE-2025-4085 (bmo#1915280)
Potential information leakage and privilege escalation in
UITour actor
* CVE-2025-4086 (bmo#1945705)
Specially crafted filename could be used to obscure download
type
* CVE-2025-4087 (bmo#1952465)
Unsafe attribute access during XPath parsing
* CVE-2025-4088 (bmo#1953521)
Cross-site request forgery via storage access API redirects
* CVE-2025-4089 (bmo#1949994, bmo#1956698, bmo#1960198)
Potential local code execution in "copy as cURL" command
* CVE-2025-4090 (bmo#1929478)
Leaked library paths in Firefox for Android
* CVE-2025-4091 (bmo#1951161, bmo#1952105)
Memory safety bugs fixed in Firefox 138, Thunderbird 138,
Firefox ESR 128.10, and Thunderbird 128.10
* CVE-2025-4092 (bmo#1924108, bmo#1950780, bmo#1959367)
Memory safety bugs fixed in Firefox 138 and Thunderbird 138
- requires NSS 3.110
- rebased patches
* Tue Apr 15 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 137.0.2
* Fixed file picker not being displayed when exporting passwords
on macOS in about:logins for some users. (bmo#1956266)
* Fixed accessibility issues with the new PDF signature feature.
(bmo#1956110, bmo#1952571)
* Fixed an issue where using the context menu to paste in the
Style Editor would insert the code twice. (bmo#1955854)
* Fixed functional regressions in our XSLT support introduced
in 137. (bmo#1954841)
* Fixed a tooltip flickering issue on Windows that affected some
users when hovering. (bmo#1958631)
* Fixed an issue where Firefox would not respond to clicks in some
HTML5 video players. (bmo#1959251)
* Fixed an issue where radio inputs behaved incorrectly when
preventDefault() was called on the click event. (bmo#1957956)
* Fixed an issue that caused some Firefox users to restart their
browser multiple times to complete an update. (bmo#1959492)
MFSA 2025-25
* CVE-2025-3608 (bmo#1951554)
Race condition in nsHttpTransaction could lead to memory corruption
- Mozilla Firefox 137.0.1
* Fixed an issue where folder shortcuts on Windows were incorrectly
treated as files during file uploads, preventing selecting files
within the target folder. (bmo#1958222)
* Fixed a crash experienced by Windows users when downloading files
with Qihoo 360 Total Security Antivirus software installed. (bmo#1958112)
* Fixed an occasional startup crash. (bmo#1958293)
* Sun Apr 06 2025 Stanislav Brabec <sbrabec@suse.com>
- Migrate from deprecated %suse_update_desktop_file to
%translate_suse_desktop. (boo#1158957)
- MozillaFirefox.desktop fixes done during the migration to
translate-suse-desktop:
* Remove English text from Burmese translation.
* Import translations from mis-named languages from
MozillaFirefox.desktop and move them to correct language codes.
* Remove en_GB translation that contains no real contents.
* Wed Apr 02 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 137.0
* https://www.mozilla.org/en-US/firefox/137.0/releasenotes/
MFSA 2025-20 (bsc#1240083)
* CVE-2025-3028 (bmo#1941002)
Use-after-free triggered by XSLTProcessor
* CVE-2025-3031 (bmo#1947141)
JIT optimization bug with different stack slot sizes
* CVE-2025-3032 (bmo#1949987)
Leaking file descriptors from the fork server
* CVE-2025-3029 (bmo#1952213)
URL bar spoofing via non-BMP Unicode characters
* CVE-2025-3035 (bmo#1952268)
Tab title disclosure across pages when using AI chatbot
* CVE-2025-3033 (bmo#1950056)
Opening local .url files could lead to another file being opened
* CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
bmo#1951017, bmo#1951494)
Memory safety bugs fixed in Firefox 137, Thunderbird 137,
Firefox ESR 128.9, and Thunderbird 128.9
* CVE-2025-3034 (bmo#1894100, bmo#1934086, bmo#1950360)
Memory safety bugs fixed in Firefox 137 and Thunderbird 137
- requires NSS 3.109
* Fri Mar 28 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 136.0.4
MFSA 2025-19 (bsc#1240084)
* CVE-2025-2857, CVE-2025-2783 (bmo#1956398)
Incorrect handle could lead to sandbox escapes
136.0.3
* Significantly improved responsiveness on TikTok by improving the
speed of date formatting. (bmo#1954323)
136.0.2
* Fixed a bug where "Cookies and site data" and "Temporary cached
files and pages" were unexpectedly enabled after updating to
Firefox 136 for users with "History" and/or "Site settings" set
to clear on shutdown in previous versions. (bmo#1952564)
* Fixed an issue where the Primary Password prompt appeared in
unexpected situations. (bmo#1946121)
* Fixed visibility issues with radio buttons on dark backgrounds
(bmo#1951930)
* Fixed high CPU usage on Windows when the screen was locked or the
laptop lid was closed. (bmo#1924932)
- Use default clang version. (by Aaron Puchert)
* Sat Mar 15 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 136.0.1
* Fixed an issue where a cookie size limit caused problems with
website cookie management when using the CookieStore API.
This could cause login and other state-related issues. (bmo#1950565)
* Fixed an issue where Control/Command+L did not focus the
address bar in new windows. (bmo#1947723)
* Thu Mar 06 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 136.0
https://www.mozilla.org/en-US/firefox/136.0/releasenotes/
MFSA 2025-14 (bsc#1237683)
* CVE-2025-1930 (bmo#1902309)
AudioIPC StreamData could trigger a use-after-free in the
Browser process
* CVE-2025-1939 (bmo#1928334)
Tapjacking in Android Custom Tabs using transition animations
* CVE-2025-1931 (bmo#1944126)
Use-after-free in WebTransportChild
* CVE-2025-1932 (bmo#1944313)
Inconsistent comparator in XSLT sorting led to out-of-bounds access
* CVE-2025-1933 (bmo#1946004)
JIT corruption of WASM i32 return values on 64-bit CPUs
* CVE-2025-1940 (bmo#1908488)
Android Intent confirmation prompt tapjacking using Select options
* CVE-2024-9956 (bmo#1922357)
Passkey phishing within Bluetooth range
* CVE-2025-1934 (bmo#1942881)
Unexpected GC during RegExp bailout processing
* CVE-2025-1941 (bmo#1944665)
Lock screen setting bypass in Firefox Focus for Android
* CVE-2025-1942 (bmo#1947139)
Disclosure of uninitialized memory when .toUpperCase() causes
string to get longer
* CVE-2025-1935 (bmo#1866661)
Clickjacking the registerProtocolHandler info-bar
* CVE-2025-1936 (bmo#1940027)
Adding %00 and a fake extension to a jar: URL changed the
interpretation of the contents
* CVE-2025-1937 (bmo#1938471, bmo#1940716)
Memory safety bugs fixed in Firefox 136, Thunderbird 136,
Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
* CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
bmo#1943912, bmo#1948111)
Memory safety bugs fixed in Firefox 136, Thunderbird 136,
Firefox ESR 128.8, and Thunderbird 128.8
* CVE-2025-1943 (bmo#1869650, bmo#1938451, bmo#1940326,
bmo#1944052, bmo#1944063, bmo#1947281)
Memory safety bugs fixed in Firefox 136 and Thunderbird 136
- requires
* NSS 3.108
* rust 1.84
* Mon Feb 03 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 135.0
https://www.mozilla.org/en-US/firefox/135.0/releasenotes
MFSA 2025-07 (bsc#1236539)
* CVE-2025-1009 (bmo#1936613)
Use-after-free in XSLT
* CVE-2025-1010 (bmo#1936982)
Use-after-free in Custom Highlight
* CVE-2025-1018 (bmo#1910818)
Fullscreen notification is not displayed when fullscreen is
re-requested
* CVE-2025-1011 (bmo#1936454)
A bug in WebAssembly code generation could result in a crash
* CVE-2025-1012 (bmo#1939710)
Use-after-free during concurrent delazification
* CVE-2025-1019 (bmo#1940162)
Fullscreen notification not properly displayed
* CVE-2025-1013 (bmo#1932555)
Potential opening of private browsing tabs in normal browsing windows
* CVE-2025-1014 (bmo#1940804)
Certificate length was not properly checked
* CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694, bmo#1938469,
bmo#1939583, bmo#1940994)
Memory safety bugs fixed in Firefox 135, Thunderbird 135,
Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
and Thunderbird 128.7
* CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
Memory safety bugs fixed in Firefox 135, Thunderbird 135,
Firefox ESR 128.7, and Thunderbird 128.7
* CVE-2025-1020 (bmo#1939063, bmo#1942169)
Memory safety bugs fixed in Firefox 135 and Thunderbird 135
- requires rust 1.83
* Thu Jan 23 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 134.0.2
* Fixed a regression in Firefox 134 where anchored links in HTML
framesets pointing to local files did not work (bmo#1934807)
* Fixed an issue in developer tools preventing the resending of
network requests when debugging extensions (bmo#1934478)
* Fixed an issue where data consumption from service workers may
unexpectedly halt (bmo#1941210)
* Fri Jan 17 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 134.0.1
* Fixed UI hangs happening on YouTube and Google Docs in some situations
(bmo#1939295)
* Fixed a startup crash affecting some users upgrading from Firefox 133
(bmo#1941134)
* Fixed an issue where search engines selection menus and context
menus could be broken if a user had previously reverted to an
earlier version (bmo#1940533)
- raised required rust version to 1.81
* Wed Jan 08 2025 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 134.0
https://www.mozilla.org/en-US/firefox/134.0/releasenotes
* Firefox now supports touchpad hold gestures on Linux. This means
that kinetic (momentum) scrolling can now be interrupted by placing
two fingers on the touchpad
* Ecosia's availability has been expanded to all languages in the
German region along with Austria, Belgium, Italy, Netherlands, Spain,
Sweden and Switzerland
MFSA 2025-01 (bsc#1234991)
* CVE-2025-0244 (bmo#1929584)
Address bar spoofing using an invalid protocol scheme on
Firefox for Android
* CVE-2025-0245 (bmo#1895342)
Lock screen setting bypass in Firefox Focus for Android
* CVE-2025-0246 (bmo#1912709)
Address bar spoofing using an invalid protocol scheme on
Firefox for Android
* CVE-2025-0237 (bmo#1915257)
WebChannel APIs susceptible to confused deputy attack
* CVE-2025-0238 (bmo#1915535)
Use-after-free when breaking lines in text
* CVE-2025-0239 (bmo#1929156)
Alt-Svc ALPN validation failure when redirected
* CVE-2025-0240 (bmo#1929623)
Compartment mismatch when parsing JavaScript JSON module
* CVE-2025-0241 (bmo#1933023)
Memory corruption when using JavaScript Text Segmentation
* CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873, bmo#1932169)
Memory safety bugs fixed in Firefox 134, Thunderbird 134,
Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
and Thunderbird 128.6
* CVE-2025-0243 (bmo#1827142, bmo#1932783)
Memory safety bugs fixed in Firefox 134, Thunderbird 134,
Firefox ESR 128.6, and Thunderbird 128.6
* CVE-2025-0247 (bmo#1835193, bmo#1910021, bmo#1919803,
bmo#1931576, bmo#1931948, bmo#1932173)
Memory safety bugs fixed in Firefox 134 and Thunderbird 134
- requires
NSS 3.107
NSPR 4.36 (since FF 133 already)
- rebased patches
* Sat Dec 14 2024 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 133.0.3
* Fixed the missing scrollbar in the Library window, such as when
viewing History or Bookmarks. (bmo#1934482)
* Fixed blurry line drawing on some Canvas elements when hardware
acceleration is enabled. (bmo#1933668)
* Mon Nov 25 2024 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 133.0
https://www.mozilla.org/en-US/firefox/133.0/releasenotes
MFSA 2024-63 (bsc#1233695)
* CVE-2024-11691 (bmo#1914707, bmo#1924184)
Memory corruption in Apple GPU drivers
* CVE-2024-11700 (bmo#1836921)
Potential Tapjacking Exploit for Intent Confirmation on Android
* CVE-2024-11692 (bmo#1909535)
Select list elements could be shown over another site
* CVE-2024-11701 (bmo#1914797)
Misleading Address Bar State During Navigation Interruption
* CVE-2024-11702 (bmo#1918884)
Inadequate Clipboard Protection in Private Browsing Mode on
Android
* CVE-2024-11693 (bmo#1921458)
Download Protections were bypassed by .library-ms files on
Windows
* CVE-2024-11694 (bmo#1924167)
CSP Bypass and XSS Exposure via Web Compatibility Shims
* CVE-2024-11695 (bmo#1925496)
URL Bar Spoofing via Manipulated Punycode and Whitespace Characters
* CVE-2024-11703 (bmo#1928779)
Password access without authentication via PIN bypass on Android
* CVE-2024-11696 (bmo#1929600)
Unhandled Exception in Add-on Signature Verification
* CVE-2024-11697 (bmo#1842187)
Improper Keypress Handling in Executable File Confirmation Dialog
* CVE-2024-11704 (bmo#1899402)
Potential Double-Free Vulnerability in PKCS#7 Decryption Handling
* CVE-2024-11698 (bmo#1916152)
Fullscreen Lock-Up When Modal Dialog Interrupts Transition on macOS
* CVE-2024-11705 (bmo#1921768)
Null Pointer Dereference in NSC_DeriveKey
* CVE-2024-11706 (bmo#1923767)
Null Pointer Dereference in PKCS#12 Utility
* CVE-2024-11708 (bmo#1922912)
Data race with PlaybackParams
* CVE-2024-11699 (bmo#1880582, bmo#1929911)
Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
and Thunderbird 128.5
- requires NSS 3.106
- remove obsolete mozilla-python313.patch
* Sat Nov 23 2024 Dirk Müller <dmueller@suse.com>
- add mozilla-python313.patch to fix build with python 3.13+
* Fri Nov 15 2024 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 132.0.2
* Fixed possible errors when playing encrypted media content
through some streaming providers. (bmo#1929491)
* Added a mitigation to help reduce the frequency of duplicated
push notifications reported by some users. (bmo#1928868)
* Fixed hangs when printing from some sites when using the system
print dialog. (bmo#1898184)
* Fixed a crash which could occur when using Microsoft SSO on macOS
(bmo#1929622)
* Fixed a crash in the Network Monitor developer tool which could
occur in some circumstances. (bmo#1924882)
* Sun Nov 10 2024 Wolfgang Rosenauer <wr@rosenauer.org>
- require xdg-desktop-portal (boo#1233166)
* Tue Nov 05 2024 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 132.0.1
* Fixed issues causing intermittent video playback problems on
some sites. (bmo#1928484, bmo#1928798)
- remove KDE integration patches
- mozilla-kde.patch
- firefox-kde.patch
on KDE use these settings instead
widget.use-xdg-desktop-portal.file-picker=1
widget.use-xdg-desktop-portal.mime-handler=1
(those are set by the latest branding package as well)
* Mon Oct 28 2024 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 132.0
https://www.mozilla.org/en-US/firefox/132.0/releasenotes
MFSA 2024-55 (bsc#1231879)
* CVE-2024-10458 (bmo#1921733)
Permission leak via embed or object elements
* CVE-2024-10459 (bmo#1919087)
Use-after-free in layout with accessibility
* CVE-2024-10460 (bmo#1912537)
Confusing display of origin for external protocol handler prompt
* CVE-2024-10461 (bmo#1914521)
XSS due to Content-Disposition being ignored in
multipart/x-mixed-replace response
* CVE-2024-10462 (bmo#1920423)
Origin of permission prompt could be spoofed by long URL
* CVE-2024-10463 (bmo#1920800)
Cross origin video frame leak
* CVE-2024-10468 (bmo#1914982)
Race conditions in IndexedDB
* CVE-2024-10464 (bmo#1913000)
History interface could have been used to cause a Denial of
Service condition in the browser
* CVE-2024-10465 (bmo#1918853)
Clipboard "paste" button persisted across tabs
* CVE-2024-10466 (bmo#1924154)
DOM push subscription message could hang Firefox
* CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394, bmo#1904059,
bmo#1917742, bmo#1919809, bmo#1923706)
Memory safety bugs fixed in Firefox 132, Thunderbird 132,
Firefox ESR 128.4, and Thunderbird 128.4
- requires NSS 3.105
- rebased patches
* Thu Oct 17 2024 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 131.0.3
* some users could not access the Bill Pay portion of their
bank's site (bmo#1923500)
* some VR180 and 360 videos were not properly rendering on YouTube
(bmo#1922278)
* Fixed a crash that Windows users with Avast or AVG security
software were experiencing when visiting certain sites. (bmo#1919678)
* "List all tabs" button was not able to be moved from the toolbar
(bmo#1918681)
NFSA 2024-53
* CVE-2024-9936 (bmo#1920381)
Undefined behavior in selection node cache
- remove obsolete mozilla-rust-disable-future-incompat.patch
* Wed Oct 09 2024 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 131.0.2
MFSA 2024-51 (bsc#1231413)
* CVE-2024-9680 (bmo#1923344)
Use-after-free in Animation timeline
* Sun Sep 29 2024 Wolfgang Rosenauer <wr@rosenauer.org>
- Firefox 131.0
https://www.mozilla.org/en-US/firefox/131.0/releasenotes/
MFSA 2024-46 (bsc#1230979)
* CVE-2024-9391 (bmo#1892407)
Prevent users from exiting full-screen mode in Firefox Focus
for Android
* CVE-2024-9392 (bmo#1899154, bmo#1905843)
Compromised content process can bypass site isolation
* CVE-2024-9393 (bmo#1918301)
Cross-origin access to PDF contents through multipart responses
* CVE-2024-9394 (bmo#1918874)
Cross-origin access to JSON contents through multipart responses
* CVE-2024-9395 (bmo#1906024)
Specially crafted filename could be used to obscure download type
* CVE-2024-9396 (bmo#1912471)
Potential memory corruption may occur when cloning certain objects
* CVE-2024-9397 (bmo#1916659)
Potential directory upload bypass via clickjacking
* CVE-2024-9398 (bmo#1881037)
External protocol handlers could be enumerated via popups
* CVE-2024-9399 (bmo#1907726)
Specially crafted WebTransport requests could lead to denial
of service
* CVE-2024-9400 (bmo#1915249)
Potential memory corruption during JIT compilation
* CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317, bmo#1916476)
Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
* CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317, bmo#1913445,
bmo#1914106, bmo#1914475, bmo#1914963, bmo#1915008, bmo#1916476)
Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
Thunderbird 131, and Thunderbird 128.3
* CVE-2024-9403 (bmo#1917807)
Memory safety bugs fixed in Firefox 131 and Thunderbird 131
- requires NSS 3.104
- rebased patches
* Sat Sep 21 2024 Manfred Hollstein <manfred.h@gmx.net>
- Don't use clang18-devel on Leap as they don't have that version.
* Wed Sep 18 2024 Manfred Hollstein <manfred.h@gmx.net>
- Firefox 130.0.1 Release
https://www.mozilla.org/en-US/firefox/130.0.1/releasenotes
* Enterprise: Added an enterprise policy to disable the
* Firefox Labs* section in *Settings*. (bmo#1911826)
* Fixed a recent regression causing some UI elements to
be rendered as left-to-right instead of right-to-left for
users of our Saraiki localization. (bmo#1917175)
* Linux: Fixed black rendering of AVIF images when
Firefox is built with GCC. (bmo#1916038)
- removed obsolete patches
mozilla-bmo1916038.patch
* Sat Sep 07 2024 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 130.0
https://www.mozilla.org/en-US/firefox/130.0/releasenotes
MFSA 2024-39 (bsc#1229821)
* CVE-2024-8385 (bmo#1911909)
WASM type confusion involving ArrayTypes
* CVE-2024-8381 (bmo#1912715)
Type confusion when looking up a property name in a "with" block
* CVE-2024-8388 (bmo#1902996, bmo#1839074, bmo#1865413, bmo#1868970,
bmo#1873367, bmo#1877820, bmo#1884642, bmo#1886469, bmo#1894326,
bmo#1894891, bmo#1897648)
Fullscreen notice on Android could be hidden under various
panels and OS prompts
* CVE-2024-8382 (bmo#1906744)
Internal event interfaces were exposed to web content when
browser EventHandler listener callbacks ran
* CVE-2024-8383 (bmo#1908496)
Firefox did not ask before openings news: links in an
external application
* CVE-2024-8384 (bmo#1911288)
Garbage collection could mis-color cross-compartment objects
in OOM conditions
* CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
SelectElements could be shown over another site if popups are
allowed
* CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
and Thunderbird 128.2
* CVE-2024-8389 (bmo#1907230, bmo#1909367)
Memory safety bugs fixed in Firefox 130
- requires NSS 3.103
- removed obsolete patches
mozilla-bmo1898476.patch
mozilla-bmo1907511.patch
- added mozilla-bmo1916038.patch to fix AVIF decoding (bsc#1230500)
* Fri Sep 06 2024 Marvin Friedrich <contact@marvinf.com>
- Update dependency on clang-devel from LLVM15 to LLVM18
* Wed Sep 04 2024 pallas wept <pallaswept@proton.me>
- Added mozilla-bmo1746799.patch to fix incorrect audio volume scaling
* Sat Aug 24 2024 Christian Boltz <suse-beta@cboltz.de>
- _constraints: increase RAM on s390x to fix the build
* Fri Aug 16 2024 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 129.0.1
* Fixed playback issues on some websites with copyrighted video
served via digital rights management. (bmo#1911283)
* Fixed a crash when dragging a video file onto some websites
(bmo#1910990)
* Thu Aug 08 2024 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 129.0
https://www.mozilla.org/en-US/firefox/129.0/releasenotes
MFSA 2024-33 (bsc#1228648))
* CVE-2024-7518 (bmo#1875354)
Fullscreen notification dialog can be obscured by document content
* CVE-2024-7519 (bmo#1902307)
Out of bounds memory access in graphics shared memory handling
* CVE-2024-7520 (bmo#1903041)
Type confusion in WebAssembly
* CVE-2024-7521 (bmo#1904644)
Incomplete WebAssembly exception handing
* CVE-2024-7522 (bmo#1906727)
Out of bounds read in editor component
* CVE-2024-7523 (bmo#1908344)
Document content could partially obscure security prompts
* CVE-2024-7524 (bmo#1909241)
CSP strict-dynamic bypass using web-compatibility shims
* CVE-2024-7525 (bmo#1909298)
Missing permission check when creating a StreamFilter
* CVE-2024-7526 (bmo#1910306)
Uninitialized memory used by WebGL
* CVE-2024-7527 (bmo#1871303)
Use-after-free in JavaScript garbage collection
* CVE-2024-7528 (bmo#1895951)
Use-after-free in IndexedDB
* CVE-2024-7529 (bmo#1903187)
Document content could partially obscure security prompts
* CVE-2024-7530 (bmo#1904011)
Use-after-free in JavaScript code coverage collection
* CVE-2024-7531 (bmo#1905691)
PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
Sandy Bridge machines
- removed obsolete patches
mozilla-bmo1905018.patch
mozilla-bmo1504834-part3.patch
mozilla-bmo1512162.patch
mozilla-bmo1822730.patch
mozilla-fix-aarch64-libopus.patch
mozilla-partial-revert-1768632.patch
- requires NSS 3.102.1
- extended mozilla-silence-no-return-type.patch
* Sun Jul 28 2024 Manfred Hollstein <manfred.h@gmx.net>
- Firefox 128.0.3 Release
* Fixed: Fixed an issue causing some sites to not load when
connecting via HTTP/2. (bmo#1908161, bmo#1909666)
* Fixed: Fixed collapsed table rows not appearing when expected
in some situations. (bmo#1907789)
* Fixed: Fixed the Windows on-screen keyboard potentially
concealing the webpage when displayed. (bmo#1907766)
- Firefox 128.0.2 Release
* Fixed: Fixed an audio echo in video calls on macOS under
certain conditions. (bmo#1908539)
* Fixed: Fixed an issue where the Adguard extension popup was
not displaying. (bmo#1906132)
* Fixed: Fixed an issue causing some screen readers to fail to
read when navigating by character in rich text editors. (Bug
1905021)
* Fixed: Fixed visual glitches when dark mode is enabled in
Windows ARM devices. (bmo#1897444)
* Fixed: Fixed an issue causing NTLM authentication failure.
(bmo#1908115)
* Fixed: Fixed an issue where content displayed on mouseover
was not captured in a screenshot. (bmo#1905468)
* Fixed: Various stability fixes.
- renamed firefox-3781e3117706.patch to mozilla-bmo1905018.patch
to conform with patch structure and naming for the package
* Thu Jul 18 2024 Martin Jambor <mjambor@suse.com>
- Add firefox-3781e3117706.patch to fix boo#1227856 aka bmo#1905018
where an incompatible pointer assignment is not accepted in C by
GCC 14.
* Mon Jul 08 2024 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 128.0
https://www.mozilla.org/en-US/firefox/128.0/releasenotes
MFSA 2024-29 (bsc#1226316)
* CVE-2024-6605 (bmo#1836786)
Firefox Android missed activation delay to prevent tapjacking
* CVE-2024-6606 (bmo#1902305)
Out-of-bounds read in clipboard component
* CVE-2024-6607 (bmo#1694513)
Leaving pointerlock by pressing the escape key could be
prevented
* CVE-2024-6608 (bmo#1743329)
Cursor could be moved out of the viewport using pointerlock.
* CVE-2024-6609 (bmo#1839258)
Memory corruption in NSS
* CVE-2024-6610 (bmo#1883396)
Form validation popups could block exiting full-screen mode
* CVE-2024-6600 (bmo#1888340)
Memory corruption in WebGL API
* CVE-2024-6601 (bmo#1890748)
Race condition in permission assignment
* CVE-2024-6602 (bmo#1895032)
Memory corruption in NSS
* CVE-2024-6603 (bmo#1895081)
Memory corruption in thread creation
* CVE-2024-6611 (bmo#1844827)
Incorrect handling of SameSite cookies
* CVE-2024-6612 (bmo#1880374)
CSP violation leakage when using devtools
* CVE-2024-6613 (bmo#1900523)
Incorrect listing of stack frames
* CVE-2024-6614 (bmo#1902983)
Incorrect listing of stack frames
* CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
and Thunderbird 115.13
* CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
Memory safety bugs fixed in Firefox 128
- requires
NSS 3.101.1
rust >= 1.78
- update create-tar.sh
- add wayland upstream fixes (bmo#1907511, bmo#1898476)
(mozilla-bmo1898476.patch and mozilla-bmo1907511.patch)
* Mon Jul 01 2024 Andrei Dziahel <develop7@develop7.info>
- Mozilla Firefox 127.0.2
* Fixed an issue where YouTube playback may experience stalling under
certain conditions (bmo#1900191, bmo#1878510).
* Fixed an issue where the Private Window icon was displayed in the taskbar
on Windows when browser.privateWindowSeparation.enabled was
set to false (bmo#1901840).
- Mozilla Firefox 127.0.1
* Fixed an issue where users with a primary password set on their profile
could lose their previous session of tabs upon upgrading if they dismissed
the primary password prompt (bmo#1901899).
* Fixed an issue where Linux users with accessibility.monoaudio.enable set
to true were experiencing slow audio speeds (bmo#1900972).
* Fixed an issue where, in some circumstances, the Firefox installer
on Windows failed to complete the installation (bmo#1896868).
* Fixed an issue causing Firefox to incorrectly reject cookies
for certain websites (bmo#1901325).
* Fri Jun 28 2024 Martin Sirringhaus <martin.sirringhaus@suse.com>
- Fix GNOME search provider (boo#1225278)
* Tue Jun 11 2024 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 127.0
https://www.mozilla.org/en-US/firefox/127.0/releasenotes
MFSA 2024-25 (bsc#1226027)
* CVE-2024-5687 (bmo#1889066)
An incorrect principal could have been used when opening new tabs
* CVE-2024-5688 (bmo#1895086)
Use-after-free in JavaScript object transplant
* CVE-2024-5689 (bmo#1389707)
User confusion and possible phishing vector via Firefox Screenshots
* CVE-2024-5690 (bmo#1883693)
External protocol handlers leaked by timing attack
* CVE-2024-5691 (bmo#1888695)
Sandboxed iframes were able to bypass sandbox restrictions to
open a new window
* CVE-2024-5692 (bmo#1837514, bmo#1891234)
Bypass of file name restrictions during saving
* CVE-2024-5693 (bmo#1891319)
Cross-Origin Image leak via Offscreen Canvas
* CVE-2024-5694 (bmo#1895055)
Use-after-free in JavaScript Strings
* CVE-2024-5695 (bmo#1895579)
Memory Corruption using allocation using out-of-memory conditions
* CVE-2024-5696 (bmo#1896555)
Memory Corruption in Text Fragments
* CVE-2024-5697 (bmo#1414937)
Website was able to detect when Firefox was taking a
screenshot of them
* CVE-2024-5698 (bmo#1828259)
Data-list could have overlaid address bar
* CVE-2024-5699 (bmo#1891349)
Cookie prefixes not treated as case-sensitive
* CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388, bmo#1895123)
Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
and Thunderbird 115.12
* CVE-2024-5701 (bmo#1890909, bmo#1891422, bmo#1893915,
bmo#1894047, bmo#1896024)
Memory safety bugs fixed in Firefox 127
- removed obsolete mozilla-bmo1886378.patch
* Wed May 29 2024 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 126.0.1
* Fixed an issue with reading tagged PDF documents in a screen reader
bmo#1894849
* Fixed not displaying localized text for non-en-US locales in the
Crash Reporter dialog box on macOS. (bmo#1896097)
* Fixed issues with drag-and-drop functionality on Linux. (bmo#1897115)
* Fixed an issue causing high GPU memory usage on certain versions
of AMD cards. (bmo#1897006)
* Tue May 28 2024 Guillaume GARDET <guillaume.gardet@opensuse.org>
- Backport upstream patches to fix build on aarch64 - boo#1225460
* mozilla-bmo1886378.patch
* Wed May 15 2024 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 126.0
https://www.mozilla.org/en-US/firefox/126.0/releasenotes
MFSA 2024-21 (bsc#1224056)
* CVE-2024-4764 (bmo#1879093)
Use-after-free when audio input connected with multiple consumers
* CVE-2024-4367 (bmo#1893645)
Arbitrary JavaScript execution in PDF.js
* CVE-2024-4765 (bmo#1871109)
Web application manifests could have been overwritten via
hash collision
* CVE-2024-4766 (bmo#1871214, bmo#1871217)
Fullscreen notification could have been obscured on Firefox
for Android
* CVE-2024-4767 (bmo#1878577)
IndexedDB files retained in private browsing mode
* CVE-2024-4768 (bmo#1886082)
Potential permissions request bypass via clickjacking
* CVE-2024-4769 (bmo#1886108)
Cross-origin responses could be distinguished between script
and non-script content-types
* CVE-2024-4770 (bmo#1893270)
Use-after-free could occur when printing to PDF
* CVE-2024-4771 (bmo#1893891)
Failed allocation could lead to use-after-free
* CVE-2024-4772 (bmo#1870579)
Use of insecure rand() function to generate nonce
* CVE-2024-4773 (bmo#1875248)
URL bar could be cleared after network error
* CVE-2024-4774 (bmo#1886598)
Undefined behavior in ShmemCharMapHashEntry()
* CVE-2024-4775 (bmo#1887332)
Invalid memory access in the built-in profiler
* CVE-2024-4776 (bmo#1887343)
Window may remain disabled after file dialog is shown in
full-screen
* CVE-2024-4777 (bmo#1878199, bmo#1893340)
Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
and Thunderbird 115.11
* CVE-2024-4778 (bmo#1838834, bmo#1889291, bmo#1889595,
bmo#1890204, bmo#1891545)
Memory safety bugs fixed in Firefox 126
- requires NSS 3.100
- removed obsolete mozilla-libproxy-fix.patch
* Mon Apr 29 2024 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 125.0.3
* Fixed: Fixed an extra blank tab with an address of
`https://0.0.0.1` sometimes appearing when attempting to
launch Firefox when it is already running (bmo#1892612).
* Fixed: Fixed an issue that could cause incorrect font
selection in some situations for users with the Japanese
locale set (bmo#1892363).
* Fixed: Fixed text corruption when dragging text containing
unicode characters on Linux systems (bmo#1888202).
* Fixed: Fixed a correctness error when checking
`arguments.length` (and not using arguments otherwise) inside
of a generator or async function (bmo#1892699).
* Fixed: Fixed an issue that could lead to inconsistent focus
handling of `<select>` elements when opened (bmo#1893177).
* Wed Apr 24 2024 Manfred Hollstein <manfred.h@gmx.net>
- Fix build on Leap by requiring gcc13 which has been made available
as an update.
* Sun Apr 21 2024 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 125.0.2
* The 125.0 and 125.0.1 releases were skipped due to problems
with a feature that proactively blocked downloads from
potentially untrustworthy URLs.
* New: Firefox now supports the AV1 codec for Encrypted Media
Extensions (EME), enabling higher-quality playback from video
streaming providers
* New: The Firefox PDF viewer now supports text highlighting.
* New: Firefox View now displays pinned tabs in the Open tabs
section. Tab indicators have also been added to Open tabs, so
users can do things like see which tabs are playing media and
quickly mute or unmute across windows. Indicators were also
added for bookmarks, tabs with notifications, and more!
their addresses upon submitting an address form, allowing
Firefox to autofill stored address information in the future.
* New: The URL Paste Suggestion feature provides a convenient
way for users to quickly visit URLs copied to the clipboard
in the address bar of Firefox. When the clipboard contains a
URL and the URL bar is focused, an autocomplete result
appears automatically. Activating the clipboard suggestion
will navigate the user to the URL with 1 click.
* New: Users of tab-specific Container add-ons can now search
in the Address Bar for tabs that are open in different
containers. Special thanks to volunteer contributor atararx
for kicking off the work on this feature!
* New: Firefox now provides an option to enable Web Proxy Auto-
Discovery (WPAD) while configured to use system proxy
settings.
* Changed: In a group of radio buttons where no option is
selected, the tab key now only reaches the first option
rather than cycling through all available options. The arrow
keys navigate between options as they do when there is a
selected option. This makes keyboard navigation more
efficient and consistent
* HTML5: Firefox now supports the `popover` global attribute
used for designating an element as a popover element. The
element won't be rendered until it is made visible, after
which it will appear on top of other page content.
* HTML5: WebAssembly multi-memory is now enabled by default.
Wasm multi-memory allows wasm modules to use and import
multiple independent linear memories. This enables more
efficient interoperability between modules and provides
better polyfills for upcoming wasm standards, such as the
component model.
* HTML5: Added support for Unicode Text Segmentation to
JavaScript.
* HTML5: Added support for `contextlost` and `contextrestored`
events on HTMLCanvasElement and OffscreenCanvas to allow user
code to recover from context loss with hardware accelerated
2d canvas.
* HTML5: Firefox now supports the
`navigator.clipboard.readText()` web API. A paste context
menu will appear for the user to confirm when attempting to
read clipboard data not provided by the same-origin page.
* HTML5: Added support for the `content-box` and `stroke-box`
keywords of the `transform-box` CSS property.
* HTML5: The `align-content` property now works in block
layout, allowing block direction alignment without needing a
flex or grid container.
* HTML5: Support for `SVGAElement.text` was removed in favor of
the more widely-implemented `SVGAElement.textContent` method.
* Developer: Following several requests, we have reintroduced
the option to disable the Pause Debugger Overlay
(`devtools.debugger.features.overlay`). This overlay appears
over the page content when the debugger pauses JavaScript
execution. In certain scenarios, the overlay can be
intrusive, making it challenging to interact with the page,
for instance, evaluating shades of color underneath.
* Developer: We've added a new drop-down menu button at the
bottom of the source view in the Debugger panel, specifically
designed for Source Map related actions. Users can now easily
disable or enable Source Maps support, open the Source Map
file in a new tab, switch between the original source and the
generated bundle, toggle the "open original source by
default" option, and view the Source Map status such as
errors, loading status, etc.
MFSA 2024-18 (bsc#1221327)
* CVE-2024-3852 (bmo#1883542)
GetBoundName in the JIT returned the wrong object
* CVE-2024-3853 (bmo#1884427)
Use-after-free if garbage collection runs during realm
initialization
* CVE-2024-3854 (bmo#1884552)
Out-of-bounds-read after mis-optimized switch statement
* CVE-2024-3855 (bmo#1885828)
Incorrect JIT optimization of MSubstr leads to out-of-bounds
reads
* CVE-2024-3856 (bmo#1885829)
Use-after-free in WASM garbage collection
* CVE-2024-3857 (bmo#1886683)
Incorrect JITting of arguments led to use-after-free during
garbage collection
* CVE-2024-3858 (bmo#1888892)
Corrupt pointer dereference in
js::CheckTracedThing<js::Shape>
* CVE-2024-3859 (bmo#1874489)
Integer-overflow led to out-of-bounds-read in the OpenType
sanitizer
* CVE-2024-3860 (bmo#1881417)
Crash when tracing empty shape lists
* CVE-2024-3861 (bmo#1883158)
Potential use-after-free due to AlignedBuffer self-move
* CVE-2024-3862 (bmo#1884457)
Potential use of uninitialized memory in MarkStack assignment
operator on self-assignment
* CVE-2024-3863 (bmo#1885855)
Download Protections were bypassed by .xrm-ms files on
Windows
* CVE-2024-3302 (bmo#1881183,
bmo#https://kb.cert.org/vuls/id/421644)
Denial of Service using HTTP/2 CONTINUATION frames
* CVE-2024-3864 (bmo#1888333)
Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
and Thunderbird 115.10
* CVE-2024-3865 (bmo#1881076, bmo#1884887, bmo#1885359,
bmo#1889049)
Memory safety bugs fixed in Firefox 125
- requires
NSS 3.99
rust 1.76
- add mozilla-libproxy-fix.patch to fix with-libproxy build variant
* Wed Apr 03 2024 Martin Sirringhaus <martin.sirringhaus@suse.com>
- Mozilla Firefox 124.0.2
https://www.mozilla.org/en-US/firefox/124.0.2/releasenotes/
* Fixed an issue where users with a large amount of bookmarks would
be unable to restore a bookmarks backup. (bmo#1884308)
* Fixed an issue that would cause open Firefox windows
to go blank or crash during video playback on sites such as
Netflix. (bmo#1883932)
* Fixed a crash that affected Linux AArch64 builds. (bmo#1866396)
* Fixed an issue where some users experienced difficulties loading
webpages due to changes made to the default AppArmor configuration
shipping in Ubuntu 24.04. (bmo#1884347)
* Fri Mar 22 2024 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 124.0.1
https://www.mozilla.org/en-US/firefox/124.0.1/releasenotes/
MFSA 2024-15 (bsc#1221850)
* CVE-2024-29943 (bmo#1886849)
Out-of-bounds access via Range Analysis bypass
* CVE-2024-29944 (bmo#1886852)
Privileged JavaScript Execution via Event Handlers
Mozilla Firefox 124.0
https://www.mozilla.org/en-US/firefox/124.0/releasenotes/
MFSA 2024-12 (bsc#1221327)
* CVE-2024-2605 (bmo#1872920)
Windows Error Reporter could be used as a Sandbox escape vector
* CVE-2024-2606 (bmo#1879237)
Mishandling of WASM register values
* CVE-2024-2607 (bmo#1879939)
JIT code failed to save return registers on Armv7-A
* CVE-2024-2608 (bmo#1880692)
Integer overflow could have led to out of bounds write
* CVE-2023-5388 (bmo#1780432)
NSS susceptible to timing attack against RSA decryption
* CVE-2024-2609 (bmo#1866100)
Permission prompt input delay could expire when not in focus
* CVE-2024-2610 (bmo#1871112)
Improper handling of html and body tags enabled CSP nonce leakage
* CVE-2024-2611 (bmo#1876675)
Clickjacking vulnerability could have led to a user accidentally
granting permissions
* CVE-2024-2612 (bmo#1879444)
Self referencing object could have potentially led to a use-
after-free
* CVE-2024-2613 (bmo#1875701)
Improper handling of QUIC ACK frame data could have led to OOM
* CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405, bmo#1881093)
Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
and Thunderbird 115.9
* CVE-2024-2615 (bmo#1881074, bmo#1881650, bmo#1882438)
Memory safety bugs fixed in Firefox 124
- requires
NSS = 3.98
rust-cbindgen >= 0.26
* Fri Mar 08 2024 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 123.0.1
* Fixed the *Firefox Translation* language indicator in the
address bar displaying a colored square icon instead of the
language code icon. (bmo#1879415)
* Fixed a regression with the `onChange` event not firing when
clearing the value of a `textarea` HTML field.
(bmo#1881457)
* Fixed a regression in the JavaScript JIT engine incorrectly
inlining strings in some cases. (bmo#1882386)
* Fixed: Fixed low contrast of text when selecting rows in the
Developer tools' Storage panel. (bmo#1877090)
* Thu Feb 22 2024 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 123.0
https://www.mozilla.org/en-US/firefox/123.0/releasenotes/
MFSA 2024-05 (bsc#1220048)
* CVE-2024-1546 (bmo#1843752)
Out-of-bounds memory read in networking channels
* CVE-2024-1547 (bmo#1877879)
Alert dialog could have been spoofed on another site
* CVE-2024-1554 (bmo#1816390)
fetch could be used to effect cache poisoning
* CVE-2024-1548 (bmo#1832627)
Fullscreen Notification could have been hidden by select element
* CVE-2024-1549 (bmo#1833814)
Custom cursor could obscure the permission dialog
* CVE-2024-1550 (bmo#1860065)
Mouse cursor re-positioned unexpectedly could have led to
unintended permission grants
* CVE-2024-1551 (bmo#1864385)
Multipart HTTP Responses would accept the Set-Cookie header
in response parts
* CVE-2024-1555 (bmo#1873223)
SameSite cookies were not properly respected when opening a
website from an external browser
* CVE-2024-1556 (bmo#1870414)
Invalid memory access in the built-in profiler
* CVE-2024-1552 (bmo#1874502)
Incorrect code generation on 32-bit ARM devices
* CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498, bmo#1872296,
bmo#1873521, bmo#1873577, bmo#1873597, bmo#1873866, bmo#1874080,
bmo#1874740, bmo#1875795, bmo#1875906, bmo#1876425, bmo#1878211,
bmo#1878286)
Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
and Thunderbird 115.8
* CVE-2024-1557 (bmo#1746471, bmo#1848829, bmo#1864011, bmo#1869175,
bmo#1869455, bmo#1869938, bmo#1871606)
Memory safety bugs fixed in Firefox 123
- requires NSS 3.97
* Tue Feb 13 2024 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 122.0.1
https://www.mozilla.org/en-US/firefox/122.0.1/releasenotes/
* Fixed the Library and Sidebar context menus only displaying
Multi-Account Containers icons in the "Open in New Container
Tab" menu. (bmo#1876518)
* Fixed an issue when clicking the Dismiss button in
notification pop-ups on Windows causing a webpage in a new tab.
(bmo#1848801)
* Fixed the yaru-remix system theme not applying correctly on
Linux. (bmo#1877002)
* Fixed adding an extra new line to a rule in the Developer
Tools' Inspector when copying it to the clipboard.
(bmo#1876220)
* Rolled back a keyboard behavior change made to the Developer
Tools' Rules view when validating a property name or input with
the Enter key.
This moves the focus to the next input, as was the behavior
in Firefox 121. (bmo#1877457)
* Tue Jan 30 2024 Martin Sirringhaus <martin.sirringhaus@suse.com>
- Recommend libfido2-udev on codestreams that exist, in order to try
to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)
* Sat Jan 27 2024 Andreas Schwab <schwab@suse.de>
- Fix file list
* Sun Jan 21 2024 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 122.0
https://www.mozilla.org/en-US/firefox/122.0/releasenotes/
MFSA 2024-01 (bsc#1218955)
* CVE-2024-0741 (bmo#1864587)
Out of bounds write in ANGLE
* CVE-2024-0742 (bmo#1867152)
Failure to update user input timestamp
* CVE-2024-0743 (bmo#1867408)
Crash in NSS TLS method
* CVE-2024-0744 (bmo#1871089)
Wild pointer dereference in JavaScript
* CVE-2024-0745 (bmo#1871838)
Stack buffer overflow in WebAudio
* CVE-2024-0746 (bmo#1660223)
Crash when listing printers on Linux
* CVE-2024-0747 (bmo#1764343)
Bypass of Content Security Policy when directive unsafe-inline was set
* CVE-2024-0748 (bmo#1783504)
Compromised content process could modify document URI
* CVE-2024-0749 (bmo#1813463)
Phishing site popup could show local origin in address bar
* CVE-2024-0750 (bmo#1863083)
Potential permissions request bypass via clickjacking
* CVE-2024-0751 (bmo#1865689)
Privilege escalation through devtools
* CVE-2024-0752 (bmo#1866840)
Use-after-free could occur when applying update on macOS
* CVE-2024-0753 (bmo#1870262)
HSTS policy on subdomain could bypass policy of upper domain
* CVE-2024-0754 (bmo#1871605)
Crash when using some WASM files in devtools
* CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
and Thunderbird 115.7
- requires NSS 3.96.1
- rebased patches
* Tue Jan 09 2024 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 121.0.1
* Fixed unexpected line wrapping in some CJK contexts caused by
changes in ideographic space handling. bmo#1870973)
* Fixed a hang when loading sites containing column-based
layouts under some circumstances. bmo#1867784)
* Fixed missing rounded corners for videos playing over another
video. bmo#1869994)
* Fixed Firefox not closing properly and other applications being
unable to use a USB security key after being previously used
during a Firefox session. bmo#1863135)
* Wed Dec 20 2023 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 121.0
https://www.mozilla.org/en-US/firefox/121.0/releasenotes
MFSA 2023-56 (bsc#1217974)
* CVE-2023-6856 (bmo#1843782)
Heap-buffer-overflow affecting WebGL DrawElementsInstanced
method with Mesa VM driver
* CVE-2023-6135 (bmo#1853908)
NSS susceptible to "Minerva" attack
* CVE-2023-6865 (bmo#1864123)
Potential exposure of uninitialized data in EncryptingOutputStream
* CVE-2023-6857 (bmo#1796023)
Symlinks may resolve to smaller than expected buffers
* CVE-2023-6858 (bmo#1826791)
Heap buffer overflow in nsTextFragment
* CVE-2023-6859 (bmo#1840144)
Use-after-free in PR_GetIdentitiesLayer
* CVE-2023-6866 (bmo#1849037)
TypedArrays lack sufficient exception handling
* CVE-2023-6860 (bmo#1854669)
Potential sandbox escape due to VideoBridge lack of texture
validation
* CVE-2023-6867 (bmo#1863863)
Clickjacking permission prompts using the popup transition
* CVE-2023-6861 (bmo#1864118)
Heap buffer overflow affected nsWindow::PickerOpen(void) in
headless mode
* CVE-2023-6868 (bmo#1865488)
WebPush requests on Firefox for Android did not require VAPID key
* CVE-2023-6869 (bmo#1799036)
Content can paint outside of sandboxed iframe
* CVE-2023-6870 (bmo#1823316)
Android Toast notifications may obscure fullscreen event
notifications
* CVE-2023-6871 (bmo#1828334)
Lack of protocol handler warning in some instances
* CVE-2023-6872 (bmo#1849186)
Browsing history leaked to syslogs via GNOME
* CVE-2023-6863 (bmo#1868901)
Undefined behavior in ShutdownObserver()
* CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328, bmo#1856090,
bmo#1858033, bmo#1858509, bmo#1862777, bmo#1864015)
Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
and Thunderbird 115.6
* CVE-2023-6873 (bmo#1855327, bmo#1862089, bmo#1862723)
Memory safety bugs fixed in Firefox 121
- requires NSS 3.95
* Fri Dec 08 2023 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 120.0.1 (boo#1217910)
* Fixed a bug that was causing persistent startup slowdowns
(bmo#1867095)
* Fixed an issue that was causing 100% CPU usage on sites such as
Google Maps. (bmo#1866409)
* Fixed an issue that was causing YouTube videos to show a green
screen when hardware acceleration was enabled. (bmo#1865928)
* Fixed an issue where the status bar was still visible when
viewing fullscreen video. (bmo#1853896)
* Fixed a startup crash affecting Linux users on some aarch64
systems with page sizes other than 4KB. (bmo#1866025)
* Wed Nov 22 2023 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 120.0
https://www.mozilla.org/en-US/firefox/120.0/releasenotes
MFSA 2023-49 (bsc#1217230)
* CVE-2023-6204 (bmo#1841050)
Out-of-bound memory access in WebGL2 blitFramebuffer
* CVE-2023-6205 (bmo#1854076)
Use-after-free in MessagePort::Entangled
* CVE-2023-6206 (bmo#1857430)
Clickjacking permission prompts using the fullscreen
transition
* CVE-2023-6207 (bmo#1861344)
Use-after-free in ReadableByteStreamQueueEntry::Buffer
* CVE-2023-6208 (bmo#1855345)
Using Selection API would copy contents into X11 primary
selection.
* CVE-2023-6209 (bmo#1858570)
Incorrect parsing of relative URLs starting with "///"
* CVE-2023-6210 (bmo#1801501)
Mixed-content resources not blocked in a javascript: pop-up
* CVE-2023-6211 (bmo#1850200)
Clickjacking to load insecure pages in HTTPS-only mode
* CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
bmo#1862782)
Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
and Thunderbird 115.5
* CVE-2023-6213 (bmo#1849265, bmo#1851118, bmo#1854911)
Memory safety bugs fixed in Firefox 120
- rebased patches
* Wed Nov 08 2023 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 119.0.1
* Fixed a bug causing colors in the <select> HTML element to not
be applied to dropdown menu arrows (bmo#1861253)
* Fixed a bug with the <input> HTML element state not changing
when dynamically updating the `disabled` attribute on an
ancestor <fieldset> (bmo#1861027)
* Fixed a bug causing elements with the indeterminate CSS
selector in a radio group to not update (bmo#1861346)
* Thu Oct 26 2023 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 119.0
https://www.mozilla.org/en-US/firefox/119.0/releasenotes
MFSA 2023-45 (bsc#1216338)
* CVE-2023-5721 (bmo#1830820)
Queued up rendering could have allowed websites to clickjack
* CVE-2023-5722 (bmo#1738426)
Cross-Origin size and header leakage
* CVE-2023-5723 (bmo#1802057)
Invalid cookie characters could have led to unexpected errors
* CVE-2023-5724 (bmo#1836705)
Large WebGL draw could have led to a crash
* CVE-2023-5725 (bmo#1845739)
WebExtensions could open arbitrary URLs
* CVE-2023-5726 (bmo#1846205)
Full screen notification obscured by file open dialog on macOS
* CVE-2023-5727 (bmo#1847180)
Download Protections were bypassed by .msix, .msixbundle,
.appx, and .appxbundle files on Windows
* CVE-2023-5728 (bmo#1852729)
Improper object tracking during GC in the JavaScript engine
could have led to a crash.
* CVE-2023-5729 (bmo#1823720)
Fullscreen notification dialog could have been obscured by
WebAuthn prompts
* CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694, bmo#1848833,
bmo#1850191, bmo#1850259, bmo#1852596, bmo#1853201, bmo#1854002,
bmo#1855306, bmo#1855640, bmo#1856695)
Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
and Thunderbird 115.4.1
* CVE-2023-5731 (bmo#1690111, bmo#1721904, bmo#1851803, bmo#1854068)
Memory safety bugs fixed in Firefox 119
- requires NSS 3.94
* Wed Oct 11 2023 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 118.0.2
* Fix games not loading on betsoft.com (bmo#1856145)
* Fix printing issues for some SVG images (bmo#1853727)
* Fix CORS XHR with authentication no longer working (bmo#1855650)
* Fix h264 WebRTC video not working in some contexts (bmo#1855636)
* Fix Firefox Translations not working on some pages
(bmo#1841656, bmo#1855307)
* Stability fixes (bmo#1851991, bmo#1799326, bmo#1856637)
* Sat Sep 30 2023 Björn Bidar <bjorn.bidar@thaodan.de>
- Activate KDE integration again, included rebased and updated
patches, firefox-kde.patch and mozilla-kde.patch, (upstream
removed special files handling for preferences but that has no
effect since we haven't shipped obsolete kde.js for a while)
(boo#1216027)
* Fri Sep 29 2023 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 118.0.1
MFSA 2023-44 (bsc#1215814)
* CVE-2023-5217 (bmo#1855550),
Heap buffer overflow in libvpx
* Mon Sep 25 2023 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 118.0
MFSA 2023-41 (bsc#1215575)
* CVE-2023-5168 (bmo#1846683)
Out-of-bounds write in FilterNodeD2D1
* CVE-2023-5169 (bmo#1846685)
Out-of-bounds write in PathOps
* CVE-2023-5170 (bmo#1846686)
Memory leak from a privileged process
* CVE-2023-5171 (bmo#1851599)
Use-after-free in Ion Compiler
* CVE-2023-5172 (bmo#1852218)
Memory Corruption in Ion Hints
* CVE-2023-5173 (bmo#1823172)
Out-of-bounds write in HTTP Alternate Services
* CVE-2023-5174 (bmo#1848454)
Double-free in process spawning on Windows
* CVE-2023-5175 (bmo#1849704)
Use-after-free of ImageBitmap during process shutdown
* CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824, bmo#1843962,
bmo#1848890, bmo#1850180, bmo#1850983, bmo#1851195)
Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
and Thunderbird 115.3
- requires NSS 3.93
- add mozilla-bmo1822730.patch
- deactivated KDE integration temporarily
(removed mozilla-kde.patch and firefox-kde.patch for now)
* Tue Sep 12 2023 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 117.0.1
* Fix a bug causing extensions using an event page for long-
running tasks to be terminated while running, causing
unexpected behavior changes (bmo#1851373)
* Temporarily revert an intentional behavior change preventing
Javascript from changing URL.protocol (bmo#1850954).
* Fix audio worklets not working for sites using WebAssembly
exception handling (bmo#1851468)
* Fix the Reopen all tabs option in the Recently closed tabs
menu sometimes failing to open all tabs (bmo#1850856)
* Fix the bookmarks menu sometimes remaining partially visible
when minimizing Firefox (bmo#1843700)
* Fix an issue causing incorrect time zones to be detected on
some sites (bmo#1848615)
* MFSA 2023-40 CVE-2023-4863 (boo#1215231)
Heap buffer overflow in WebP
* Sun Aug 27 2023 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 117.0
https://www.mozilla.org/en-US/firefox/117.0/releasenotes
MFSA 2023-34 (bsc#1214606)
* CVE-2023-4573 (bmo#1846687)
Memory corruption in IPC CanvasTranslator
* CVE-2023-4574 (bmo#1846688)
Memory corruption in IPC ColorPickerShownCallback
* CVE-2023-4575 (bmo#1846689)
Memory corruption in IPC FilePickerShownCallback
* CVE-2023-4576 (bmo#1846694)
Integer Overflow in RecordedSourceSurfaceCreation
* CVE-2023-4577 (bmo#1847397)
Memory corruption in JIT UpdateRegExpStatics
* CVE-2023-4578 (bmo#1839007)
Error reporting methods in SpiderMonkey could have triggered
an Out of Memory Exception
* CVE-2023-4579 (bmo#1842766)
Persisted search terms were formatted as URLs
* CVE-2023-4580 (bmo#1843046)
Push notifications saved to disk unencrypted
* CVE-2023-4581 (bmo#1843758)
XLL file extensions were downloadable without warnings
* CVE-2023-4582 (bmo#1773874)
Buffer Overflow in WebGL glGetProgramiv
* CVE-2023-4583 (bmo#1842030)
Browsing Context potentially not cleared when closing Private
Window
* CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
bmo#1846526, bmo#1847529)
Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
* CVE-2023-4585 (bmo#1751583, bmo#1841082, bmo#1847904, bmo#1848999)
Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
and Thunderbird 115.2
- requires
NSS = 3.92
rustc = 1.71
* Thu Aug 17 2023 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 116.0.3
* Fixed an issue for OPFS users that broke access to files that
were locally cached in a previous version
(bmo#1847989, bmo#1847619)
* Fixed an issue that was breaking screensharing for some users
on Wayland (bmo#1841851)
* Fixed an issue where a fullscreen notification was persistently
being shown to a user, even after disabling it (bmo#1847901)
* Fixed an issue where Firefox would hang when doing a Google
search (bmo#1847066)
* Tue Aug 15 2023 Adam Majer <adam.majer@suse.de>
- After further testing on memory consumption during linking, it's
safe to remove most of the memory reducing options for ix86 linker.
A combination of these actually resulted in the OOM condition.
It's even possible to add basic debugging info while keeping
linker memory consumption at about 2GB
* Thu Aug 10 2023 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 116.0.2
* fixes for other platforms
* Wed Aug 09 2023 Adam Majer <adam.majer@suse.de>
- Workarold ld bug causing OOM when linking on 32-bit
- Remove -j1 limit on x86. The build runs on 64-bit kernel with a
32-bit userland. This means there is plenty of memory available
but userland is limited to just under 4GB per process.
* Sat Aug 05 2023 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 116.0.1
* fixes for other platforms
* Sat Aug 05 2023 Andreas Schwab <schwab@suse.de>
- ship vaapitest binary for supported archs
* Fri Aug 04 2023 Wolfgang Rosenauer <wr@rosenauer.org>
- re-enable ppc64le
- ship v4l2test binary for supported archs
- drop obsolete mozilla-bmo1775202.patch
* Sun Jul 30 2023 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 116.0
* https://www.mozilla.org/en-US/firefox/116.0/releasenotes/
MFSA 2023-29 (bsc#1213746)
* CVE-2023-4045 (bmo#1833876)
Offscreen Canvas could have bypassed cross-origin restrictions
* CVE-2023-4046 (bmo#1837686)
Incorrect value used during WASM compilation
* CVE-2023-4047 (bmo#1839073)
Potential permissions request bypass via clickjacking
* CVE-2023-4048 (bmo#1841368)
Crash in DOMParser due to out-of-memory conditions
* CVE-2023-4049 (bmo#1842658)
Fix potential race conditions when releasing platform objects
* CVE-2023-4050 (bmo#1843038)
Stack buffer overflow in StorageManager
* CVE-2023-4051 (bmo#1821884)
Full screen notification obscured by file open dialog
* CVE-2023-4052 (bmo#1824420)
File deletion and privilege escalation through Firefox uninstaller
* CVE-2023-4053 (bmo#1839079)
Full screen notification obscured by external program
* CVE-2023-4054 (bmo#1840777)
Lack of warning when opening appref-ms files
* CVE-2023-4055 (bmo#1782561)
Cookie jar overflow caused unexpected cookie jar state
* CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
bmo#1842325, bmo#1843847)
Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
* CVE-2023-4057 (bmo#1841682)
Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
and Thunderbird 115.1
* CVE-2023-4058 (bmo#1819160, bmo#1828024)
Memory safety bugs fixed in Firefox 116
- require NSS 3.91
- remove obsolete mozilla-fix-top-level-asm.patch
- re-enable LTO
* Fri Jul 28 2023 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 115.0.3
* fixes for other platforms
- remove bashisms from firefox startup script (boo#1213657)
* Thu Jul 13 2023 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 115.0.2
* Fixed a bug with displaying a caret in the text editor on some websites
(bmo#1840804)
* Fixed a bug with broken audio rendering on some websites (bmo#1841982)
* Fixed a bug with patternTransform translate using the wrong units
(bmo#1840746)
MFSA 2023-26 (bsc#1213230)
* CVE-2023-3600 (bmo#1839703)
Use-after-free in workers
* Fri Jul 07 2023 Andreas Stieger <Andreas.Stieger@gmx.de>
- Mozilla Firefox 115.0.1
* fixes for other platforms
* Sun Jul 02 2023 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 115.0
* Support for importing payment methods saved in Chrome-based browser
* Hardware video decoding is now enabled for Intel GPUs on Linux
* The Tab Manager dropdown now features close buttons, so tabs
can be closed more quickly
* Streamlined the user interface for importing data in from other browsers
* Users without platform support for H264 video decoding can now
fallback to Cisco's OpenH264 plugin for playback.
* Undo and redo are now available in Password fields
* Changed: On Linux, middle clicks on the new tab button will
now open the xclipboard contents in the new tab. If the
xclipboard content is a URL then that URL is opened, any
other text is opened with your default search provider.
* Changed: For users with a Firefox Colorways built-in theme,
the theme will be automatically migrated to the same theme
hosted on addons.mozilla.org for Firefox profiles that have
disabled add-ons auto-updates. This will allow users to keep
their Colorways theme when they are later removed from
Firefox installer files.
* Changed: Certain Firefox users may come across a message in
the extensions panel indicating that their add-ons are not
allowed on the site currently open. We have introduced a new
back-end feature to only allow some extensions monitored by
Mozilla to run on specific websites for various reasons,
including security concerns.
* HTML5: The builtin editor now behaves similarly to other
browsers with `contenteditable` and `designMode` when
splitting a node, e.g. typing Enter to split a paragraph, and
also when joining two nodes, e.g. typing Backspace at the
start of a paragraph to join the paragraph and the previous
one.
When a node is split, the builtin editor creates a new node
after the original one instead of before, i.e. creates the
right node instead of the left node.
Similarly, when two nodes are joined, the builtin editor
deletes the latter node and moves its children to the end of
the preceding node instead of deleting the former node and
moving its child to the start of the following node.
* HTML5: WebRTC application developers can now specify a target
in milliseconds of media for the jitter buffer to hold.
Altering the target value allows applications to control the
tradeoff between playout delay and the risk of running out of
audio or video frames due to network jitter.
* HTML5: Change array by copy provides additional methods on
`Array.prototype` and `TypedArray.prototype` to enable
changes on the array by returning a new copy of it with the
change.
* HTML5: The animation-composition property is now supported,
allowing a declarative way to define the composite operation
used when multiple animations affect the same property
simultaneously.
* HTML5: Added the URL.canParse() function to allow easy and
fast checking if URLs are valid and parseable.
* HTML5: IndexedDB is now also supported in private browsing
without memory limits thanks to encrypted storage on disk.
The temporary keys to decrypt the information are hold in RAM
only and all stored information is purged at the normal end
of a private browsing session from disk.
* HTML5: Supports conditions are now supported in CSS import
rules @import supports(...)
* Developer: In web development, we rely on third-party
libraries which you may not be interested in while debugging.
These can be ignored. Ignoring them means that breakpoints
will not get hit and they are skipped during stepping.
You can now choose to **Hide ignore-listed sources** in the
Developer Tools source tree
* Developer: We have introduced a new option,
`devtools.f12_enabled`, that can be utilized to prevent the
accidental use of the F12 key, which opens the DevTools
toolbox (bug).
* Enterprise: You can find information about policy updates and
enterprise specific bug fixes in the Firefox for Enterprise
115 Release Notes.
MFSA 2023-22 (bsc#1212438)
* CVE-2023-3482 (bmo#1839464)
Block all cookies bypass for localstorage
* CVE-2023-37201 (bmo#1826002)
Use-after-free in WebRTC certificate generation
* CVE-2023-37202 (bmo#1834711)
Potential use-after-free from compartment mismatch in SpiderMonkey
* CVE-2023-37203 (bmo#291640)
Drag and Drop API may provide access to local system files
* CVE-2023-37204 (bmo#1832195)
Fullscreen notification obscured via option element
* CVE-2023-37205 (bmo#1704420)
URL spoofing in address bar using RTL characters
* CVE-2023-37206 (bmo#1813299)
Insufficient validation of symlinks in the FileSystem API
* CVE-2023-37207 (bmo#1816287)
Fullscreen notification obscured
* CVE-2023-37208 (bmo#1837675)
Lack of warning when opening Diagcab files
* CVE-2023-37209 (bmo#1837993)
Use-after-free in `NotifyOnHistoryReload`
* CVE-2023-37210 (bmo#1821886)
Full-screen mode exit prevention
* CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
bmo#1836550, bmo#1837450)
Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
and Thunderbird 102.13
* CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206, bmo#1827076,
bmo#1828690, bmo#1833503, bmo#1835710, bmo#1838587)
Memory safety bugs fixed in Firefox 115
- Requires NSS 3.90
- Add patches:
mozilla-rust-disable-future-incompat.patch
mozilla-bmo1775202.patch
mozilla-partial-revert-1768632.patch
- removed obsolete mozilla-buildfixes.patch
* Tue Jun 20 2023 Andreas Stieger <Andreas.Stieger@gmx.de>
- Mozilla Firefox 114.0.2:
* Several crash fixes
* Web Extensions: Fixes for 114 regressions in Native Messaging
support
* Tue Jun 20 2023 Wolfgang Rosenauer <wr@rosenauer.org>
- do not enable LTO as it caused crashes now (boo#1212101)
* Sat Jun 10 2023 Andreas Stieger <Andreas.Stieger@gmx.de>
- Mozilla Firefox 114.0.1
* Fix a startup crash (bmo#1837201, boo#1212101)
* Fri Jun 09 2023 Martin Sirringhaus <martin.sirringhaus@suse.com>
- Only install vaapitest for wayland-enabled builds, where it gets built
- Rebase mozilla-silence-no-return-type.patch
- Rebase s390x-patches, and remove obsolete patches:
mozilla-bmo1005535.patch mozilla-s390x-skia-gradient.patch
* Mon Jun 05 2023 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 114.0
MFSA 2023-20 (bsc#1211922)
* CVE-2023-34414 (bmo#1695986)
Click-jacking certificate exceptions through rendering lag
* CVE-2023-34415 (bmo#1811999)
Site-isolation bypass on sites that allow open redirects to
data: urls
* CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
bmo#1830206, bmo#1830795, bmo#1833339)
Memory safety bugs fixed in Firefox 114 and Firefox ESR
102.12
* CVE-2023-34417 (bmo#1746447, bmo#1820903, bmo#1832832)
Memory safety bugs fixed in Firefox 114
* New: Added UI to manage the DNS over HTTPS exception list.
(bmo#1596847)
* New: Bookmarks can now be searched from the Bookmarks menu.
The Bookmarks menu is accessible by adding the *Bookmarks
menu* button to the toolbar. (bmo#1736937)
* New: Restrict searches to your local browsing history by
selecting *Search history* from the History, Library or
Application menu buttons. (bmo#1736939)
* New: Mac users can now capture video from their cameras in
all supported native resolutions. This enables resolutions
higher than 1280x720. (bmo#1806604)
* New: It is now possible to reorder the extensions listed in
the extensions panel. (bmo#1805924)
* New: Users on macOS, Linux, and Windows 7 can now use FIDO2 /
WebAuthn authenticators over USB. Some advanced features,
such as fully passwordless logins, require a PIN to be set on
the authenticator. (bmo#1814487)
* New: Pocket Recommended content can now be seen in France,
Italy, and Spain. (bmo#None)
* Changed: DNS over HTTPS settings are now part of the
* Privacy & Security* section of the *Settings* page and allow
the user to choose from all the supported modes.
(bmo#1610741)
* HTML5: DOM: Added support for ES Modules on DedicatedWorker
and SharedWorker
* HTML5: WebTransport is now enabled by default and will be
going to release with 114. As the original Explainer notes,
it enables multiple use-cases that are hard or impossible to
handle without it, especially for Gaming and live streaming.
It covers cases that are problematic for alternative
mechanisms, such as WebSockets.
Built on top of HTTP3 (HTTP2 support will be coming later).
The current implementation in Firefox is passing 505 out of
565 Web-Platform Tests.
* HTML5: CSS: The `infinity` and `NaN` constants are now
supported inside the `calc()` function. (bmo#1830759)
* Developer: The *Copy as cURL* feature, available in the
Network panel, has been enhanced. It now supports the
- `-compressed` argument. (bmo#1776120)
* Developer: The Accessibility Inspector has been improved to
accurately recognize all the ARIA roles like `banner`,
`main`, `navigation`, and `contentinfo`, etc. This
enhancement is particularly beneficial for web developers
working with ARIA roles to improve web accessibility.
(bmo#1572512)
* Developer: Firefox now provides support for the CSS Cascading
Level 4 `supports()` syntax for `@import` rules. This allows
for the importation of other stylesheets based on support-
dependency. In addition, the Inspector panel now accurately
displays the conditions at the top of the imported rule.
- requires NSS 3.89.1
* Wed May 24 2023 Andreas Stieger <Andreas.Stieger@gmx.de>
- Mozilla Firefox 113.0.2 (boo#1211696)
* Fixed: Fixed a bug which could cause Firefox to freeze on
some pages when loading them with the Developer Tools Web
Console open (bmo#1828026)
* Fixed: Fixed a bug which would cause the bookmarks and
history sidebars to not properly react to the browser window
being vertically resized (bmo#1831535)
* Sat May 13 2023 Andreas Stieger <Andreas.Stieger@gmx.de>
- Mozilla Firefox 113.0.1
* UI fixes for other platforms
- upstream signing key updated
* Tue May 09 2023 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 113.0
* https://www.mozilla.org/en-US/firefox/113.0/releasenotes
MFSA 2023-16 (bsc#1211175)
* CVE-2023-32205 (bmo#1753339, bmo#1753341)
Browser prompts could have been obscured by popups
* CVE-2023-32206 (bmo#1824892)
Crash in RLBox Expat driver
* CVE-2023-32207 (bmo#1826116)
Potential permissions request bypass via clickjacking
* CVE-2023-32208 (bmo#1646034)
Leak of script base URL in service workers via import()
* CVE-2023-32209 (bmo#1767194)
Persistent DoS via favicon image
* CVE-2023-32210 (bmo#1776755)
Incorrect principal object ordering
* CVE-2023-32211 (bmo#1823379)
Content process crash due to invalid wasm code
* CVE-2023-32212 (bmo#1826622)
Potential spoof due to obscured address bar
* CVE-2023-32213 (bmo#1826666)
Potential memory corruption in FileReader::DoReadData()
* MFSA-TMP-2023-0002 (bmo#1814560, bmo#1814790, bmo#1819796)
Race condition in dav1d decoding
* CVE-2023-32214 (bmo#1828716)
Potential DoS via exposed protocol handlers
* CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856, bmo#1820210,
bmo#1821480, bmo#1827019, bmo#1827024, bmo#1827144, bmo#1827359,
bmo#1830186)
Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11
* CVE-2023-32216 (bmo#1746479, bmo#1806852, bmo#1815987,
bmo#1820359, bmo#1823568, bmo#1824803, bmo#1824834, bmo#1825170,
bmo#1827020, bmo#1828130)
Memory safety bugs fixed in Firefox 113
- removed obsolete mozilla-bmo1568145.patch
* Sun May 07 2023 Aaron Puchert <aaronpuchert@alice-dsl.net>
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
* Tue Apr 25 2023 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 112.0.2
* Fix a high memory usage issue with animated images in minimized
(or completely covered) windows, especially when using animated
themes (bmo#1828587)
* Fix an issue where Linux users with bitmap fonts installed may
have had entire sections of text invisible to them on some
sites (bmo#1827950)
* Fri Apr 21 2023 Manfred Hollstein <manfred.h@gmx.net>
- Include Leap 15.5 in check for which python version is required.
* Thu Apr 20 2023 Andreas Stieger <Andreas.Stieger@gmx.de>
- Mozilla Firefox 112.0.1
* Fix a bug where cookie dates appear to be set in the far
future after updating Firefox. This may have caused cookies to
be unintentionally purged (bmo#1827669)
* Mon Apr 10 2023 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 112.0
* https://www.mozilla.org/en-US/firefox/112.0/releasenotes/
MFSA 2023-13 (bsc#1210212)
* CVE-2023-29531 (bmo#1794292)
Out-of-bound memory access in WebGL on macOS
* CVE-2023-29532 (bmo#1806394)
Mozilla Maintenance Service Write-lock bypass
* CVE-2023-29533 (bmo#1798219, bmo#1814597)
Fullscreen notification obscured
* CVE-2023-29534 (bmo#1816007, bmo#1816059, bmo#1821155, bmo#1821576,
bmo#1821906, bmo#1822298, bmo#1822305)
Fullscreen notification could have been obscured on Firefox
for Android
* MFSA-TMP-2023-0001 (bmo#1819244)
Double-free in libwebp
* CVE-2023-29535 (bmo#1820543)
Potential Memory Corruption following Garbage Collector compaction
* CVE-2023-29536 (bmo#1821959)
Invalid free from JavaScript code
* CVE-2023-29537 (bmo#1823365, bmo#1824200, bmo#1825569)
Data Races in font initialization code
* CVE-2023-29538 (bmo#1685403)
Directory information could have been leaked to WebExtensions
* CVE-2023-29539 (bmo#1784348)
Content-Disposition filename truncation leads to Reflected
File Download
* CVE-2023-29540 (bmo#1790542)
Iframe sandbox bypass using redirects and sourceMappingUrls
* CVE-2023-29541 (bmo#1810191)
Files with malicious extensions could have been downloaded
unsafely on Linux
* CVE-2023-29542 (bmo#1810793, bmo#1815062)
Bypass of file download extension restrictions
* CVE-2023-29543 (bmo#1816158)
Use-after-free in debugging APIs
* CVE-2023-29544 (bmo#1818781)
Memory Corruption in garbage collector
* CVE-2023-29545 (bmo#1823077)
Windows Save As dialog resolved environment variables
* CVE-2023-29546 (bmo#1780842)
Screen recording in Private Browsing included address bar on
Android
* CVE-2023-29547 (bmo#1783536)
Secure document cookie could be spoofed with insecure cookie
* CVE-2023-29548 (bmo#1822754)
Incorrect optimization result on ARM64
* CVE-2023-29549 (bmo#1823042)
Javascript's bind function may have failed
* CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498, bmo#1814217,
bmo#1818357, bmo#1818762, bmo#1819493, bmo#1820389, bmo#1820602,
bmo#1821448, bmo#1822413, bmo#1824828)
Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10
* CVE-2023-29551 (bmo#1763625, bmo#1814314, bmo#1815798, bmo#1815890,
bmo#1819239, bmo#1819465, bmo#1819486, bmo#1819492, bmo#1819957,
bmo#1820514, bmo#1820776, bmo#1821838, bmo#1822175, bmo#1823547)
Memory safety bugs fixed in Firefox 112
- requires
* NSS 3.89
* Python >= 3.7 (for build)
- removed obsolete mozilla-bmo1807652.patch
- Fix Icons displayed incorrectly on GNOME/wayland via WMCLASS
in desktop file
* Mon Mar 27 2023 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 111.0.1 (boo#1209688)
* Fixed a crash on macOS while pinch-zooming under some circumstances
(bmo#1658986)
* Fixed a bug causing Firefox to freeze on startup for some
Windows users (bmo#1823159)
- fix build on Tumbleweed (mozilla-bmo1807652.patch)
- exclude i586/i686 once again because it fails to link libxul due
to its size
* Tue Mar 14 2023 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 111.0
* https://www.mozilla.org/en-US/firefox/111.0/releasenotes
MFSA 2023-09 (bsc#1209173)
* CVE-2023-28159 (bmo#1783561)
Fullscreen Notification could have been hidden by download
popups on Android
* CVE-2023-25748 (bmo#1798798)
Fullscreen Notification could have been hidden by window
prompts on Android
* CVE-2023-25749 (bmo#1810705)
Firefox for Android may have opened third-party apps without
a prompt
* CVE-2023-25750 (bmo#1814733)
Potential ServiceWorker cache leak during private browsing mode
* CVE-2023-25751 (bmo#1814899)
Incorrect code generation during JIT compilation
* CVE-2023-28160 (bmo#1802385)
Redirect to Web Extension files may have leaked local path
* CVE-2023-28164 (bmo#1809122)
URL being dragged from a removed cross-origin iframe into the
same tab triggered navigation
* CVE-2023-28161 (bmo#1811181)
One-time permissions granted to a local file were extended to
other local files loaded in the same tab
* CVE-2023-28162 (bmo#1811327)
Invalid downcast in Worklets
* CVE-2023-25752 (bmo#1811627)
Potential out-of-bounds when accessing throttled streams
* CVE-2023-28163 (bmo#1817768)
Windows Save As dialog resolved environment variables
* CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904, bmo#1817442,
bmo#1818674)
Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9
* CVE-2023-28177 (bmo#1803109, bmo#1808832, bmo#1809542, bmo#1817336)
Memory safety bugs fixed in Firefox 111
- ensure gcc11-c++ gets used on Leap 15.5
- requires NSS >= 3.88.1
- removed obsolete patches
gcc13-fix.patch
mozilla-bmo1810584.patch
- rebased patches
- update create-tar.sh
* Tue Mar 07 2023 Martin Liška <mliska@suse.cz>
- Cherry-pick upstream changes for GCC 13 in gcc13-fix.patch.
* Mon Mar 06 2023 Andreas Schwab <schwab@suse.de>
- Limit memory use on riscv64
* Sat Mar 04 2023 Andreas Stieger <andreas.stieger@gmx.de>
- Fix 32 bit build bmo#1810584 (add mozilla-bmo1810584.patch)
* Fri Mar 03 2023 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 110.0.1 (boo#1208886)
* Fixed clearing recent cookies clears all cookies
(bmo#1816279)
* Fixed WebGL crashes on Linux when ran inside a VMWare virtual
machine (bmo#1807942)
* Fixed a bug with CSP serialization causing bugs with the MitID
Digital ID in Denmark (bmo#1819096)
* Wed Feb 15 2023 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 110.0
* https://www.mozilla.org/en-US/firefox/110.0/releasenotes
MFSA 2023-05 (bsc#1208144)
* CVE-2023-25728 (bmo#1790345)
Content security policy leak in violation reports using iframes
* CVE-2023-25730 (bmo#1794622)
Screen hijack via browser fullscreen mode
* CVE-2023-25743 (bmo#1800203)
Fullscreen notification not shown in Firefox Focus
* CVE-2023-0767 (bmo#1804640)
Arbitrary memory write via PKCS 12 in NSS
* CVE-2023-25735 (bmo#1810711)
Potential use-after-free from compartment mismatch in SpiderMonkey
* CVE-2023-25737 (bmo#1811464)
Invalid downcast in SVGUtils::SetupStrokeGeometry
* CVE-2023-25738 (bmo#1811852)
Printing on Windows could potentially crash Firefox with some
device drivers
* CVE-2023-25739 (bmo#1811939)
Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext
* CVE-2023-25729 (bmo#1792138)
Extensions could have opened external schemes without user knowledge
* CVE-2023-25732 (bmo#1804564)
Out of bounds memory write from EncodeInputStream
* CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143, bmo#1812338)
Opening local .url files could cause unexpected network loads
* CVE-2023-25740 (bmo#1812354)
Opening local .scf files could cause unexpected network loads
* CVE-2023-25731 (bmo#1801542)
Prototype pollution when rendering URLPreview
* CVE-2023-25733 (bmo#1808632)
Possible null pointer dereference in TaskbarPreviewCallback
* CVE-2023-25736 (bmo#1811331)
Invalid downcast in GetTableSelectionMode
* CVE-2023-25741 (bmo#1437126, bmo#1812611, bmo#1813376)
Same-origin policy leak via image drag and drop
* CVE-2023-25742 (bmo#1813424)
Web Crypto ImportKey crashes tab
* CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)
Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
* CVE-2023-25745 (bmo#1688592, bmo#1797186, bmo#1804998,
bmo#1806521, bmo#1813284)
Memory safety bugs fixed in Firefox 110
- requires
NSS = 3.87
rust/cargo = 1.66
- update create-tar.sh
* Wed Feb 01 2023 Andreas Stieger <andreas.stieger@gmx.de>
- Mozilla Firefox 109.0.1
* Fixed jank when loading pages containing a large number of
emoji characters (bmo#1809081)
* Fixed an issue causing authentication prompts to not appear
when loading pages in some enterprise environments
(bmo#1809151)
* ixed inconsistent sizing of event listener checkboxes inside
the Inspector developer tool (bmo#1811760)
* Mon Jan 16 2023 Wolfgang Rosenauer <wr@rosenauer.org>
- Mozilla Firefox 109.0
MFSA 2023-01 (bsc#1207119)
* CVE-2023-23597 (bmo#1538028)
Logic bug in process allocation allowed to read arbitrary
files
* CVE-2023-23598 (bmo#1800425)
Arbitrary file read from GTK drag and drop on Linux
* CVE-2023-23599 (bmo#1777800)
Malicious command could be hidden in devtools output on
Windows
* CVE-2023-23600 (bmo#1787034)
Notification permissions persisted between Normal and Private
Browsing on Android
* CVE-2023-23601 (bmo#1794268)
URL being dragged from cross-origin iframe into same tab
triggers navigation
* CVE-2023-23602 (bmo#1800890)
Content Security Policy wasn't being correctly applied to
WebSockets in WebWorkers
* CVE-2023-23603 (bmo#1800832)
Calls to <code>console.log</code> allowed bypasing Content
Security Policy via format directive
* CVE-2023-23604 (bmo#1802346)
Creation of duplicate <code>SystemPrincipal</code> from less
secure contexts
* CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)
Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7
* CVE-2023-23606 (bmo#1764974, bmo#1798591, bmo#1799201,
bmo#1800446, bmo#1801248, bmo#1802100, bmo#1803393,
bmo#1804626, bmo#1804971, bmo#1807004)
Memory safety bugs fixed in Firefox 109
- requires NSS 3.86
- rebased patches
* Fri Jan 06 2023 Luciano Santos <luc14n0@opensuse.org>
- Mozilla Firefox 108.0.2
* Fixes a crash that might occur when managing browser history
(bmo#1806408).
- Drop merged-upstream mozilla-bmo1805809.patch.
/usr/bin/firefox
/usr/lib64/firefox
/usr/lib64/firefox/application.ini
/usr/lib64/firefox/browser
/usr/lib64/firefox/browser/chrome
/usr/lib64/firefox/browser/chrome/icons
/usr/lib64/firefox/browser/chrome/icons/default
/usr/lib64/firefox/browser/chrome/icons/default/default128.png
/usr/lib64/firefox/browser/chrome/icons/default/default16.png
/usr/lib64/firefox/browser/chrome/icons/default/default22.png
/usr/lib64/firefox/browser/chrome/icons/default/default24.png
/usr/lib64/firefox/browser/chrome/icons/default/default256.png
/usr/lib64/firefox/browser/chrome/icons/default/default32.png
/usr/lib64/firefox/browser/chrome/icons/default/default48.png
/usr/lib64/firefox/browser/chrome/icons/default/default64.png
/usr/lib64/firefox/browser/defaults
/usr/lib64/firefox/browser/defaults/preferences
/usr/lib64/firefox/browser/defaults/preferences/firefox.js
/usr/lib64/firefox/browser/omni.ja
/usr/lib64/firefox/crashhelper
/usr/lib64/firefox/crashreporter
/usr/lib64/firefox/defaults
/usr/lib64/firefox/defaults/pref
/usr/lib64/firefox/defaults/pref/channel-prefs.js
/usr/lib64/firefox/defaults/pref/spellcheck.js
/usr/lib64/firefox/dependentlibs.list
/usr/lib64/firefox/distribution
/usr/lib64/firefox/distribution/extensions
/usr/lib64/firefox/firefox
/usr/lib64/firefox/firefox-bin
/usr/lib64/firefox/firefox.sh
/usr/lib64/firefox/fonts
/usr/lib64/firefox/fonts/TwemojiMozilla.ttf
/usr/lib64/firefox/glxtest
/usr/lib64/firefox/gmp-clearkey
/usr/lib64/firefox/gmp-clearkey/0.1
/usr/lib64/firefox/gmp-clearkey/0.1/libclearkey.so
/usr/lib64/firefox/gmp-clearkey/0.1/manifest.json
/usr/lib64/firefox/libgkcodecs.so
/usr/lib64/firefox/liblgpllibs.so
/usr/lib64/firefox/libmozavcodec.so
/usr/lib64/firefox/libmozavutil.so
/usr/lib64/firefox/libmozgtk.so
/usr/lib64/firefox/libmozinference.so
/usr/lib64/firefox/libmozsandbox.so
/usr/lib64/firefox/libmozsqlite3.so
/usr/lib64/firefox/libmozwayland.so
/usr/lib64/firefox/libxul.so
/usr/lib64/firefox/omni.ja
/usr/lib64/firefox/pingsender
/usr/lib64/firefox/platform.ini
/usr/lib64/firefox/vaapitest
/usr/lib64/mozilla
/usr/lib64/mozilla/extensions
/usr/lib64/mozilla/extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
/usr/share/applications/firefox.desktop
/usr/share/gnome-shell
/usr/share/gnome-shell/search-providers
/usr/share/gnome-shell/search-providers/firefox-search-provider.ini
/usr/share/icons/hicolor
/usr/share/icons/hicolor/128x128
/usr/share/icons/hicolor/128x128/apps
/usr/share/icons/hicolor/128x128/apps/firefox.png
/usr/share/icons/hicolor/16x16
/usr/share/icons/hicolor/16x16/apps
/usr/share/icons/hicolor/16x16/apps/firefox.png
/usr/share/icons/hicolor/22x22
/usr/share/icons/hicolor/22x22/apps
/usr/share/icons/hicolor/22x22/apps/firefox.png
/usr/share/icons/hicolor/24x24
/usr/share/icons/hicolor/24x24/apps
/usr/share/icons/hicolor/24x24/apps/firefox.png
/usr/share/icons/hicolor/256x256
/usr/share/icons/hicolor/256x256/apps
/usr/share/icons/hicolor/256x256/apps/firefox.png
/usr/share/icons/hicolor/32x32
/usr/share/icons/hicolor/32x32/apps
/usr/share/icons/hicolor/32x32/apps/firefox.png
/usr/share/icons/hicolor/48x48
/usr/share/icons/hicolor/48x48/apps
/usr/share/icons/hicolor/48x48/apps/firefox.png
/usr/share/icons/hicolor/64x64
/usr/share/icons/hicolor/64x64/apps
/usr/share/icons/hicolor/64x64/apps/firefox.png
/usr/share/man/man1/firefox.1.gz
/usr/share/metainfo
/usr/share/metainfo/firefox.appdata.xml
/usr/share/mime/packages/firefox.xml
/usr/share/mozilla
/usr/share/mozilla/extensions
/usr/share/mozilla/extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
Generated by rpm2html 1.8.1
Fabrice Bellet, Fri Jul 24 15:27:28 2026