%define rname firefox
%set_verify_elf_method no
%def_without system_nss
%define firefox_cid \{ec8030f7-c20a-464f-9b0e-13a3a9e97384\}
%define firefox_prefix %_libdir/firefox
%define firefox_datadir %_datadir/firefox
%define gst_version 1.0
%define nspr_version 4.17
%define nss_version 3.36.4
%define rust_version 1.24.1
%define cargo_version 0.25.0
Summary: The Mozilla Firefox project is a redesign of Mozilla's browser
Summary(ru_RU.UTF-8): Интернет-браузер Mozilla Firefox
Name: firefox
Version: 60.8.0
Release: alt0.M70C.1
License: MPL/GPL/LGPL
Group: Networking/WWW
URL: http://www.mozilla.org/projects/firefox/
Packager: Andrey Cherepanov <cas@altlinux.ru>
Source0: firefox-source.tar
Source1: rpm-build.tar
Source2: searchplugins.tar
Source4: firefox-mozconfig
Source5: distribution.ini
Source6: firefox.desktop
Source7: firefox.c
Source8: firefox-prefs.js
Patch6: firefox-alt-disable-werror.patch
Patch7: firefox-alt-fix-expandlibs.patch
Patch14: firefox-fix-install.patch
Patch16: firefox-cross-desktop.patch
Patch17: firefox-mediasource-crash.patch
Patch18: firefox-alt-nspr-for-rust.patch
Patch19: build-aarch64-skia.patch
Patch20: bug1375074-save-restore-x28.patch
Patch21: rust-ignore-not-available-documentation.patch
Patch22: firefox-60.7.2-alt-ppc64le-fix-clang-error-invalid-memory-operand.patch
Patch23: firefox-60.7.2-alt-ppc64le-disable-broken-getProcessorLineSize-code.patch
Patch24: firefox-60.7.2-alt-libpng-std=gnu89.patch
# Upstream
Patch200: mozilla-bug-256180.patch
Patch201: mozilla-bug-1196777.patch
Patch202: mozilla-bug-1430274.patch
BuildRequires(pre): mozilla-common-devel
BuildRequires(pre): rpm-build-mozilla.org
BuildRequires(pre): browser-plugins-npapi-devel
BuildRequires(pre): custom-gcc5 custom-gcc5-c++ custom-libstdc++5-devel
#BuildRequires: clang6.0
#BuildRequires: clang6.0-devel
#BuildRequires: llvm6.0-devel
#BuildRequires: lld-devel
BuildRequires: rpm-macros-alternatives
BuildRequires: rust >= %rust_version
BuildRequires: rust-cargo >= %cargo_version
BuildRequires: libXt-devel libX11-devel libXext-devel libXft-devel libXScrnSaver-devel
BuildRequires: libXcursor-devel
BuildRequires: libXi-devel
BuildRequires: libXcomposite-devel
BuildRequires: libXdamage-devel
BuildRequires: libcurl-devel libgtk+2-devel libgtk+3-devel libhunspell-devel libjpeg-devel
BuildRequires: xorg-cf-files chrpath alternatives yasm
BuildRequires: zip unzip
BuildRequires: bzlib-devel zlib-devel
BuildRequires: libcairo-devel libpixman-devel
BuildRequires: libGL-devel
BuildRequires: libwireless-devel
BuildRequires: libalsa-devel
BuildRequires: libnotify-devel
BuildRequires: libevent-devel
BuildRequires: libproxy-devel
BuildRequires: libshell
BuildRequires: libvpx-devel
BuildRequires: libgio-devel
BuildRequires: libfreetype-devel fontconfig-devel
BuildRequires: libstartup-notification-devel
BuildRequires: libffi-devel
BuildRequires: gstreamer%gst_version-devel gst-plugins%gst_version-devel
BuildRequires: libopus-devel
BuildRequires: libpulseaudio-devel
#BuildRequires: libicu-devel
BuildRequires: libdbus-devel libdbus-glib-devel
# Python requires
BuildRequires: python-module-distribute
BuildRequires: python-module-pip
BuildRequires: python-modules-compiler
BuildRequires: python-modules-logging
BuildRequires: python-modules-sqlite3
BuildRequires: python-modules-json
# Rust requires
BuildRequires: /proc
# Mozilla requires
%if_with system_nss
BuildRequires: pkgconfig(nspr) >= %nspr_version
BuildRequires: pkgconfig(nss) >= %nss_version
BuildRequires: libnss-devel-static
%else
BuildRequires: pkgconfig(nspr)
%endif
BuildRequires: autoconf_2.13
%set_autoconf_version 2.13
Obsoletes: firefox-3.6 firefox-4.0 firefox-5.0
Conflicts: firefox-settings-desktop
Provides: webclient
Requires: mozilla-common
# ALT#30732
Requires: gst-plugins-ugly%gst_version
# Require fresh nss for correct https open
%if_with system_nss
Requires: libnss >= %nss_version
%endif
# Fix artefacts in SELinux enforced mode
Requires: devshm-namespaced
%description
The Mozilla Firefox project is a redesign of Mozilla's browser
component, written using the XUL user interface language and designed to
be cross-platform.
%description -l ru_RU.UTF8
Интернет-браузер Mozilla Firefox - кроссплатформенная модификация
браузера Mozilla, созданная с использованием языка XUL для описания
интерфейса пользователя.
%package -n rpm-build-firefox
Summary: RPM helper macros to rebuild firefox packages
Group: Development/Other
BuildArch: noarch
Requires: mozilla-common-devel
Requires: rpm-build-mozilla.org
%description -n rpm-build-firefox
These helper macros provide possibility to rebuild
firefox packages by some Alt Linux Team Policy compatible way.
%prep
%setup -q -n firefox-%version -c
cd mozilla
tar -xf %SOURCE1
tar -xf %SOURCE2
#patch6 -p1
%patch7 -p2
#patch14 -p1
%patch16 -p2
%patch17 -p2
%patch18 -p2
%patch19 -p2 -b .aarch64-skia
#patch20 -p1 -b .bug1375074-save-restore-x28
%patch21 -p1
%patch22 -p2
%patch23 -p2
%patch24 -p2
%patch200 -p1
#patch201 -p1
#patch202 -p1
cp -f %SOURCE4 .mozconfig
%if_without system_nss
subst 's/with-system-nspr/without-system-nspr/' .mozconfig
subst 's/with-system-nss/without-system-nss/' .mozconfig
%endif
%build
cd mozilla
%add_optflags %optflags_shared
%add_findprov_lib_path %firefox_prefix
export MOZ_BUILD_APP=browser
export MOZ_NOSPAM=1
%ifarch x86_64
%define l_arch x86_64
%else
%define l_arch i586
%endif
export RUSTFLAGS="-C link-args=\"$LDFLAGS\" -L %_libdir/gcc/%{l_arch}-alt-linux/5"
MOZ_OPT_FLAGS="-pipe -O2 -g0"
#%ifnarch %{ix86} ppc64le
#MOZ_OPT_FLAGS="$MOZ_OPT_FLAGS -fuse-ld=lld"
#%endif
#MOZ_OPT_FLAGS="$MOZ_OPT_FLAGS \
# -fuse-ld=lld -flto=thin \
# -Wl,--thinlto-jobs=4 -Wl,--thinlto-cache-dir=thinlto-cache -Wl,--thinlto-cache-policy,cache_size=10%% -Wl,--lto-O0"
# PIE, full relro
MOZ_OPT_FLAGS="$MOZ_OPT_FLAGS -DPIC -fPIC -Wl,-z,relro -Wl,-z,now"
%define desired_rpath %firefox_prefix:%_libdir/custom-gcc
# Add fake RPATH
rpath="/$(printf %%s '%desired_rpath' |tr '[:print:]' '_')"
MOZ_OPT_FLAGS="$MOZ_OPT_FLAGS -Wl,-rpath,$rpath"
# Passing rpath through LDFLAGS has the same effects (tested on 60.4.0)
# on all ELFs except for the /usr/bin/firefox small executable.
# So, IMHO, MOZ_OPT_FLAGS is the more reliable way (to avoid library clashes).
#
# To affect the bundled NSS libs (if they are built), previously, the additional
# setting of RPATH env var was needed, but not any more (tested for 60.4.0).
# If MOZ_DEBUG_FLAGS is empty, firefox's build will default it to "-g" which
# overrides the -g0 from line above and breaks building on s390
# (OOM when linking, rhbz#1238225)
export MOZ_DEBUG_FLAGS=" "
export CFLAGS="$MOZ_OPT_FLAGS"
export CXXFLAGS="$MOZ_OPT_FLAGS"
export CC="/usr/bin/gcc-5"
export CXX="/usr/bin/g++-5"
export LIBIDL_CONFIG=/usr/bin/libIDL-config-2
export srcdir="$PWD"
export SHELL=/bin/sh
export RUST_BACKTRACE=1
export LDFLAGS="-Wl,-rpath,%_libdir/custom-gcc"
#export RUSTFLAGS="-С link-args=\"$LDFLAGS\" -L %_libdir/gcc/%{l_arch}-alt-linux/5"
export BUILD_VERBOSE_LOG=1
cat >> .mozconfig <<'EOF'
ac_add_options --prefix="%_prefix"
ac_add_options --libdir="%_libdir"
ac_add_options --disable-stylo
%ifnarch %{ix86} ppc64le
%ifnarch x86_64
ac_add_options --disable-webrtc
%endif
%endif
%ifarch %{ix86} x86_64
ac_add_options --disable-elf-hack
%endif
EOF
export MOZ_MAKE_FLAGS="-j6"
autoconf old-configure.in > old-configure
pushd js/src
autoconf old-configure.in > old-configure
popd
./mach build
$CC $CFLAGS \
-Wall -Wextra \
-DMOZ_PLUGIN_PATH=\"%browser_plugins_path\" \
-DMOZ_PROGRAM=\"%firefox_prefix/firefox\" \
-DMOZ_DIST_BIN=\"%firefox_prefix\"\
%SOURCE7 -o firefox
%install
cd mozilla
export SHELL=/bin/sh
mkdir -p \
%buildroot/%mozilla_arch_extdir/%firefox_cid \
%buildroot/%mozilla_noarch_extdir/%firefox_cid \
#
make -C objdir \
DESTDIR=%buildroot \
INSTALL="/bin/install -p" \
mozappdir=%firefox_prefix \
libdir=%_libdir \
install
# install altlinux-specific configuration
install -D -m 644 %SOURCE8 %buildroot/%firefox_prefix/browser/defaults/preferences/all-altlinux.js
cat > %buildroot/%firefox_prefix/browser/defaults/preferences/firefox-l10n.js <<EOF
pref("intl.locale.matchOS", true);
pref("intl.locale.requested", "");
pref("general.useragent.locale", "chrome://global/locale/intl.properties");
EOF
# icons
for s in 16 22 24 32 48 256; do
install -D -m 644 \
browser/branding/official/default$s.png \
%buildroot/%_iconsdir/hicolor/${s}x${s}/apps/firefox.png
done
# ALT#30572
if [ ! -e "%buildroot/%firefox_prefix/plugins" ]; then
what="$(relative %browser_plugins_path %firefox_prefix/plugins)"
ln -s -- "$what" %buildroot/%firefox_prefix/plugins
fi
# install rpm-build-firefox
mkdir -p -- \
%buildroot/%_rpmmacrosdir
sed \
-e 's,@firefox_version@,%version,' \
-e 's,@firefox_release@,%release,' \
rpm-build/rpm.macros.firefox.standalone > %buildroot/%_rpmmacrosdir/firefox
install -m755 firefox %buildroot/%_bindir/firefox
cd %buildroot
# Add distribution.ini
mkdir -p -- ./%firefox_prefix/distribution
cp -- %SOURCE5 ./%firefox_prefix/distribution/distribution.ini
# install menu file
install -D -m 644 %SOURCE6 ./%_datadir/applications/firefox.desktop
# Add alternatives
mkdir -p ./%_altdir
printf '%_bindir/xbrowser\t%_bindir/firefox\t100\n' >./%_altdir/firefox
rm -f -- \
./%firefox_prefix/removed-files
# Remove devel files
rm -rf -- \
./%_includedir/%name \
./%_datadir/idl/%name \
./%_libdir/%name-devel \
#
# Add real RPATH
rpath="/$(printf %%s '%desired_rpath' |tr '[:print:]' '_')"
find \
%buildroot%_bindir %buildroot%firefox_prefix \
-type f -print0 |
(set +x
while read -r -d '' f; do
t="$(readlink -ev -- "$f")"
file -- "$t" | fgrep -qs ELF || continue
if chrpath -l "$t" | egrep -qs "R(UN)?PATH=$rpath"; then
chrpath -r '%desired_rpath' "$t"
fi
done
)
%pre
for n in defaults browserconfig.properties; do
[ ! -L "%firefox_prefix/$n" ] || rm -f "%firefox_prefix/$n"
done
%files
%_altdir/firefox
%_bindir/firefox
%firefox_prefix
%mozilla_arch_extdir/%firefox_cid
%mozilla_noarch_extdir/%firefox_cid
%_datadir/applications/firefox.desktop
%_iconsdir/hicolor/16x16/apps/firefox.png
%_iconsdir/hicolor/22x22/apps/firefox.png
%_iconsdir/hicolor/24x24/apps/firefox.png
%_iconsdir/hicolor/32x32/apps/firefox.png
%_iconsdir/hicolor/48x48/apps/firefox.png
%_iconsdir/hicolor/256x256/apps/firefox.png
%files -n rpm-build-firefox
%_rpmmacrosdir/firefox
%changelog
* Wed Jul 10 2019 Andrey Cherepanov <cas@altlinux.org> 60.8.0-alt0.M70C.1
- Backport new version with security fixes to c7 branch.
* Tue Jul 09 2019 Andrey Cherepanov <cas@altlinux.org> 60.8.0-alt1
- New ESR version (60.8.0).
- Fixed:
+ CVE-2019-9811 Sandbox escape via installation of malicious language pack
+ CVE-2019-11711 Script injection within domain through inner window reuse
+ CVE-2019-11712 Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects
+ CVE-2019-11713 Use-after-free with HTTP/2 cached stream
+ CVE-2019-11729 Empty or malformed p256-ECDH public keys may trigger a segmentation fault
+ CVE-2019-11715 HTML parsing error can contribute to content XSS
+ CVE-2019-11717 Caret character improperly escaped in origins
+ CVE-2019-11719 Out-of-bounds read when importing curve25519 private key
+ CVE-2019-11730 Same-origin policy treats all files in a directory as having the same-origin
+ CVE-2019-11709 Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8
* Wed Jul 03 2019 Gleb F-Malinovskiy <glebfm@altlinux.org> 60.7.2-alt2
- Added ppc64le support.
- spec: cleaned up rpm-build internal macros.
* Fri Jun 21 2019 Andrey Cherepanov <cas@altlinux.org> 60.7.2-alt0.M70C.1
- Backport new version with security fixes to c7 branch.
* Thu Jun 20 2019 Andrey Cherepanov <cas@altlinux.org> 60.7.2-alt1
- New ESR version (60.7.2).
- Fixed:
+ CVE-2019-11708 sandbox escape using Prompt:Open
* Wed Jun 19 2019 Andrey Cherepanov <cas@altlinux.org> 60.7.1-alt0.M70C.1
- Backport new version with security fixes to c7 branch.
* Tue Jun 18 2019 Andrey Cherepanov <cas@altlinux.org> 60.7.1-alt1
- New ESR version (60.7.1).
- Fixed:
+ CVE-2019-11707 Type confusion in Array.pop
* Sun Jun 16 2019 Andrey Cherepanov <cas@altlinux.org> 60.7.0-alt2
- Fix build with Rust > 1.33.
* Wed May 22 2019 Andrey Cherepanov <cas@altlinux.org> 60.7.0-alt0.M70C.1
- Backport new version with security fixes to c7 branch.
* Tue May 21 2019 Andrey Cherepanov <cas@altlinux.org> 60.7.0-alt1
- New ESR version (60.7.0).
- Fixed:
+ CVE-2019-9815 Disable hyperthreading on content JavaScript threads on macOS
+ CVE-2019-9816 Type confusion with object groups and UnboxedObjects
+ CVE-2019-9817 Stealing of cross-domain images using canvas
+ CVE-2019-9818 Use-after-free in crash generation server
+ CVE-2019-9819 Compartment mismatch with fetch API
+ CVE-2019-9820 Use-after-free of ChromeEventHandler by DocShell
+ CVE-2019-11691 Use-after-free in XMLHttpRequest
+ CVE-2019-11692 Use-after-free removing listeners in the event listener manager
+ CVE-2019-11693 Buffer overflow in WebGL bufferdata on Linux
+ CVE-2019-7317 Use-after-free in png_image_free of libpng library
+ CVE-2019-9797 Cross-origin theft of images with createImageBitmap
+ CVE-2018-18511 Cross-origin theft of images with ImageBitmapRenderingContext
+ CVE-2019-11694 Uninitialized memory memory leakage in Windows sandbox
+ CVE-2019-11698 Theft of user history data through drag and drop of hyperlinks to and from bookmarks
+ CVE-2019-5798 Out-of-bounds read in Skia
+ CVE-2019-9800 Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7
* Sun May 05 2019 Andrey Cherepanov <cas@altlinux.org> 60.6.2-alt1
- New ESR version (60.6.2).
- Hotfix for addon signing cert has not been applied.
* Sat Mar 23 2019 Andrey Cherepanov <cas@altlinux.org> 60.6.1-alt0.M70C.1
- Backport new version with security fixes to c7 branch.
* Sat Mar 23 2019 Andrey Cherepanov <cas@altlinux.org> 60.6.1-alt1
- New ESR version (60.6.1).
- Fixed:
+ CVE-2019-9810 IonMonkey MArraySlice has incorrect alias information
+ CVE-2019-9813 Ionmonkey type confusion with __proto__ mutations
* Thu Mar 21 2019 Andrey Cherepanov <cas@altlinux.org> 60.6.0-alt1
- New ESR version (60.6.0).
- Fixed:
+ CVE-2019-9790 Use-after-free when removing in-use DOM elements
+ CVE-2019-9791 Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey
+ CVE-2019-9792 IonMonkey leaks JS_OPTIMIZED_OUT magic value to script
+ CVE-2019-9793 Improper bounds checks when Spectre mitigations are disabled
+ CVE-2019-9794 Command line arguments not discarded during execution
+ CVE-2019-9795 Type-confusion in IonMonkey JIT compiler
+ CVE-2019-9796 Use-after-free with SMIL animation controller
+ CVE-2019-9801 Windows programs that are not 'URL Handlers' are exposed to web content
+ CVE-2018-18506 Proxy Auto-Configuration file can define localhost access to be proxied
+ CVE-2019-9788 Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6
* Wed Feb 27 2019 Andrey Cherepanov <cas@altlinux.org> 60.5.2-alt1.1
- Rebuild vith libvpx5.
* Sat Feb 23 2019 Andrey Cherepanov <cas@altlinux.org> 60.5.2-alt1
- New ESR version (60.5.2).
* Sat Feb 16 2019 Andrey Cherepanov <cas@altlinux.org> 60.5.1-alt0.M70C.1
- Backport new version with security fixes to c7 branch.
* Fri Feb 15 2019 Andrey Cherepanov <cas@altlinux.org> 60.5.1-alt1
- New ESR version (60.5.1).
- Fixed:
+ CVE-2018-18356 Use-after-free in Skia
+ CVE-2019-5785 Integer overflow in Skia
+ CVE-2018-18335 Buffer overflow in Skia with accelerated Canvas 2D
* Mon Feb 04 2019 Andrey Cherepanov <cas@altlinux.org> 60.5.0-alt0.M70C.1
- Backport new version with security fixes to c7 branch.
* Fri Feb 01 2019 Andrey Cherepanov <cas@altlinux.org> 60.5.0-alt1
- New ESR version (60.5.0).
- Fixed:
+ CVE-2018-18500 Use-after-free parsing HTML5 stream
+ CVE-2018-18505 Privilege escalation through IPC channel messages
+ CVE-2018-18501 Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5
* Thu Dec 13 2018 Andrey Cherepanov <cas@altlinux.org> 60.4.0-alt0.M70C.1
- Backport new version with security fixes to c7 branch (thank imz@).
* Tue Dec 11 2018 Andrey Cherepanov <cas@altlinux.org> 60.4.0-alt1
- New ESR version (60.4.0)
- Fixed:
+ CVE-2018-17466 Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11
+ CVE-2018-18492 Use-after-free with select element
+ CVE-2018-18493 Buffer overflow in accelerated 2D canvas with Skia
+ CVE-2018-18494 Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs
+ CVE-2018-18498 Integer overflow when calculating buffer sizes for images
+ CVE-2018-12405 Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4
* Fri Nov 30 2018 Andrey Cherepanov <cas@altlinux.org> 60.3.0-alt0.M70C.1
- Backport new version with security fixes to c7 branch.
* Tue Oct 23 2018 Andrey Cherepanov <cas@altlinux.org> 60.3.0-alt1
- New ESR version (60.3.0).
- Fixed:
+ CVE-2018-12391 HTTP Live Stream audio data is accessible cross-origin
+ CVE-2018-12392 Crash with nested event loops
+ CVE-2018-12393 Integer overflow during Unicode conversion while loading JavaScript
+ CVE-2018-12395 WebExtension bypass of domain restrictions through header rewriting
+ CVE-2018-12396 WebExtension content scripts can execute in disallowed contexts
+ CVE-2018-12397 WebExtension can request access to local files without the warning prompt
+ CVE-2018-12389 Memory safety bugs fixed in Firefox ESR 60.3
+ CVE-2018-12390 Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3
* Fri Oct 19 2018 Andrey Cherepanov <cas@altlinux.org> 60.2.2-alt0.M70C.1
- Backport new version with security fixes to c7 branch.
- Build with bundled NSS.
* Tue Oct 02 2018 Andrey Cherepanov <cas@altlinux.org> 60.2.2-alt1
- New ESR version (60.2.2)
- Fixed:
+ CVE-2018-12386 Type confusion in JavaScript
+ CVE-2018-12387 JavaScript JIT compiler inlines Array.prototype.push with multiple arguments
* Tue Sep 25 2018 Andrey Cherepanov <cas@altlinux.org> 60.2.1-alt0.M80C.1
- Backport new version with security fixes to c8 branch.
* Mon Sep 24 2018 Andrey Cherepanov <cas@altlinux.org> 60.2.1-alt1
- New ESR version (60.2.1).
- Fixed:
+ CVE-2018-12385 Crash in TransportSecurityInfo due to cached data
+ CVE-2018-12383 Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords
* Wed Sep 12 2018 Andrey Cherepanov <cas@altlinux.org> 60.2.0-alt0.M80C.1
- Backport new version with security fixes to c8 branch.
* Mon Sep 10 2018 Andrey Cherepanov <cas@altlinux.org> 60.2.0-alt1
- New ESR version (60.2.0).
- Fixed:
+ CVE-2018-12377 Use-after-free in refresh driver timers
+ CVE-2018-12378 Use-after-free in IndexedDB
+ CVE-2018-12379 Out-of-bounds write with malicious MAR file
+ CVE-2017-16541 Proxy bypass using automount and autofs
+ CVE-2018-12381 Dragging and dropping Outlook email message results in page navigation
+ CVE-2018-12376 Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2
* Tue Jun 26 2018 Andrey Cherepanov <cas@altlinux.org> 60.1.0-alt1
- New ESR version (60.1.0).
- Fixed:
+ CVE-2018-12359 Buffer overflow using computed size of canvas element
+ CVE-2018-12360 Use-after-free when using focus()
+ CVE-2018-12361 Integer overflow in SwizzleData
+ CVE-2018-12362 Integer overflow in SSSE3 scaler
+ CVE-2018-5156 Media recorder segmentation fault when track type is changed during capture
+ CVE-2018-12363 Use-after-free when appending DOM nodes
+ CVE-2018-12364 CSRF attacks through 307 redirects and NPAPI plugins
+ CVE-2018-12365 Compromised IPC child process can list local filenames
+ CVE-2018-12371 Integer overflow in Skia library during edge builder allocation
+ CVE-2018-12366 Invalid data handling during QCMS transformations
+ CVE-2018-12367 Timing attack mitigation of PerformanceNavigationTiming
+ CVE-2018-12368 No warning when opening executable SettingContent-ms files
+ CVE-2018-12369 WebExtension security permission checks bypassed by embedded experiments
+ CVE-2018-5187 Memory safety bugs fixed in Firefox 60 and Firefox ESR 60.1
+ CVE-2018-5188 Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9
* Mon Jun 18 2018 Andrey Cherepanov <cas@altlinux.org> 60.0.2-alt2
- Fix build for aarch64 (thanks legion@).
* Mon Jun 11 2018 Andrey Cherepanov <cas@altlinux.org> 60.0.2-alt1
- New ESR version (60.0.2).
- Fixed:
+ CVE-2018-6126 Heap buffer overflow rasterizing paths in SVG with Skia
* Tue Jun 05 2018 Andrey Cherepanov <cas@altlinux.org> 60.0.1-alt1
- New ESR version (60.0.1).
- Fixed:
+ CVE-2018-5154: Use-after-free with SVG animations and clip paths
+ CVE-2018-5155: Use-after-free with SVG animations and text paths
+ CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files
+ CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer
+ CVE-2018-5159: Integer overflow and out-of-bounds write in Skia
+ CVE-2018-5160: Uninitialized memory use by WebRTC encoder
+ CVE-2018-5152: WebExtensions information leak through webRequest API
+ CVE-2018-5153: Out-of-bounds read in mixed content websocket messages
+ CVE-2018-5163: Replacing cached data in JavaScript Start-up Bytecode Cache
+ CVE-2018-5164: CSP not applied to all multipart content sent with multipart/x-mixed-replace
+ CVE-2018-5166: WebExtension host permission bypass through filterReponseData
+ CVE-2018-5167: Improper linkification of chrome: and javascript: content in web console and JavaScript debugger
+ CVE-2018-5168: Lightweight themes can be installed without user interaction
+ CVE-2018-5169: Dragging and dropping link text onto home button can set home page to include chrome pages
+ CVE-2018-5172: Pasted script from clipboard can run in the Live Bookmarks page or PDF viewer
+ CVE-2018-5173: File name spoofing of Downloads panel with Unicode characters
+ CVE-2018-5174: Windows Defender SmartScreen UI runs with less secure behavior for downloaded files in Windows 10 April 2018 Update
+ CVE-2018-5175: Universal CSP bypass on sites using strict-dynamic in their policies
+ CVE-2018-5176: JSON Viewer script injection
+ CVE-2018-5177: Buffer overflow in XSLT during number formatting
+ CVE-2018-5165: Checkbox for enabling Flash protected mode is inverted in 32-bit Firefox
+ CVE-2018-5180: heap-use-after-free in mozilla::WebGLContext::DrawElementsInstanced
+ CVE-2018-5181: Local file can be displayed in noopener tab through drag and drop of hyperlink
+ CVE-2018-5182: Local file can be displayed from hyperlink dragged and dropped on addressbar
+ CVE-2018-5151: Memory safety bugs fixed in Firefox 60
+ CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8
* Mon May 14 2018 Alexey Appolonov <alexey@altlinux.org> 52.8.0-alt0.M70C.1
- Backport new version of firefox-esr from c8.1 branch
as firefox to c7 branch.
* Thu May 10 2018 Andrey Cherepanov <cas@altlinux.org> 52.8.0-alt0.M80C.1
- Backport new version with security fixes to c8 branch
* Wed May 09 2018 Andrey Cherepanov <cas@altlinux.org> 52.8.0-alt1
- New ESR version (52.8.0).
- Fixes:
+ CVE-2018-5183 Backport critical security fixes in Skia
+ CVE-2018-5154 Use-after-free with SVG animations and clip paths
+ CVE-2018-5155 Use-after-free with SVG animations and text paths
+ CVE-2018-5157 Same-origin bypass of PDF Viewer to view protected PDF files
+ CVE-2018-5158 Malicious PDF can inject JavaScript into PDF Viewer
+ CVE-2018-5159 Integer overflow and out-of-bounds write in Skia
+ CVE-2018-5168 Lightweight themes can be installed without user interaction
+ CVE-2018-5178 Buffer overflow during UTF-8 to Unicode string conversion through legacy extension
+ CVE-2018-5150 Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8
* Wed May 02 2018 Andrey Cherepanov <cas@altlinux.org> 52.7.4-alt1
- New ESR version (52.7.4).
* Tue Apr 03 2018 Alexey Appolonov <alexey@altlinux.org> 52.7.3-alt0.M70C.1
- Backport new version of firefox-esr from c8 branch
as firefox to c7 branch.
* Mon Mar 26 2018 Andrey Cherepanov <cas@altlinux.org> 52.7.3-alt0.M80C.1
- Backport new version with security fixes to c8 branch
* Mon Mar 26 2018 Andrey Cherepanov <cas@altlinux.org> 52.7.3-alt1
- New ESR version (52.7.3)
- Fixes:
+ CVE-2018-5148 Use-after-free in compositor
* Mon Mar 19 2018 Alexey Appolonov <alexey@altlinux.org> 52.7.0-alt0.M70C.1
- Backport new version of firefox-esr from c8.1 branch
as firefox to c7 branch.
* Fri Mar 16 2018 Andrey Cherepanov <cas@altlinux.org> 52.7.2-alt1
- New ESR version (52.7.2)
* Thu Mar 15 2018 Andrey Cherepanov <cas@altlinux.org> 52.7.1-alt1
- New ESR version (52.7.1)
* Wed Mar 14 2018 Andrey Cherepanov <cas@altlinux.org> 52.7.0-alt0.M80C.1
- Backport new version with security fixes to c8 branch
* Sat Mar 10 2018 Andrey Cherepanov <cas@altlinux.org> 52.7.0-alt1
- New ESR version (52.7.0).
- Fixes:
+ CVE-2018-5127 Buffer overflow manipulating SVG animatedPathSegList
+ CVE-2018-5129 Out-of-bounds write with malformed IPC messages
+ CVE-2018-5130 Mismatched RTP payload type can trigger memory corruption
+ CVE-2018-5131 Fetch API improperly returns cached copies of no-store/no-cache resources
+ CVE-2018-5144 Integer overflow during Unicode conversion
+ CVE-2018-5125 Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7
+ CVE-2018-5145 Memory safety bugs fixed in Firefox ESR 52.7
* Mon Mar 05 2018 Andrey Cherepanov <cas@altlinux.org> 52.6.0-alt2
- Enable ALSA support (ALT #34608)
* Thu Feb 27 2018 Alexey Appolonov <alexey@altlinux.org> 52.6.0-alt0.M70C.1
- Backport new version of firefox-esr from c8.1 branch
as firefox to c7 branch.
* Wed Feb 07 2018 Andrey Cherepanov <cas@altlinux.org> 52.6.0-alt0.M80C.2
- Rebuild for put CVEs in spec changelog
* Thu Feb 01 2018 Alexey Appolonov <alexey@altlinux.org> 52.5.3-alt0.M70C.1
- Backport new version to c7 branch.
* Wed Jan 24 2018 Andrey Cherepanov <cas@altlinux.org> 52.6.0-alt0.M80C.1
- Backport new version to c8 branch
* Mon Jan 22 2018 Andrey Cherepanov <cas@altlinux.org> 52.6.0-alt1
- New ESR version (52.6.0)
- Fixes:
+ CVE-2018-5095 Integer overflow in Skia library during edge builder allocation
+ CVE-2018-5096 Use-after-free while editing form elements
+ CVE-2018-5097 Use-after-free when source document is manipulated during XSLT
+ CVE-2018-5098 Use-after-free while manipulating form input elements
+ CVE-2018-5099 Use-after-free with widget listener
+ CVE-2018-5102 Use-after-free in HTML media elements
+ CVE-2018-5103 Use-after-free during mouse event handling
+ CVE-2018-5104 Use-after-free during font face manipulation
+ CVE-2018-5117 URL spoofing with right-to-left text aligned left-to-right
+ CVE-2018-5089 Memory safety bugs fixed in Firefox 58 and Firefox ESR 52.6
- Continue fix of Speculative execution side-channel attack ("Spectre")
* Fri Jan 12 2018 Andrey Cherepanov <cas@altlinux.org> 52.5.3-alt0.M80C.1
- Backport new version to c8 branch
* Wed Jan 10 2018 Andrey Cherepanov <cas@altlinux.org> 52.5.3-alt1
- New ESR version (52.5.3)
- Fixes:
+ Speculative execution side-channel attack ("Spectre")
* Tue Dec 19 2017 Andrey Cherepanov <cas@altlinux.org> 52.5.2-alt0.M80C.1
- Backport new version to c8 branch
* Sun Dec 10 2017 Andrey Cherepanov <cas@altlinux.org> 52.5.2-alt1
- New ESR version (52.5.2)
- Fixes:
+ CVE-2017-7843 Web worker in Private Browsing mode can write IndexedDB data
- Build with DBUS support (ALT #34302)
* Wed Nov 15 2017 Andrey Cherepanov <cas@altlinux.org> 52.5.0-alt1
- New ESR version (52.5.0)
- Fixes:
+ CVE-2017-7828 Use-after-free of PressShell while restyling layout
+ CVE-2017-7830 Cross-origin URL information leak through Resource
+ CVE-2017-7826 Memory safety bugs fixed in Firefox 57 and Firefox ESR
* Wed Oct 04 2017 Andrey Cherepanov <cas@altlinux.org> 52.4.0-alt0.M80C.1
- Backport new version to c8 branch
* Fri Sep 29 2017 Andrey Cherepanov <cas@altlinux.org> 52.4.0-alt1
- New ESR version (52.4.0)
- Fixes:
+ CVE-2017-7793 Use-after-free with Fetch API
+ CVE-2017-7818 Use-after-free during ARIA array manipulation
+ CVE-2017-7819 Use-after-free while resizing images in design mode
+ CVE-2017-7824 Buffer overflow when drawing and validating elements with ANGLE
+ CVE-2017-7805 Use-after-free in TLS 1.2 generating handshake hashes
+ CVE-2017-7814 Blob and data URLs bypass phishing and malware protection warnings
+ CVE-2017-7825 OS X fonts render some Tibetan and Arabic unicode characters as spaces
+ CVE-2017-7823 CSP sandbox directive did not create a unique origin
+ CVE-2017-7810 Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4
* Tue Sep 19 2017 Andrey Cherepanov <cas@altlinux.org> 52.3.0-alt0.M80C.1
- Backport new version to c8 branch
* Tue Aug 08 2017 Andrey Cherepanov <cas@altlinux.org> 52.3.0-alt1
- New ESR version (52.3.0)
- Security fixes:
+ CVE-2017-7798: XUL injection in the style editor in devtools
+ CVE-2017-7800: Use-after-free in WebSockets during disconnection
+ CVE-2017-7801: Use-after-free with marquee during window resizing
+ CVE-2017-7809: Use-after-free while deleting attached editor DOM node
+ CVE-2017-7784: Use-after-free with image observers
+ CVE-2017-7802: Use-after-free resizing image elements
+ CVE-2017-7785: Buffer overflow manipulating ARIA attributes in DOM
+ CVE-2017-7786: Buffer overflow while painting non-displayable SVG
+ CVE-2017-7806: Use-after-free in layer manager with SVG
+ CVE-2017-7753: Out-of-bounds read with cached style data and pseudo-elements
+ CVE-2017-7787: Same-origin policy bypass with iframes through page reloads
+ CVE-2017-7807: Domain hijacking through AppCache fallback
+ CVE-2017-7792: Buffer overflow viewing certificates with an extremely long OID
+ CVE-2017-7804: Memory protection bypass through WindowsDllDetourPatcher
+ CVE-2017-7791: Spoofing following page navigation with data: protocol and modal alerts
+ CVE-2017-7782: WindowsDllDetourPatcher allocates memory without DEP protections
+ CVE-2017-7803: CSP containing 'sandbox' improperly applied
+ CVE-2017-7779: Memory safety bugs fixed in Firefox 55 and Firefox ESR 52.3
* Tue Jul 11 2017 Andrey Cherepanov <cas@altlinux.org> 52.2.1-alt1
- New ESR version (52.2.1)
* Wed Jun 21 2017 Andrey Cherepanov <cas@altlinux.org> 52.2.0-alt1
- New ESR version (52.2.0)
- Security fixes:
+ CVE-2017-5472: Use-after-free using destroyed node when regenerating trees
+ CVE-2017-7749: Use-after-free during docshell reloading
+ CVE-2017-7750: Use-after-free with track elements
+ CVE-2017-7751: Use-after-free with content viewer listeners
+ CVE-2017-7752: Use-after-free with IME input
+ CVE-2017-7754: Out-of-bounds read in WebGL with ImageInfo object
+ CVE-2017-7755: Privilege escalation through Firefox Installer with same directory DLL files
+ CVE-2017-7756: Use-after-free and use-after-scope logging XHR header errors
+ CVE-2017-7757: Use-after-free in IndexedDB
+ CVE-2017-7778: Vulnerabilities in the Graphite 2 library
+ CVE-2017-7758: Out-of-bounds read in Opus encoder
+ CVE-2017-7760: File manipulation and privilege escalation via callback parameter in Mozilla Windows Updater and Maintenance Service
+ CVE-2017-7761: File deletion and privilege escalation through Mozilla Maintenance Service helper.exe application
+ CVE-2017-7763: Mac fonts render some unicode characters as spaces
+ CVE-2017-7764: Domain spoofing with combination of Canadian Syllabics and other unicode blocks
+ CVE-2017-7765: Mark of the Web bypass when saving executable files
+ CVE-2017-7766: File execution and privilege escalation through updater.ini, Mozilla Windows Updater, and Mozilla Maintenance Service
+ CVE-2017-7767: Privilege escalation and arbitrary file overwrites through Mozilla Windows Updater and Mozilla Maintenance Service
+ CVE-2017-7768: 32 byte arbitrary file read through Mozilla Maintenance Service
+ CVE-2017-5470: Memory safety bugs fixed in Firefox 54 and Firefox ESR 52.2
* Thu May 18 2017 Andrey Cherepanov <cas@altlinux.org> 45.9.0-alt0.M70C.1
- New ESR version
- Security fixes:
+ CVE-2017-5429: Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9,
+ CVE-2017-5462: DRBG flaw in NSS
+ CVE-2017-5445: Uninitialized values used while parsing
+ CVE-2017-5469: Potential Buffer overflow in flex-generated code
+ CVE-2017-5437: Vulnerabilities in Libevent library
+ CVE-2017-5448: Out-of-bounds write in ClearKeyDecryptor
+ CVE-2017-5465: Out-of-bounds read in ConvolvePixel
+ CVE-2017-5447: Out-of-bounds read during glyph processing
+ CVE-2017-5446: Out-of-bounds read when HTTP/2 DATA frames are sent with
+ CVE-2017-5444: Buffer overflow while parsing application/http-index-format
+ CVE-2017-5443: Out-of-bounds write during BinHex decoding
+ CVE-2017-5464: Memory corruption with accessibility and DOM manipulation
+ CVE-2017-5442: Use-after-free during style changes
+ CVE-2017-5441: Use-after-free with selection during scroll events
+ CVE-2017-5440: Use-after-free in txExecutionState destructor during XSLT
+ CVE-2017-5439: Use-after-free in nsTArray Length() during XSLT processing
+ CVE-2017-5438: Use-after-free in nsAutoPtr during XSLT processing
+ CVE-2017-5460: Use-after-free in frame selection
+ CVE-2017-5432: Use-after-free in text input selection
+ CVE-2017-5434: Use-after-free during focus handling
+ CVE-2017-5459: Buffer overflow in WebGL
+ CVE-2017-5461: Out-of-bounds write in Base64 encoding in NSS
+ CVE-2017-5436: Out-of-bounds write with malicious font in Graphite 2
+ CVE-2017-5435: Use-after-free during transaction processing in the editor
+ CVE-2017-5433: Use-after-free in SMIL animation functions
* Wed May 10 2017 Andrey Cherepanov <cas@altlinux.org> 52.1.1-alt0.M80P.1
- Backport new version to p8 branch
* Mon May 08 2017 Andrey Cherepanov <cas@altlinux.org> 52.1.1-alt1
- New ESR version (52.1.1)
- Set plugin.load_flash_only setting to false to allow use all NPAPI plugins
- Security fixes since 52.0:
+ CVE-2016-10196: Vulnerabilities in Libevent library
+ CVE-2017-5031: Use after free in ANGLE
+ CVE-2017-5428: integer overflow in createImageBitmap()
+ CVE-2017-5429: Memory safety bugs fixed in Firefox 53, Firefox ESR
+ CVE-2017-5430: Memory safety bugs fixed in Firefox 53 and Firefox ESR
+ CVE-2017-5435: Use-after-free during transaction processing in the
+ CVE-2017-5439: Use-after-free in nsTArray Length() during XSLT
+ CVE-2017-5440: Use-after-free in txExecutionState destructor during
+ CVE-2017-5444: Buffer overflow while parsing
+ CVE-2017-5446: Out-of-bounds read when HTTP/2 DATA frames are sent
+ CVE-2017-5451: Addressbar spoofing with onblur event
+ CVE-2017-5454: Sandbox escape allowing file system read access through
+ CVE-2017-5455: Sandbox escape through internal feed reader APIs
+ CVE-2017-5456: Sandbox escape allowing local file system access
+ CVE-2017-5464: Memory corruption with accessibility and DOM
+ CVE-2017-5466: Origin confusion when reloading isolated data:text/html
+ CVE-2017-5467: Memory corruption when drawing Skia content
* Mon May 08 2017 Andrey Cherepanov <cas@altlinux.org> 52.0-alt1
- New release (52.0) based on legion@ build.
- Built with internal icu.
- Fixed:
+ CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP
+ CVE-2017-5401: Memory Corruption when handling ErrorResult
+ CVE-2017-5402: Use-after-free working with events in FontFace objects
+ CVE-2017-5403: Use-after-free using addRange to add range to an incorrect root object
+ CVE-2017-5404: Use-after-free working with ranges in selections
+ CVE-2017-5406: Segmentation fault in Skia with canvas operations
+ CVE-2017-5407: Pixel and history stealing via floating-point timing side channel with SVG filters
+ CVE-2017-5410: Memory corruption during JavaScript garbage collection incremental sweeping
+ CVE-2017-5411: Use-after-free in Buffer Storage in libGLES
+ CVE-2017-5409: File deletion via callback parameter in Mozilla Windows Updater and Maintenance Service
+ CVE-2017-5408: Cross-origin reading of video captions in violation of CORS
+ CVE-2017-5412: Buffer overflow read in SVG filters
+ CVE-2017-5413: Segmentation fault during bidirectional operations
+ CVE-2017-5414: File picker can choose incorrect default directory
+ CVE-2017-5415: Addressbar spoofing through blob URL
+ CVE-2017-5416: Null dereference crash in HttpChannel
+ CVE-2017-5417: Addressbar spoofing by draging and dropping URLs
+ CVE-2017-5425: Overly permissive Gecko Media Plugin sandbox regular expression access
+ CVE-2017-5426: Gecko Media Plugin sandbox is not started if seccomp-bpf filter is running
+ CVE-2017-5427: Non-existent chrome.manifest file loaded during startup
+ CVE-2017-5418: Out of bounds read when parsing HTTP digest authorization responses
+ CVE-2017-5419: Repeated authentication prompts lead to DOS attack
+ CVE-2017-5420: Javascript: URLs can obfuscate addressbar location
+ CVE-2017-5405: FTP response codes can cause use of uninitialized values for ports
+ CVE-2017-5421: Print preview spoofing
+ CVE-2017-5422: DOS attack by using view-source: protocol repeatedly in one hyperlink
+ CVE-2017-5399: Memory safety bugs fixed in Firefox 52
+ CVE-2017-5398: Memory safety bugs fixed in Firefox 52 and Firefox ESR 45.8
* Thu Apr 27 2017 Andrey Cherepanov <cas@altlinux.org> 45.9.0-alt0.M80P.1
- Backport new version to p8 branch
* Thu Mar 09 2017 Andrey Cherepanov <cas@altlinux.org> 45.8.0-alt0.M70C.1
- Backport new ESR version to c7 branch
* Tue Mar 07 2017 Andrey Cherepanov <cas@altlinux.org> 45.8.0-alt0.M80P.1
- Backport new version to p8 branch
* Tue Mar 07 2017 Andrey Cherepanov <cas@altlinux.org> 45.8.0-alt1
- New ESR version
- Require fresh libnss for correct https open
* Fri Jan 27 2017 Andrey Cherepanov <cas@altlinux.org> 45.7.0-alt0.M70C.1
- Backport new version to c7 branch
* Thu Jan 26 2017 Andrey Cherepanov <cas@altlinux.org> 45.7.0-alt0.M80P.1
- Backport new version to p8 branch
* Wed Jan 25 2017 Andrey Cherepanov <cas@altlinux.org> 45.7.0-alt1
- New ESR version
* Fri Jan 20 2017 Andrey Cherepanov <cas@altlinux.org> 45.6.0-alt2
- Fix build with GCC 6.1
* Sat Dec 17 2016 Andrey Cherepanov <cas@altlinux.org> 45.6.0-alt0.M70C.1
- Backport new version to c7 branch
* Sat Dec 17 2016 Andrey Cherepanov <cas@altlinux.org> 45.6.0-alt0.M80P.1
- Backport new version to p8 branch
* Fri Dec 16 2016 Andrey Cherepanov <cas@altlinux.org> 45.6.0-alt1
- New ESR version
* Fri Dec 9 2016 Ivan Zakharyaschev <imz@altlinux.org> 45.5.1-alt1.M80P.1
- Build for p8.
- Correct version in Provides: firefox.
* Tue Dec 6 2016 Ivan Zakharyaschev <imz@altlinux.org> 45.5.1-alt2
- Make it pass strict verification of unresolved ELF symbols; this will also
protect us from missing dependencies on libgtk symbols. (Thx legion@ for
the original hack, removed in 44.0.2-alt3, but found to be restorable by
ruslandh@'s work on strict unresolved symbols verification in palemoon.)
* Thu Dec 01 2016 Andrey Cherepanov <cas@altlinux.org> 45.5.1-alt0.M70C.1
- Backport new version to c7 branch
* Thu Dec 01 2016 Andrey Cherepanov <cas@altlinux.org> 45.5.1-alt0.M80P.1
- Backport new version to p8 branch
* Thu Dec 01 2016 Andrey Cherepanov <cas@altlinux.org> 45.5.1-alt1
- New ESR version
- Security fixes:
+ MFSA 2016-92 Firefox SVG Animation Remote Code Execution
* Tue Nov 22 2016 Andrey Cherepanov <cas@altlinux.org> 45.5.0-alt0.M70C.1
- Backport new version to c7 branch
* Thu Nov 17 2016 Andrey Cherepanov <cas@altlinux.org> 45.5.0-alt0.M80P.1
- Backport new version to p8 branch
* Thu Nov 17 2016 Andrey Cherepanov <cas@altlinux.org> 45.5.0-alt1
- New ESR version
* Thu Sep 22 2016 Andrey Cherepanov <cas@altlinux.org> 45.4.0-alt0.M70C.1
- Backport new version to c7 branch
* Tue Sep 20 2016 Andrey Cherepanov <cas@altlinux.org> 45.4.0-alt0.M80P.1
- Backport new version to p8 branch
* Tue Sep 20 2016 Andrey Cherepanov <cas@altlinux.org> 45.4.0-alt1
- New ESR version
* Wed Aug 24 2016 Andrey Cherepanov <cas@altlinux.org> 45.3.0-alt0.M70C.1
- Backport new version to c7 branch
* Wed Aug 24 2016 Andrey Cherepanov <cas@altlinux.org> 45.3.0-alt0.M70P.1
- Backport new version to p7 branch
* Tue Aug 02 2016 Andrey Cherepanov <cas@altlinux.org> 45.3.0-alt1
- New ESR version
- Security fixes:
+ MFSA 2016-80 Same-origin policy violation using local HTML file and saved shortcut file
+ MFSA 2016-79 Use-after-free when applying SVG effects
+ MFSA 2016-78 Type confusion in display transformation
+ MFSA 2016-77 Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback
+ MFSA 2016-76 Scripts on marquee tag can execute in sandboxed iframes
+ MFSA 2016-73 Use-after-free in service workers with nested sync events
+ MFSA 2016-72 Use-after-free in DTLS during WebRTC session shutdown
+ MFSA 2016-70 Use-after-free when using alt key and toplevel menus
+ MFSA 2016-67 Stack underflow during 2D graphics rendering
+ MFSA 2016-65 Cairo rendering crash due to memory allocation issue with FFmpeg 0.10
+ MFSA 2016-64 Buffer overflow rendering SVG with bidirectional content
+ MFSA 2016-63 Favicon network connection can persist when page is closed
* Sun Jun 12 2016 Andrey Cherepanov <cas@altlinux.org> 45.2.0-alt0.M70P.1
- Backport new version to p7 branch
* Sun Jun 12 2016 Andrey Cherepanov <cas@altlinux.org> 45.2.0-alt1
- New ESR version
- Security fixes:
+ MFSA 2016-58 Entering fullscreen and persistent pointerlock without user permission
+ MFSA 2016-56 Use-after-free when textures are used in WebGL operations after recycle pool destruction
+ MFSA 2016-55 File overwrite and privilege escalation through Mozilla Windows updater
+ MFSA 2016-53 Out-of-bounds write with WebGL shader
+ MFSA 2016-52 Addressbar spoofing though the SELECT element
+ MFSA 2016-51 Use-after-free deleting tables from a contenteditable document
+ MFSA 2016-50 Buffer overflow parsing HTML5 fragments
* Tue Mar 15 2016 Andrey Cherepanov <cas@altlinux.org> 38.7.0-alt0.M70P.1
- Backport new version to p7 branch
* Wed Mar 09 2016 Andrey Cherepanov <cas@altlinux.org> 38.7.0-alt1
- New ESR version
- Security fixes:
+ MFSA 2016-37 Font vulnerabilities in the Graphite 2 library
+ MFSA 2016-35 Buffer overflow during ASN.1 decoding in NSS
+ MFSA 2016-34 Out-of-bounds read in HTML parser following a failed allocation
+ MFSA 2016-31 Memory corruption with malicious NPAPI plugin
+ MFSA 2016-28 Addressbar spoofing though history navigation and Location protocol property
+ MFSA 2016-27 Use-after-free during XML transformations
+ MFSA 2016-25 Use-after-free when using multiple WebRTC data channels
+ MFSA 2016-24 Use-after-free in SetBody
+ MFSA 2016-23 Use-after-free in HTML5 string parser
+ MFSA 2016-21 Displayed page address can be overridden
+ MFSA 2016-20 Memory leak in libstagefright when deleting an array during MP4 processing
+ MFSA 2016-17 Local file overwriting and potential privilege escalation through CSP reports
+ MFSA 2016-16 Miscellaneous memory safety hazards
+ MFSA 2015-136 Same-origin policy violation using performance.getEntries and history navigation
+ MFSA 2015-81 Use-after-free in MediaStream playback
* Sat Feb 13 2016 Andrey Cherepanov <cas@altlinux.org> 38.6.1-alt0.M70P.1
- Backport new version to p7 branch
* Fri Feb 12 2016 Andrey Cherepanov <cas@altlinux.org> 38.6.1-alt1
- New ESR version
- Security fixes:
+ MFSA 2016-14 Vulnerabilities in Graphite 2
* Sat Jan 30 2016 Andrey Cherepanov <cas@altlinux.org> 38.6.0-alt0.M70P.1
- Backport new version to p7 branch
* Thu Jan 28 2016 Andrey Cherepanov <cas@altlinux.org> 38.6.0-alt1
- New ESR version
- Security fixes:
+ MFSA 2016-03 Buffer overflow in WebGL after out of memory allocation
+ MFSA 2016-01 Miscellaneous memory safety hazards (rv:44.0 / rv:38.6)
+ MFSA 2015-150 MD5 signatures accepted within TLS 1.2 ServerKeyExchange in server signature
* Mon Dec 28 2015 Andrey Cherepanov <cas@altlinux.org> 38.5.2-alt0.M70P.1
- Backport new version to p7 branch
* Sat Dec 26 2015 Andrey Cherepanov <cas@altlinux.org> 38.5.2-alt1
- New ESR version
- Security fixes:
+ MFSA 2015-150 MD5 signatures accepted within TLS 1.2 ServerKeyExchange in server signature
* Wed Dec 02 2015 Andrey Cherepanov <cas@altlinux.org> 38.4.0-alt0.M70P.1
- Backport new version to p7 branch
* Wed Nov 04 2015 Andrey Cherepanov <cas@altlinux.org> 38.4.0-alt1
- New ESR version
- Security fixes:
+ MFSA 2015-133 NSS and NSPR memory corruption issues
+ MFSA 2015-132 Mixed content WebSocket policy bypass through workers
+ MFSA 2015-131 Vulnerabilities found through code inspection
+ MFSA 2015-130 JavaScript garbage collection crash with Java applet
+ MFSA 2015-128 Memory corruption in libjar through zip files
+ MFSA 2015-127 CORS preflight is bypassed when non-standard Content-Type headers are received
+ MFSA 2015-123 Buffer overflow during image interactions in canvas
+ MFSA 2015-122 Trailing whitespace in IP address hostnames can bypass same-origin policy
* Wed Sep 30 2015 Andrey Cherepanov <cas@altlinux.org> 38.3.0-alt1.M70P.1
- Backport fix to p7 branch
* Mon Sep 28 2015 Andrey Cherepanov <cas@altlinux.org> 38.3.0-alt2
- Use GStreamer 1.0 (ALT #31305)
* Thu Sep 24 2015 Andrey Cherepanov <cas@altlinux.org> 38.3.0-alt0.M70P.1
- Backport new ESR version to p7 branch
* Wed Sep 23 2015 Andrey Cherepanov <cas@altlinux.org> 38.3.0-alt1
- New ESR version
- Security fixes:
+ MFSA 2015-113 Memory safety errors in libGLES in the ANGLE graphics library
+ MFSA 2015-112 Vulnerabilities found through code inspection
+ MFSA 2015-111 Errors in the handling of CORS preflight request headers
+ MFSA 2015-110 Dragging and dropping images exposes final URL after redirects
+ MFSA 2015-106 Use-after-free while manipulating HTML media content
+ MFSA 2015-105 Buffer overflow while decoding WebM video
+ MFSA 2015-101 Buffer overflow in libvpx while parsing vp9 format video
+ MFSA 2015-100 Arbitrary file manipulation by local user through Mozilla updater
* Sun Aug 30 2015 Andrey Cherepanov <cas@altlinux.org> 38.2.1-alt0.M70P.1
- Backport new ESR version to p7 branch
* Fri Aug 28 2015 Andrey Cherepanov <cas@altlinux.org> 38.2.1-alt1
- New ESR version
- Security fixes:
+ MFSA 2015-95 Add-on notification bypass through data URLs
+ MFSA 2015-94 Use-after-free when resizing canvas element during restyling
* Sun Aug 16 2015 Andrey Cherepanov <cas@altlinux.org> 38.2.0-alt0.M70P.1
- Build new version for p7 branch
* Wed Aug 12 2015 Andrey Cherepanov <cas@altlinux.org> 38.2.0-alt1
- New ESR version
- Security fixes:
+ MFSA 2015-92 Use-after-free in XMLHttpRequest with shared workers
+ MFSA 2015-90 Vulnerabilities found through code inspection
+ MFSA 2015-89 Buffer overflows on Libvpx when decoding WebM video
+ MFSA 2015-88 Heap overflow in gdk-pixbuf when scaling bitmap images
+ MFSA 2015-87 Crash when using shared memory in JavaScript
+ MFSA 2015-85 Out-of-bounds write with Updater and malicious MAR file
+ MFSA 2015-84 Arbitrary file overwriting through Mozilla Maintenance
Service with hard links
+ MFSA 2015-83 Overflow issues in libstagefright
+ MFSA 2015-82 Redefinition of non-configurable JavaScript object
properties
+ MFSA 2015-80 Out-of-bounds read with malformed MP3 file
* Sat Aug 08 2015 Andrey Cherepanov <cas@altlinux.org> 38.1.1-alt1
- New ESR version
- Security fixes:
+ MFSA 2015-78 Same origin violation and local file stealing via PDF reader
* Thu Jul 16 2015 Andrey Cherepanov <cas@altlinux.org> 38.1.0-alt1
- New ESR version
- Security fixes:
+ MFSA 2015-70 NSS accepts export-length DHE keys with regular DHE cipher suites
+ MFSA 2015-69 Privilege escalation through internal workers
+ MFSA 2015-67 Key pinning is ignored when overridable errors are encountered
+ MFSA 2015-66 Vulnerabilities found through code inspection
+ MFSA 2015-65 Use-after-free in workers while using XMLHttpRequest
+ MFSA 2015-64 ECDSA signature validation fails to handle some signatures correctly
+ MFSA 2015-63 Use-after-free in Content Policy due to microtask execution error
+ MFSA 2015-62 Out-of-bound read while computing an oscillator rendering range in Web Audio
+ MFSA 2015-61 Type confusion in Indexed Database Manager
+ MFSA 2015-60 Local files or privileged URLs in pages can be opened into new tabs
* Mon Jun 01 2015 Andrey Cherepanov <cas@altlinux.org> 38.0.1-alt0.M70P.1
- Build new version for p7 branch
* Tue May 19 2015 Alexey Gladkov <legion@altlinux.ru> 38.0.1-alt1
- New release (38.0.1).
- Fixed:
+ 2015-58 Mozilla Windows updater can be run outside of application directory
+ 2015-57 Privilege escalation through IPC channel messages
+ 2015-56 Untrusted site hosting trusted page can intercept webchannel responses
+ 2015-55 Buffer overflow and out-of-bounds read while parsing MP4 video metadata
+ 2015-54 Buffer overflow when parsing compressed XML
+ 2015-53 Use-after-free due to Media Decoder Thread creation during shutdown
+ 2015-52 Sensitive URL encoded information written to Android logcat
+ 2015-51 Use-after-free during text processing with vertical text enabled
+ 2015-50 Out-of-bounds read and write in asm.js validation
+ 2015-49 Referrer policy ignored when links opened by middle-click and context menu
+ 2015-48 Buffer overflow with SVG content and CSS
+ 2015-47 Buffer overflow parsing H.264 video with Linux Gstreamer
+ 2015-46 Miscellaneous memory safety hazards (rv:38.0 / rv:31.7)
* Sun Apr 26 2015 Andrey Cherepanov <cas@altlinux.org> 37.0.2-alt0.M70P.1
- Build new version for p7 branch
* Sun Apr 26 2015 Alexey Gladkov <legion@altlinux.ru> 37.0.2-alt1
- New release (37.0.2).
- Fixed:
+ 2015-45 Memory corruption during failed plugin initialization
* Mon Apr 13 2015 Andrey Cherepanov <cas@altlinux.org> 37.0.1-alt0.M70P.1
- Build new version for p7 branch
* Mon Apr 06 2015 Alexey Gladkov <legion@altlinux.ru> 37.0.1-alt1
- New release (37.0.1).
- Fixed:
+ 2015-44 Certificate verification bypass through the HTTP/2 Alt-Svc header
+ 2015-43 Loading privileged content through Reader mode
+ 2015-42 Windows can retain access to privileged content on navigation to unprivileged pages
+ 2015-41 PRNG weakness allows for DNS poisoning on Android
+ 2015-40 Same-origin bypass through anchor navigation
+ 2015-39 Use-after-free due to type confusion flaws
+ 2015-38 Memory corruption crashes in Off Main Thread Compositing
+ 2015-37 CORS requests should not follow 30x redirections after preflight
+ 2015-36 Incorrect memory management for simple-type arrays in WebRTC
+ 2015-35 Cursor clickjacking with flash and images
+ 2015-34 Out of bounds read in QCMS library
+ 2015-33 resource:// documents can load privileged pages
+ 2015-32 Add-on lightweight theme installation approval bypassed through MITM attack
+ 2015-31 Use-after-free when using the Fluendo MP3 GStreamer plugin
+ 2015-30 Miscellaneous memory safety hazards (rv:37.0 / rv:31.6)
* Mon Mar 23 2015 Andrey Cherepanov <cas@altlinux.org> 36.0.4-alt0.M70P.1
- Backport new version to p7 branch
* Sun Mar 22 2015 Alexey Gladkov <legion@altlinux.ru> 36.0.4-alt1
- New release (36.0.4).
- Fixed:
+ 2015-28 Privilege escalation through SVG navigation
+ 2015-29 Code execution through incorrect JavaScript bounds checking elimination
* Fri Mar 20 2015 Andrey Cherepanov <cas@altlinux.org> 36.0.1-alt0.M70P.2
- Fix language pack support
* Fri Mar 13 2015 Andrey Cherepanov <cas@altlinux.org> 36.0.1-alt0.M70P.1
- Backport new version to p7 branch
* Sun Mar 08 2015 Alexey Gladkov <legion@altlinux.ru> 36.0.1-alt1
- New release (36.0.1).
- Fixed:
+ 2015-27 Caja Compiler JavaScript sandbox bypass
+ 2015-26 UI Tour whitelisted sites in background tab can spoof foreground tabs
+ 2015-25 Local files or privileged URLs in pages can be opened into new tabs
+ 2015-24 Reading of local files through manipulation of form autocomplete
+ 2015-23 Use-after-free in Developer Console date with OpenType Sanitiser
+ 2015-22 Crash using DrawTarget in Cairo graphics library
+ 2015-21 Buffer underflow during MP3 playback
+ 2015-20 Buffer overflow during CSS restyling
+ 2015-19 Out-of-bounds read and write while rendering SVG content
+ 2015-18 Double-free when using non-default memory allocators with a zero-length XHR
+ 2015-17 Buffer overflow in libstagefright during MP4 video playback
+ 2015-16 Use-after-free in IndexedDB
+ 2015-15 TLS TURN and STUN connections silently fail to simple TCP connections
+ 2015-14 Malicious WebGL content crash when writing strings
+ 2015-13 Appended period to hostnames can bypass HPKP and HSTS protections
+ 2015-12 Invoking Mozilla updater will load locally stored DLL files
+ 2015-11 Miscellaneous memory safety hazards (rv:36.0 / rv:31.5)
* Wed Mar 04 2015 Andrey Cherepanov <cas@altlinux.org> 35.0.1-alt0.M70P.1
- Backport new version to p7 branch
* Wed Jan 28 2015 Alexey Gladkov <legion@altlinux.ru> 35.0.1-alt1
- New release (35.0.1).
* Mon Jan 26 2015 Anton V. Boyarshinov <boyarsh@altlinux.ru> 31.3.0-alt0.M70C.2
- port to c7
* Mon Jan 19 2015 Alexey Gladkov <legion@altlinux.ru> 35.0-alt1
- New release (35.0).
- Fixed:
+ 2015-09 XrayWrapper bypass through DOM objects
+ 2015-08 Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension
+ 2015-07 Gecko Media Plugin sandbox escape
+ 2015-06 Read-after-free in WebRTC
+ 2015-05 Read of uninitialized memory in Web Audio
+ 2015-04 Cookie injection through Proxy Authenticate responses
+ 2015-03 sendBeacon requests lack an Origin header
+ 2015-02 Uninitialized memory use during bitmap rendering
+ 2015-01 Miscellaneous memory safety hazards (rv:35.0 / rv:31.4)
* Thu Dec 18 2014 Alexey Gladkov <legion@altlinux.ru> 34.0.5-alt2
- Enable WebRTC.
* Mon Dec 08 2014 Andrey Cherepanov <cas@altlinux.org> 31.3.0-alt0.M70P.2
- Enable Position Independent Executables
* Tue Dec 02 2014 Alexey Gladkov <legion@altlinux.ru> 34.0.5-alt1
- New release (34.0.5).
- Fixed:
+ 2014-91 Privileged access to security wrapped protected objects
+ 2014-90 Apple CoreGraphics framework on OS X 10.10 logging input data to /tmp directory
+ 2014-89 Bad casting from the BasicThebesLayer to BasicContainerLayer
+ 2014-88 Buffer overflow while parsing media content
+ 2014-87 Use-after-free during HTML5 parsing
+ 2014-86 CSP leaks redirect data via violation reports
+ 2014-85 XMLHttpRequest crashes with some input streams
+ 2014-84 XBL bindings accessible via improper CSS declarations
+ 2014-83 Miscellaneous memory safety hazards (rv:34.0 / rv:31.3)
* Mon Nov 17 2014 Alexey Gladkov <legion@altlinux.ru> 33.1.1-alt1
- New release (33.1.1).
* Thu Oct 30 2014 Alexey Gladkov <legion@altlinux.ru> 33.0.2-alt1
- New release (33.0.2).
* Sun Oct 19 2014 Alexey Gladkov <legion@altlinux.ru> 33.0-alt1
- New release (33.0).
- Fixed:
+ MFSA 2014-82 Accessing cross-origin objects via the Alarms API
+ MFSA 2014-81 Inconsistent video sharing within iframe
+ MFSA 2014-80 Key pinning bypasses
+ MFSA 2014-79 Use-after-free interacting with text directionality
+ MFSA 2014-78 Further uninitialized memory use during GIF
+ MFSA 2014-77 Out-of-bounds write with WebM video
+ MFSA 2014-76 Web Audio memory corruption issues with custom waveforms
+ MFSA 2014-75 Buffer overflow during CSS manipulation
+ MFSA 2014-74 Miscellaneous memory safety hazards (rv:33.0 / rv:31.2)
* Wed Sep 24 2014 Alexey Gladkov <legion@altlinux.ru> 32.0.3-alt1
- New release (32.0.3).
- Fixed:
+ MFSA 2014-72 Use-after-free setting text directionality
+ MFSA 2014-71 Profile directory file access through file: protocol
+ MFSA 2014-70 Out-of-bounds read in Web Audio audio timeline
+ MFSA 2014-69 Uninitialized memory use during GIF rendering
+ MFSA 2014-68 Use-after-free during DOM interactions with SVG
+ MFSA 2014-67 Miscellaneous memory safety hazards (rv:32.0 / rv:31.1 / rv:24.8)
* Sun Jul 27 2014 Alexey Gladkov <legion@altlinux.ru> 31.0-alt1
- New release (31.0).
- Fixed:
+ MFSA 2014-66 IFRAME sandbox same-origin access through redirect
+ MFSA 2014-65 Certificate parsing broken by non-standard character encoding
+ MFSA 2014-64 Crash in Skia library when scaling high quality images
+ MFSA 2014-63 Use-after-free while when manipulating certificates in the trusted cache
+ MFSA 2014-62 Exploitable WebGL crash with Cesium JavaScript library
+ MFSA 2014-61 Use-after-free with FireOnStateChange event
+ MFSA 2014-60 Toolbar dialog customization event spoofing
+ MFSA 2014-59 Use-after-free in DirectWrite font handling
+ MFSA 2014-58 Use-after-free in Web Audio due to incorrect control message ordering
+ MFSA 2014-57 Buffer overflow during Web Audio buffering for playback
+ MFSA 2014-56 Miscellaneous memory safety hazards (rv:31.0 / rv:24.7)
* Tue Jul 01 2014 Alexey Gladkov <legion@altlinux.ru> 30.0-alt1
- New release (30.0).
- Built without xulrunner.
- Fixed:
+ MFSA 2014-54 Buffer overflow in Gamepad API
+ MFSA 2014-53 Buffer overflow in Web Audio Speex resampler
+ MFSA 2014-52 Use-after-free with SMIL Animation Controller
+ MFSA 2014-51 Use-after-free in Event Listener Manager
+ MFSA 2014-50 Clickjacking through cursor invisability after Flash interaction
+ MFSA 2014-49 Use-after-free and out of bounds issues found using Address Sanitizer
+ MFSA 2014-48 Miscellaneous memory safety hazards (rv:30.0 / rv:24.6)
* Sun May 11 2014 Alexey Gladkov <legion@altlinux.ru> 29.0.1-alt1
- New release (29.0.1).
* Sat May 10 2014 Alexey Gladkov <legion@altlinux.ru> 29.0-alt1
- New release (29.0).
- Fixed:
+ MFSA 2014-47 Debugger can bypass XrayWrappers with JavaScript
+ MFSA 2014-46 Use-after-free in nsHostResolve
+ MFSA 2014-45 Incorrect IDNA domain name matching for wildcard certificates
+ MFSA 2014-44 Use-after-free in imgLoader while resizing images
+ MFSA 2014-43 Cross-site scripting (XSS) using history navigations
+ MFSA 2014-42 Privilege escalation through Web Notification API
+ MFSA 2014-41 Out-of-bounds write in Cairo
+ MFSA 2014-40 Firefox for Android addressbar suppression
+ MFSA 2014-39 Use-after-free in the Text Track Manager for HTML video
+ MFSA 2014-38 Buffer overflow when using non-XBL object as XBL
+ MFSA 2014-37 Out of bounds read while decoding JPG images
+ MFSA 2014-36 Web Audio memory corruption issues
+ MFSA 2014-35 Privilege escalation through Mozilla Maintenance Service Installer
+ MFSA 2014-34 Miscellaneous memory safety hazards (rv:29.0 / rv:24.5)
* Sat Mar 22 2014 Alexey Gladkov <legion@altlinux.ru> 28.0-alt1
- New release (28.0).
- Fixed:
+ MFSA 2014-32 Out-of-bounds write through TypedArrayObject after neutering
+ MFSA 2014-31 Out-of-bounds read/write through neutering ArrayBuffer objects
+ MFSA 2014-30 Use-after-free in TypeObject
+ MFSA 2014-29 Privilege escalation using WebIDL-implemented APIs
+ MFSA 2014-28 SVG filters information disclosure through feDisplacementMap
+ MFSA 2014-27 Memory corruption in Cairo during PDF font rendering
+ MFSA 2014-26 Information disclosure through polygon rendering in MathML
+ MFSA 2014-25 Firefox OS DeviceStorageFile object vulnerable to relative path escape
+ MFSA 2014-24 Android Crash Reporter open to manipulation
+ MFSA 2014-23 Content Security Policy for data: documents not preserved by session restore
+ MFSA 2014-22 WebGL content injection from one domain to rendering in another
+ MFSA 2014-21 Local file access via Open Link in new tab
+ MFSA 2014-20 onbeforeunload and Javascript navigation DOS
+ MFSA 2014-19 Spoofing attack on WebRTC permission prompt
+ MFSA 2014-18 crypto.generateCRMFRequest does not validate type of key
+ MFSA 2014-17 Out of bounds read during WAV file decoding
+ MFSA 2014-16 Files extracted during updates are not always read only
+ MFSA 2014-15 Miscellaneous memory safety hazards (rv:28.0 / rv:24.4)
* Fri Feb 07 2014 Alexey Gladkov <legion@altlinux.ru> 27.0-alt1
- New release (27.0).
- Fixed:
+ MFSA 2014-13 Inconsistent JavaScript handling of access to Window objects
+ MFSA 2014-12 NSS ticket handling issues
+ MFSA 2014-11 Crash when using web workers with asm.js
+ MFSA 2014-10 Firefox default start page UI content invokable by script
+ MFSA 2014-09 Cross-origin information leak through web workers
+ MFSA 2014-08 Use-after-free with imgRequestProxy and image proccessing
+ MFSA 2014-07 XSLT stylesheets treated as styles in Content Security Policy
+ MFSA 2014-06 Profile path leaks to Android system log
+ MFSA 2014-05 Information disclosure with *FromPoint on iframes
+ MFSA 2014-04 Incorrect use of discarded images by RasterImage
+ MFSA 2014-03 UI selection timeout missing on download prompts
+ MFSA 2014-02 Clone protected content with XBL scopes
+ MFSA 2014-01 Miscellaneous memory safety hazards (rv:27.0 / rv:24.3)
* Mon Dec 23 2013 Alexey Gladkov <legion@altlinux.ru> 26.0-alt1
- New release (26.0).
- Fixed:
+ MFSA 2013-117 Mis-issued ANSSI/DCSSI certificate
+ MFSA 2013-116 JPEG information leak
+ MFSA 2013-115 GetElementIC typed array stubs can be generated outside observed typesets
+ MFSA 2013-114 Use-after-free in synthetic mouse movement
+ MFSA 2013-113 Trust settings for built-in roots ignored during EV certificate validation
+ MFSA 2013-112 Linux clipboard information disclosure though selection paste
+ MFSA 2013-111 Segmentation violation when replacing ordered list elements
+ MFSA 2013-110 Potential overflow in JavaScript binary search algorithms
+ MFSA 2013-109 Use-after-free during Table Editing
+ MFSA 2013-108 Use-after-free in event listeners
+ MFSA 2013-107 Sandbox restrictions not applied to nested object elements
+ MFSA 2013-106 Character encoding cross-origin XSS attack
+ MFSA 2013-105 Application Installation doorhanger persists on navigation
+ MFSA 2013-104 Miscellaneous memory safety hazards (rv:26.0 / rv:24.2)
* Thu Nov 21 2013 Alexey Gladkov <legion@altlinux.ru> 25.0.1-alt1
- New release (25.0.1).
- Fixed:
+ MFSA 2013-103 Miscellaneous Network Security Services (NSS) vulnerabilities
* Sun Nov 03 2013 Alexey Gladkov <legion@altlinux.ru> 25.0-alt1
- New release (25.0).
- Fixed:
+ MFSA 2013-102 Use-after-free in HTML document templates
+ MFSA 2013-101 Memory corruption in workers
+ MFSA 2013-100 Miscellaneous use-after-free issues found through ASAN fuzzing
+ MFSA 2013-99 Security bypass of PDF.js checks using iframes
+ MFSA 2013-98 Use-after-free when updating offline cache
+ MFSA 2013-97 Writing to cycle collected object during image decoding
+ MFSA 2013-96 Improperly initialized memory and overflows in some JavaScript functions
+ MFSA 2013-95 Access violation with XSLT and uninitialized data
+ MFSA 2013-94 Spoofing addressbar though SELECT element
+ MFSA 2013-93 Miscellaneous memory safety hazards (rv:25.0 / rv:24.1 / rv:17.0.10)
* Tue Oct 01 2013 Alexey Gladkov <legion@altlinux.ru> 24.0-alt1
- New release (24.0).
- Add gstreamer support (ALT#29454).
- Fixed:
+ MFSA 2013-92 GC hazard with default compartments and frame chain restoration
+ MFSA 2013-91 User-defined properties on DOM proxies get the wrong "this" object
+ MFSA 2013-90 Memory corruption involving scrolling
+ MFSA 2013-89 Buffer overflow with multi-column, lists, and floats
+ MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes
+ MFSA 2013-87 Shared object library loading from writable location
+ MFSA 2013-86 WebGL Information disclosure through OS X NVIDIA graphic drivers
+ MFSA 2013-85 Uninitialized data in IonMonkey
+ MFSA 2013-84 Same-origin bypass through symbolic links
+ MFSA 2013-83 Mozilla Updater does not lock MAR file after signature verification
+ MFSA 2013-82 Calling scope for new Javascript objects can lead to memory corruption
+ MFSA 2013-81 Use-after-free with select element
+ MFSA 2013-80 NativeKey continues handling key messages after widget is destroyed
+ MFSA 2013-79 Use-after-free in Animation Manager during stylesheet cloning
+ MFSA 2013-78 Integer overflow in ANGLE library
+ MFSA 2013-77 Improper state in HTML5 Tree Builder with templates
+ MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 / rv:17.0.9)
* Mon Aug 12 2013 Alexey Gladkov <legion@altlinux.ru> 23.0-alt1
- New release (23.0).
- Fixed:
+ MFSA 2013-75 Local Java applets may read contents of local file system
+ MFSA 2013-74 Firefox full and stub installer DLL hijacking
+ MFSA 2013-73 Same-origin bypass with web workers and XMLHttpRequest
+ MFSA 2013-72 Wrong principal used for validating URI for some Javascript components
+ MFSA 2013-71 Further Privilege escalation through Mozilla Updater
+ MFSA 2013-70 Bypass of XrayWrappers using XBL Scopes
+ MFSA 2013-69 CRMF requests allow for code execution and XSS attacks
+ MFSA 2013-68 Document URI misrepresentation and masquerading
+ MFSA 2013-67 Crash during WAV audio file decoding
+ MFSA 2013-66 Buffer overflow in Mozilla Maintenance Service and Mozilla Updater
+ MFSA 2013-65 Buffer underflow when generating CRMF requests
+ MFSA 2013-64 Use after free mutating DOM during SetBody
+ MFSA 2013-63 Miscellaneous memory safety hazards (rv:23.0 / rv:17.0.8)
* Wed Jun 26 2013 Alexey Gladkov <legion@altlinux.ru> 22.0-alt1
- New release (22.0).
- Fixed:
+ MFSA 2013-62 Inaccessible updater can lead to local privilege escalation
+ MFSA 2013-61 Homograph domain spoofing in .com, .net and .name
+ MFSA 2013-60 getUserMedia permission dialog incorrectly displays location
+ MFSA 2013-59 XrayWrappers can be bypassed to run user defined methods in a privileged context
+ MFSA 2013-58 X-Frame-Options ignored when using server push with multi-part responses
+ MFSA 2013-57 Sandbox restrictions not applied to nested frame elements
+ MFSA 2013-56 PreserveWrapper has inconsistent behavior
+ MFSA 2013-55 SVG filters can lead to information disclosure
+ MFSA 2013-54 Data in the body of XHR HEAD requests leads to CSRF attacks
+ MFSA 2013-53 Execution of unmapped memory through onreadystatechange event
+ MFSA 2013-52 Arbitrary code execution within Profiler
+ MFSA 2013-51 Privileged content access and execution via XBL
+ MFSA 2013-50 Memory corruption found using Address Sanitizer
+ MFSA 2013-49 Miscellaneous memory safety hazards (rv:22.0 / rv:17.0.7)
* Sat Jun 01 2013 Alexey Gladkov <legion@altlinux.ru> 21.0-alt1
- New release (21.0).
- Fixed:
+ MFSA 2013-48 Memory corruption found using Address Sanitizer
+ MFSA 2013-47 Uninitialized functions in DOMSVGZoomEvent
+ MFSA 2013-46 Use-after-free with video and onresize event
+ MFSA 2013-45 Mozilla Updater fails to update some Windows Registry entries
+ MFSA 2013-44 Local privilege escalation through Mozilla Maintenance Service
+ MFSA 2013-43 File input control has access to full path
+ MFSA 2013-42 Privileged access for content level constructor
+ MFSA 2013-41 Miscellaneous memory safety hazards (rv:21.0 / rv:17.0.6)
* Wed Apr 10 2013 Alexey Gladkov <legion@altlinux.ru> 20.0-alt1
- New release (20.0).
- Fixed:
+ MFSA 2013-40 Out-of-bounds array read in CERT_DecodeCertPackage
+ MFSA 2013-39 Memory corruption while rendering grayscale PNG images
+ MFSA 2013-38 Cross-site scripting (XSS) using timed history navigations
+ MFSA 2013-37 Bypass of tab-modal dialog origin disclosure
+ MFSA 2013-36 Bypass of SOW protections allows cloning of protected nodes
+ MFSA 2013-35 WebGL crash with Mesa graphics driver on Linux
+ MFSA 2013-34 Privilege escalation through Mozilla Updater
+ MFSA 2013-33 World read and write access to app_tmp directory on Android
+ MFSA 2013-32 Privilege escalation through Mozilla Maintenance Service
+ MFSA 2013-31 Out-of-bounds write in Cairo library
+ MFSA 2013-30 Miscellaneous memory safety hazards (rv:20.0 / rv:17.0.5)
* Sat Mar 09 2013 Alexey Gladkov <legion@altlinux.ru> 19.0.2-alt1
- New release (19.0.2).
- Fixed:
+ MFSA 2013-29 Use-after-free in HTML Editor
* Fri Mar 01 2013 Alexey Gladkov <legion@altlinux.ru> 19.0.1-alt1
- New release (19.0.1).
- Fixed:
+ MFSA 2013-28 Use-after-free, out of bounds read, and buffer overflow issues found using Address Sanitizer
+ MFSA 2013-27 Phishing on HTTPS connection through malicious proxy
+ MFSA 2013-26 Use-after-free in nsImageLoadingContent
+ MFSA 2013-25 Privacy leak in JavaScript Workers
+ MFSA 2013-24 Web content bypass of COW and SOW security wrappers
+ MFSA 2013-23 Wrapped WebIDL objects can be wrapped again
+ MFSA 2013-22 Out-of-bounds read in image rendering
+ MFSA 2013-21 Miscellaneous memory safety hazards (rv:19.0 / rv:17.0.3)
* Sun Feb 10 2013 Alexey Gladkov <legion@altlinux.ru> 18.0.2-alt1
- New release (18.0.2).
* Mon Jan 28 2013 Alexey Gladkov <legion@altlinux.ru> 18.0.1-alt1
- New release (18.0.1).
* Thu Jan 17 2013 Alexey Gladkov <legion@altlinux.ru> 18.0-alt1
- New release (18.0).
- Fixed:
+ MFSA 2013-20 Mis-issued TURKTRUST certificates
+ MFSA 2013-19 Use-after-free in Javascript Proxy objects
+ MFSA 2013-18 Use-after-free in Vibrate
+ MFSA 2013-17 Use-after-free in ListenerManager
+ MFSA 2013-16 Use-after-free in serializeToStream
+ MFSA 2013-15 Privilege escalation through plugin objects
+ MFSA 2013-14 Chrome Object Wrapper (COW) bypass through changing prototype
+ MFSA 2013-13 Memory corruption in XBL with XML bindings containing SVG
+ MFSA 2013-12 Buffer overflow in Javascript string concatenation
+ MFSA 2013-11 Address space layout leaked in XBL objects
+ MFSA 2013-10 Event manipulation in plugin handler to bypass same-origin policy
+ MFSA 2013-09 Compartment mismatch with quickstubs returned values
+ MFSA 2013-08 AutoWrapperChanger fails to keep objects alive during garbage collection
+ MFSA 2013-07 Crash due to handling of SSL on threads
+ MFSA 2013-06 Touch events are shared across iframes
+ MFSA 2013-05 Use-after-free when displaying table with many columns and column groups
+ MFSA 2013-04 URL spoofing in addressbar during page loads
+ MFSA 2013-03 Buffer Overflow in Canvas
+ MFSA 2013-02 Use-after-free and buffer overflow issues found using Address Sanitizer
+ MFSA 2013-01 Miscellaneous memory safety hazards (rv:18.0/ rv:10.0.12 / rv:17.0.2)
+ MFSA 2012-98 Firefox installer DLL hijacking
* Wed Dec 05 2012 Alexey Gladkov <legion@altlinux.ru> 17.0.1-alt1
- New release (17.0.1).
* Wed Nov 21 2012 Alexey Gladkov <legion@altlinux.ru> 17.0-alt1
- New release (17.0).
- Fixed:
+ MFSA 2012-106 Use-after-free, buffer overflow, and memory corruption issues found using Address Sanitizer
+ MFSA 2012-105 Use-after-free and buffer overflow issues found using Address Sanitizer
+ MFSA 2012-104 CSS and HTML injection through Style Inspector
+ MFSA 2012-103 Frames can shadow top.location
+ MFSA 2012-102 Script entered into Developer Toolbar runs with chrome privileges
+ MFSA 2012-101 Improper character decoding in HZ-GB-2312 charset
+ MFSA 2012-100 Improper security filtering for cross-origin wrappers
+ MFSA 2012-99 XrayWrappers exposes chrome-only properties when not in chrome compartment
+ MFSA 2012-98 Firefox installer DLL hijacking
+ MFSA 2012-97 XMLHttpRequest inherits incorrect principal within sandbox
+ MFSA 2012-96 Memory corruption in str_unescape
+ MFSA 2012-95 Javascript: URLs run in privileged context on New Tab page
+ MFSA 2012-94 Crash when combining SVG text on path with CSS
+ MFSA 2012-93 evalInSanbox location context incorrectly applied
+ MFSA 2012-92 Buffer overflow while rendering GIF images
+ MFSA 2012-91 Miscellaneous memory safety hazards (rv:17.0/ rv:10.0.11)
* Thu Nov 01 2012 Alexey Gladkov <legion@altlinux.ru> 16.0.2-alt1
- New release (16.0.2).
- Fixed:
+ MFSA 2012-90 Fixes for Location object issues
* Mon Oct 22 2012 Alexey Gladkov <legion@altlinux.ru> 16.0.1-alt1
- New release (16.0.1).
- Fixed:
+ MFSA 2012-89 defaultValue security checks not applied
+ MFSA 2012-88 Miscellaneous memory safety hazards (rv:16.0.1)
+ MFSA 2012-87 Use-after-free in the IME State Manager
+ MFSA 2012-86 Heap memory corruption issues found using Address Sanitizer
+ MFSA 2012-85 Use-after-free, buffer overflow, and out of bounds read issues found using Address Sanitizer
+ MFSA 2012-84 Spoofing and script injection through location.hash
+ MFSA 2012-83 Chrome Object Wrapper (COW) does not disallow acces to privileged functions or properties
+ MFSA 2012-82 top object and location property accessible by plugins
+ MFSA 2012-81 GetProperty function can bypass security checks
+ MFSA 2012-80 Crash with invalid cast when using instanceof operator
+ MFSA 2012-79 DOS and crash with full screen and history navigation
+ MFSA 2012-78 Reader Mode pages have chrome privileges
+ MFSA 2012-77 Some DOMWindowUtils methods bypass security checks
+ MFSA 2012-76 Continued access to initial origin after setting document.domain
+ MFSA 2012-75 select element persistance allows for attacks
+ MFSA 2012-74 Miscellaneous memory safety hazards (rv:16.0/ rv:10.0.8)
* Wed Aug 29 2012 Alexey Gladkov <legion@altlinux.ru> 15.0-alt1
- New release (15.0).
- Fixed:
+ MFSA 2012-72 Web console eval capable of executing chrome-privileged code
+ MFSA 2012-71 Insecure use of __android_log_print
+ MFSA 2012-70 Location object security checks bypassed by chrome code
+ MFSA 2012-69 Incorrect site SSL certificate data display
+ MFSA 2012-68 DOMParser loads linked resources in extensions when parsing text/html
+ MFSA 2012-67 Installer will launch incorrect executable following new installation
+ MFSA 2012-66 HTTPMonitor extension allows for remote debugging without explicit activation
+ MFSA 2012-65 Out-of-bounds read in format-number in XSLT
+ MFSA 2012-64 Graphite 2 memory corruption
+ MFSA 2012-63 SVG buffer overflow and use-after-free issues
+ MFSA 2012-62 WebGL use-after-free and memory corruption
+ MFSA 2012-61 Memory corruption with bitmap format images with negative height
+ MFSA 2012-60 Escalation of privilege through about:newtab
+ MFSA 2012-59 Location object can be shadowed using Object.defineProperty
+ MFSA 2012-58 Use-after-free issues found using Address Sanitizer
+ MFSA 2012-57 Miscellaneous memory safety hazards (rv:15.0/ rv:10.0.7)
* Sun Jul 29 2012 Alexey Gladkov <legion@altlinux.ru> 14.0.1-alt1
- New release (14.0.1).
- Fixed:
+ MFSA 2012-56 Code execution through javascript: URLs
+ MFSA 2012-55 feed: URLs with an innerURI inherit security context of page
+ MFSA 2012-53 Content Security Policy 1.0 implementation errors cause data leakage
+ MFSA 2012-52 JSDependentString::undepend string conversion results in memory corruption
+ MFSA 2012-51 X-Frame-Options header ignored when duplicated
+ MFSA 2012-50 Out of bounds read in QCMS
+ MFSA 2012-49 Same-compartment Security Wrappers can be bypassed
+ MFSA 2012-48 use-after-free in nsGlobalWindow::PageHidden
+ MFSA 2012-47 Improper filtering of javascript in HTML feed-view
+ MFSA 2012-46 XSS through data: URLs
+ MFSA 2012-45 Spoofing issue with location
+ MFSA 2012-44 Gecko memory corruption
+ MFSA 2012-43 Incorrect URL displayed in addressbar through drag and drop
+ MFSA 2012-42 Miscellaneous memory safety hazards (rv:14.0/ rv:10.0.6)
* Sun Jul 01 2012 Alexey Gladkov <legion@altlinux.ru> 13.0.1-alt1
- New release (13.0.1).
- Fixed:
+ MFSA 2012-40 Buffer overflow and use-after-free issues found using Address Sanitizer
+ MFSA 2012-39 NSS parsing errors with zero length items
+ MFSA 2012-38 Use-after-free while replacing/inserting a node in a document
+ MFSA 2012-37 Information disclosure though Windows file shares and shortcut files
+ MFSA 2012-36 Content Security Policy inline-script bypass
+ MFSA 2012-35 Privilege escalation through Mozilla Updater and Windows Updater Service
+ MFSA 2012-34 Miscellaneous memory safety hazards
* Tue May 08 2012 Alexey Gladkov <legion@altlinux.ru> 12.0-alt1
- New release (12.0).
- Fixed:
+ MFSA 2012-33 Potential site identity spoofing when loading RSS and Atom feeds
+ MFSA 2012-32 HTTP Redirections and remote content can be read by javascript errors
+ MFSA 2012-31 Off-by-one error in OpenType Sanitizer
+ MFSA 2012-30 Crash with WebGL content using textImage2D
+ MFSA 2012-29 Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues
+ MFSA 2012-28 Ambiguous IPv6 in Origin headers may bypass webserver access restrictions
+ MFSA 2012-27 Page load short-circuit can lead to XSS
+ MFSA 2012-26 WebGL.drawElements may read illegal video memory due to FindMaxUshortElement error
+ MFSA 2012-25 Potential memory corruption during font rendering using cairo-dwrite
+ MFSA 2012-24 Potential XSS via multibyte content processing errors
+ MFSA 2012-23 Invalid frees causes heap corruption in gfxImageSurface
+ MFSA 2012-22 use-after-free in IDBKeyRange
+ MFSA 2012-21 Multiple security flaws fixed in FreeType v2.4.9
+ MFSA 2012-20 Miscellaneous memory safety hazards (rv:12.0/ rv:10.0.4)
* Thu Apr 19 2012 Alexey Gladkov <legion@altlinux.ru> 11.0-alt1
- New release (11.0).
- Fixed:
+ MFSA 2012-19 Miscellaneous memory safety hazards (rv:11.0/ rv:10.0.3 / rv:1.9.2.28)
+ MFSA 2012-18 window.fullScreen writeable by untrusted content
+ MFSA 2012-17 Crash when accessing keyframe cssText after dynamic modification
+ MFSA 2012-16 Escalation of privilege with Javascript: URL as home page
+ MFSA 2012-15 XSS with multiple Content Security Policy headers
+ MFSA 2012-14 SVG issues found with Address Sanitizer
+ MFSA 2012-13 XSS with Drag and Drop and Javascript: URL
+ MFSA 2012-12 Use-after-free in shlwapi.dll
* Tue Feb 21 2012 Alexey Gladkov <legion@altlinux.ru> 10.0.2-alt1
- New release (10.0.2).
- Fixed:
+ MFSA 2012-11 libpng integer overflow
+ MFSA 2012-10 use after free in nsXBLDocumentInfo::ReadPrototypeBindings
+ MFSA 2012-09 Firefox Recovery Key.html is saved with unsafe permission
+ MFSA 2012-08 Crash with malformed embedded XSLT stylesheets
+ MFSA 2012-07 Potential Memory Corruption When Decoding Ogg Vorbis files
+ MFSA 2012-06 Uninitialized memory appended when encoding icon images may cause information disclosure
+ MFSA 2012-05 Frame scripts calling into untrusted objects bypass security checks
+ MFSA 2012-04 Child nodes from nsDOMAttribute still accessible after removal of nodes
+ MFSA 2012-03 <iframe> element exposed across domains via name attribute
+ MFSA 2012-01 Miscellaneous memory safety hazards (rv:10.0/ rv:1.9.2.26)
* Mon Jan 09 2012 Alexey Gladkov <legion@altlinux.ru> 9.0.1-alt1
- New release (9.0.1).
- Check default browser (ALT#26195).
- Change location for noarch extensions (ALT#26702).
- Add translation for summary and description (ALT#22789).
- Fixed:
+ MFSA 2011-58 Crash scaling <video> to extreme sizes
+ MFSA 2011-57 Crash when plugin removes itself on Mac OS X
+ MFSA 2011-56 Key detection without JavaScript via SVG animation
+ MFSA 2011-55 nsSVGValue out-of-bounds access
+ MFSA 2011-54 Potentially exploitable crash in the YARR regular expression library
+ MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)
* Mon Nov 14 2011 Alexey Gladkov <legion@altlinux.ru> 8.0-alt1
- New release (8.0).
- Fixed:
+ MFSA 2011-52 Code execution via NoWaiverWrapper
+ MFSA 2011-51 Cross-origin image theft on Mac with integrated Intel GPU
+ MFSA 2011-50 Cross-origin data theft using canvas and Windows D2D
+ MFSA 2011-49 Memory corruption while profiling using Firebug
+ MFSA 2011-48 Miscellaneous memory safety hazards (rv:8.0)
+ MFSA 2011-47 Potential XSS against sites using Shift-JIS
* Wed Oct 19 2011 Alexey Gladkov <legion@altlinux.ru> 7.0.1-alt2
- Drop depends for extensions.
* Thu Oct 06 2011 Alexey Gladkov <legion@altlinux.ru> 7.0.1-alt1
- New release (7.0.1).
- Fixed:
+ MFSA 2011-45 Inferring Keystrokes from motion data
+ MFSA 2011-44 Use after free reading OGG headers
+ MFSA 2011-43 loadSubScript unwraps XPCNativeWrapper scope parameter
+ MFSA 2011-42 Potentially exploitable crash in the YARR regular expression library
+ MFSA 2011-41 Potentially exploitable WebGL crashes
+ MFSA 2011-40 Code installation through holding down Enter
+ MFSA 2011-39 Defense against multiple Location headers due to CRLF Injection
+ MFSA 2011-36 Miscellaneous memory safety hazards (rv:7.0 / rv:1.9.2.23)
* Tue Sep 06 2011 Alexey Gladkov <legion@altlinux.ru> 6.0.2-alt1
- New release (6.0.2).
* Tue Sep 06 2011 Alexey Gladkov <legion@altlinux.ru> 6.0.1-alt1
- New release (6.0.1).
- Fixed:
+ MFSA 2011-34 Protection against fraudulent DigiNotar certificates
* Mon Aug 22 2011 Alexey Gladkov <legion@altlinux.ru> 6.0-alt1
- New release (6.0).
- Add Conflict to firefox-settings-desktop (ALT#25473).
- Fixed:
+ MFSA 2011-29 Security issues addressed in Firefox6.
* Wed Jul 13 2011 Alexey Gladkov <legion@altlinux.ru> 5.0.1-alt1
- New release (5.0.1).
- Fixed:
+ MFSA 2011-28 Non-whitelisted site can trigger xpinstall
+ MFSA 2011-27 XSS encoding hazard with inline SVG
+ MFSA 2011-26 Multiple WebGL crashes
+ MFSA 2011-25 Stealing of cross-domain images using WebGL textures
+ MFSA 2011-22 Integer overflow and arbitrary code execution in Array.reduceRight()
+ MFSA 2011-21 Memory corruption due to multipart/x-mixed-replace images
+ MFSA 2011-20 Use-after-free vulnerability when viewing XUL document with script disabled
+ MFSA 2011-19 Miscellaneous memory safety hazards (rv:3.0/1.9.2.18)
* Mon May 02 2011 Alexey Gladkov <legion@altlinux.ru> 4.0.1-alt1
- New release (4.0.1).
- Update desktop file (ALT#25530).
- Fixed:
+ MFSA 2011-18 XSLT generate-id() function heap address leak
+ MFSA 2011-17 WebGLES vulnerabilities
+ MFSA 2011-12 Miscellaneous memory safety hazards (rv:2.0.1/ 1.9.2.17/ 1.9.1.19)
* Fri Apr 22 2011 Alexey Gladkov <legion@altlinux.ru> 4.0-alt3
- Set some settings in Firefox to default values (ALT#22148).
* Tue Apr 19 2011 Alexey Gladkov <legion@altlinux.ru> 4.0-alt2
- Fix plugins path.
- Fix alternatives for %_bindir/xbrowser.
* Fri Apr 01 2011 Alexey Gladkov <legion@altlinux.ru> 4.0-alt1
- New release (4.0).
- Remove alternatives for configuration.
* Tue Mar 08 2011 Alexey Gladkov <legion@altlinux.ru> 3.6.15-alt1.20110308
- New release (3.6.15).
- Fixed:
+ MFSA 2011-10 CSRF risk with plugins and 307 redirects
+ MFSA 2011-09 Crash caused by corrupted JPEG image
+ MFSA 2011-08 ParanoidFragmentSink allows javascript: URLs in chrome documents
+ MFSA 2011-07 Memory corruption during text run construction (Windows)
+ MFSA 2011-06 Use-after-free error using Web Workers
+ MFSA 2011-05 Buffer overflow in JavaScript atom map
+ MFSA 2011-04 Buffer overflow in JavaScript upvarMap
+ MFSA 2011-03 Use-after-free error in JSON.stringify
+ MFSA 2011-02 Recursive eval call causes confirm dialogs to evaluate to true
+ MFSA 2011-01 Miscellaneous memory safety hazards (rv:1.9.2.14/ 1.9.1.17)
* Wed Dec 22 2010 Alexey Gladkov <legion@altlinux.ru> 3.6.13-alt1.20101222
- New release (3.6.13).
- Fixed:
+ MFSA 2010-84 XSS hazard in multiple character encodings
+ MFSA 2010-83 Location bar SSL spoofing using network error page
+ MFSA 2010-82 Incomplete fix for CVE-2010-0179
+ MFSA 2010-81 Integer overflow vulnerability in NewIdArray
+ MFSA 2010-80 Use-after-free error with nsDOMAttribute MutationObserver
+ MFSA 2010-79 Java security bypass from LiveConnect loaded via data: URL meta refresh
+ MFSA 2010-78 Add support for OTS font sanitizer
+ MFSA 2010-77 Crash and remote code execution using HTML tags inside a XUL tree
+ MFSA 2010-76 Chrome privilege escalation with window.open and <isindex> element
+ MFSA 2010-75 Buffer overflow while line breaking after document.write with long string
+ MFSA 2010-74 Miscellaneous memory safety hazards (rv:1.9.2.13/ 1.9.1.16)
* Sun Nov 14 2010 Alexey Gladkov <legion@altlinux.ru> 3.6.13-alt1.20101110
- New release (3.6.12).
- Fixed:
+ MFSA 2010-73 Heap buffer overflow mixing document.write and DOM insertion
* Tue Oct 26 2010 Alexey Gladkov <legion@altlinux.ru> 3.6.12-alt1.20101025
- New release (3.6.11).
- Fixed:
+ MFSA 2010-72 Insecure Diffie-Hellman key exchange
+ MFSA 2010-71 Unsafe library loading vulnerabilities
+ MFSA 2010-70 SSL wildcard certificate matching IP addresses
+ MFSA 2010-69 Cross-site information disclosure via modal calls
+ MFSA 2010-68 XSS in gopher parser when parsing hrefs
+ MFSA 2010-67 Dangling pointer vulnerability in LookupGetterOrSetter
+ MFSA 2010-66 Use-after-free error in nsBarProp
+ MFSA 2010-65 Buffer overflow and memory corruption using document.write
+ MFSA 2010-64 Miscellaneous memory safety hazards (rv:1.9.2.11/ 1.9.1.14)
* Tue Sep 21 2010 Alexey Gladkov <legion@altlinux.ru> 3.6.11-alt1.20100920
- New release (3.6.10).
* Sun Sep 12 2010 Alexey Gladkov <legion@altlinux.ru> 3.6.10-alt1.20100909
- New release (3.6.9).
- Fixed:
+ MFSA 2010-63 Information leak via XMLHttpRequest statusText
+ MFSA 2010-62 Copy-and-paste or drag-and-drop into designMode document allows XSS
+ MFSA 2010-61 UTF-7 XSS by overriding document charset using <object> type attribute
+ MFSA 2010-59 SJOW creates scope chains ending in outer object
+ MFSA 2010-58 Crash on Mac using fuzzed font in data: URL
+ MFSA 2010-57 Crash and remote code execution in normalizeDocument
+ MFSA 2010-56 Dangling pointer vulnerability in nsTreeContentView
+ MFSA 2010-55 XUL tree removal crash and remote code execution
+ MFSA 2010-54 Dangling pointer vulnerability in nsTreeSelection
+ MFSA 2010-53 Heap buffer overflow in nsTextFrameUtils::TransformText
+ MFSA 2010-52 Windows XP DLL loading vulnerability
+ MFSA 2010-51 Dangling pointer vulnerability using DOM plugin array
+ MFSA 2010-50 Frameset integer overflow vulnerability
+ MFSA 2010-49 Miscellaneous memory safety hazards (rv:1.9.2.9/ 1.9.1.12)
* Thu Jul 29 2010 Alexey Gladkov <legion@altlinux.ru> 3.6.9-alt1.20100725
- New release (3.6.8).
- Fixed:
+ MFSA 2010-48 Dangling pointer crash regression from plugin parameter array fix
+ MFSA 2010-47 Cross-origin data leakage from script filename in error messages
+ MFSA 2010-46 Cross-domain data theft using CSS
+ MFSA 2010-45 Multiple location bar spoofing vulnerabilities
+ MFSA 2010-44 Characters mapped to U+FFFD in 8 bit encodings cause subsequent character to vanish
+ MFSA 2010-43 Same-origin bypass using canvas context
+ MFSA 2010-42 Cross-origin data disclosure via Web Workers and importScripts
+ MFSA 2010-41 Remote code execution using malformed PNG image
+ MFSA 2010-40 nsTreeSelection dangling pointer remote code execution vulnerability
+ MFSA 2010-39 nsCSSValue::Array index integer overflow
+ MFSA 2010-38 Arbitrary code execution using SJOW and fast native function
+ MFSA 2010-37 Plugin parameter EnsureCachedAttrParamArrays remote code execution vulnerability
+ MFSA 2010-36 Use-after-free error in NodeIterator
+ MFSA 2010-35 DOM attribute cloning remote code execution vulnerability
+ MFSA 2010-34 Miscellaneous memory safety hazards (rv:1.9.2.7/ 1.9.1.11)
* Sun Jun 27 2010 Alexey Gladkov <legion@altlinux.ru> 3.6.6-alt1.20100626
- New release (3.6.6).
- Fixed:
+ MFSA 2010-33 User tracking across sites using Math.random()
+ MFSA 2010-32 Content-Disposition: attachment ignored if Content-Type: multipart also present
+ MFSA 2010-31 focus() behavior can be used to inject or steal keystrokes
+ MFSA 2010-30 Integer Overflow in XSLT Node Sorting
+ MFSA 2010-29 Heap buffer overflow in nsGenericDOMDataNode::SetTextInternal
+ MFSA 2010-28 Freed object reuse across plugin instances
+ MFSA 2010-26 Crashes with evidence of memory corruption (rv:1.9.2.4/ 1.9.1.10)
* Mon Apr 05 2010 Alexey Gladkov <legion@altlinux.ru> 3.6.3-alt1.20100404
- New release (3.6.3).
- Fixed:
+ MFSA 2009-25 Re-use of freed object due to scope confusion
* Mon Mar 29 2010 Alexey Gladkov <legion@altlinux.ru> 3.6.2-alt1.20100328
- New release (3.6.2).
- Fix for Transport Layer Security (ALT#22994).
- Fix addons search (ALT#22878).
- Fix release notes (ALT#22883).
- Fixed:
+ MFSA 2010-15 Asynchronous Auth Prompt attaches to wrong window
+ MFSA 2010-14 Browser chrome defacement via cached XUL stylesheets
+ MFSA 2010-13 Content policy bypass with image preloading
+ MFSA 2010-12 XSS using addEventListener and setTimeout on a wrapped object
+ MFSA 2010-11 Crashes with evidence of memory corruption (rv:1.9.2.2/ 1.9.1.8/ 1.9.0.18)
+ MFSA 2010-10 XSS via plugins and unprotected Location object
+ MFSA 2010-09 Deleted frame reuse in multipart/x-mixed-replace image
+ MFSA 2010-08 WOFF heap corruption due to integer overflow
* Fri Jan 22 2010 Alexey Gladkov <legion@altlinux.ru> 3.6.0-alt1
- New release (3.6.0).
- Fix process name (ALT#22731).
* Thu Jan 07 2010 Alexey Gladkov <legion@altlinux.ru> 3.6.0-alt0.20100113
- New snapshot (3.6.0 20100113).
* Mon Nov 24 2009 Alexey Gladkov <legion@altlinux.ru> 3.6.0-alt0.20091124
- New major branch (3.6.0 b4pre).
* Sun Oct 11 2009 Alexey Gladkov <legion@altlinux.ru> 3.5.3-alt0.20091010
- New snapshot (3.5.3 20091010).
- KDE: Update patches (ALT#21509).
* Mon Sep 28 2009 Alexey Gladkov <legion@altlinux.ru> 3.5.3-alt0.20090918.1
- Rebuild with new browser-plugins-npapi.
* Sun Sep 20 2009 Alexey Gladkov <legion@altlinux.ru> 3.5.3-alt0.20090918
- New snapshot (3.5.3 20090918).
- Set firefox as default KDE/KDE4 browser (ALT#21509).
- Update desktop file (ALT#21510).
- Update requires (ALT#21533).
* Tue Sep 01 2009 Alexey Gladkov <legion@altlinux.ru> 3.5.3-alt0.20090831
- New snapshot (3.5.3 20090831).
* Fri Jul 17 2009 Alexey Gladkov <legion@altlinux.ru> 3.5.1-alt1
- New release (3.5.1).
* Wed Jul 01 2009 Alexey Gladkov <legion@altlinux.ru> 3.5-alt2
- New release (3.5).
* Thu Jun 04 2009 Alexey Gladkov <legion@altlinux.ru> 3.5-alt1.20090601
- New snapshot (3.5 20090601).
* Wed Apr 24 2009 Alexey Gladkov <legion@altlinux.ru> 3.5-alt1.20090424
- New snapshot (3.5 20090424).
* Sun Jan 18 2009 Alexey Gladkov <legion@altlinux.ru> 3.1-alt1.20090312
- New snapshot (3.1 20090312).
* Tue Nov 18 2008 Alexey Gladkov <legion@altlinux.ru> 3.0.4-alt1
- New release (3.0.4).
- Fixed:
+ MFSA 2008-58 Parsing error in E4X default namespace
+ MFSA 2008-57 -moz-binding property bypasses security checks on codebase principals
+ MFSA 2008-56 nsXMLHttpRequest::NotifyEventListeners() same-origin violation
+ MFSA 2008-55 Crash and remote code execution in nsFrameManager
+ MFSA 2008-54 Buffer overflow in http-index-format parser
+ MFSA 2008-53 XSS and JavaScript privilege escalation via session restore
+ MFSA 2008-52 Crashes with evidence of memory corruption (rv:1.9.0.4/1.8.1.18)
+ MFSA 2008-51 file: URIs inherit chrome privileges when opened from chrome
+ MFSA 2008-47 Information stealing via local shortcut files
* Wed Oct 08 2008 Alexey Gladkov <legion@altlinux.ru> 3.0.3-alt1
- New release (3.0.3).
- Firefox set itself as default browser correctly (ALT#17384).
- Reload new plugins.
- Fixed:
+ MFSA 2008-44 resource: traversal vulnerabilities
+ MFSA 2008-43 BOM characters stripped from JavaScript before execution
+ MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17)
+ MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution
+ MFSA 2008-40 Forced mouse drag
* Tue Sep 09 2008 Alexey Gladkov <legion@altlinux.ru> 3.0.1-alt2
- New bugfix build.
- Update desktop file (ALT#10558).
* Fri Jul 18 2008 Alexey Gladkov <legion@altlinux.ru> 3.0.1-alt1
- New version (3.0.1).
- Fixed:
+ MFSA 2008-36 Crash with malformed GIF file on Mac OS X
+ MFSA 2008-35 Command-line URLs launch multiple tabs when Firefox not running
+ MFSA 2008-34 Remote code execution by overflowing CSS reference counter
* Sun Jul 13 2008 Alexey Gladkov <legion@altlinux.ru> 3.0-alt2.20080704
- New bugfix build.
- Add searchplugins: bugzilla@altlinux, wikipedia-ru, yandex.
- Remove RPATH.
* Fri Jul 04 2008 Alexey Gladkov <legion@altlinux.ru> 3.0-alt1.20080704
- New cvs snapshot 3.0 (20080704).
* Sat May 31 2008 Alexey Gladkov <legion@altlinux.ru> 3.0-alt1.20080530
- New cvs snapshot 20080530.
* Tue May 20 2008 Alexey Gladkov <legion@altlinux.ru> 3.0-alt1.20080519
- New cvs snapshot (3.0 rc1).
* Sun Feb 03 2008 Alexey Gladkov <legion@altlinux.ru> 3.0-alt1.b3pre
- New cvs snapshot.
* Thu Dec 20 2007 Alexey Gladkov <legion@altlinux.ru> 3.0.b2-alt1
- New major beta version 3.0.b2
* Wed Nov 28 2007 Alexey Gladkov <legion@altlinux.ru> 3.0.b1-alt1
- New major beta version 3.0.b1
* Sun Feb 25 2007 Alexey Gladkov <legion@altlinux.ru> 2.0.0.2-alt1
- New bugfix version 2.0.0.2
- Remove version from requires in *.pc.
- Fixed:
+ MFSA 2007-07 Embedded nulls in location.hostname confuse same-domain checks
+ MFSA 2007-06 Mozilla Network Security Services (NSS) SSLv2 buffer overflow
+ MFSA 2007-05 XSS and local file access by opening blocked popups
+ MFSA 2007-04 Spoofing using custom cursor and CSS3 hotspot
+ MFSA 2007-03 Information disclosure through cache collisions
+ MFSA 2007-02 Improvements to help protect against Cross-Site Scripting attacks
+ MFSA 2007-01 Crashes with evidence of memory corruption (rv:1.8.0.10/1.8.1.2)
* Sun Jan 28 2007 Alexey Gladkov <legion@altlinux.ru> 2.0.0.1-alt1
- New minor version 2.0.0.1
- Fixed:
+ MFSA 2006-76 XSS using outer window's Function object
+ MFSA 2006-75 RSS Feed-preview referrer leak
+ MFSA 2006-73 Mozilla SVG Processing Remote Code Execution
+ MFSA 2006-72 XSS by setting img.src to javascript: URI
+ MFSA 2006-71 LiveConnect crash finalizing JS objects
+ MFSA 2006-70 Privilege escalation using watch point
+ MFSA 2006-69 CSS cursor image buffer overflow (Windows only)
+ MFSA 2006-68 Crashes with evidence of memory corruption (rv:1.8.0.9/1.8.1.1)
* Thu Nov 23 2006 Alexey Gladkov <legion@altlinux.ru> 2.0-alt2
- Add %%pre script.
- Remove version specific paths.
* Sat Oct 28 2006 Alexey Gladkov <legion@altlinux.ru> 2.0-alt1
- New major version 2.0 .
- Don't build libxul.
- Add support for printing via Pango.
- Change printer paper size at A4.
- Check compatibility disabled.
- Patch disabling OS_TEST autoguessing for %%ix86 builds on x86_64 host.
* Fri Sep 15 2006 Alexey Gladkov <legion@altlinux.ru> 1.5.0.7-alt1
- New version 1.5.0.7 .
- Fixed:
+ MFSA 2006-64 Crashes with evidence of memory corruption (rv:1.8.0.7)
+ MFSA 2006-62 Popup-blocker cross-site scripting (XSS)
+ MFSA 2006-61 Frame spoofing using document.open()
+ MFSA 2006-60 RSA Signature Forgery
+ MFSA 2006-59 Concurrency-related vulnerability
+ MFSA 2006-58 Auto-Update compromise through DNS and SSL spoofing
+ MFSA 2006-57 JavaScript Regular Expression Heap Corruption
* Wed Aug 30 2006 Alexey Gladkov <legion@altlinux.ru> 1.5.0.6-alt4
- Add libgtkembedmoz.so, firefox-gtkembedmoz.pc .
- Update BuildRequires.
* Wed Aug 16 2006 Alexey Gladkov <legion@altlinux.ru> 1.5.0.6-alt3
- bugfix build.
- Patch to enable intl.locale.matchOS was removed.
- Added default download directory.
* Wed Aug 09 2006 Alexey Gladkov <legion@altlinux.ru> 1.5.0.6-alt2
- bugfix build.
- Added patch to handle #9863 (history #4352).
* Sat Aug 05 2006 Alexey Gladkov <legion@altlinux.ru> 1.5.0.6-alt1
- New version 1.5.0.6 .
- Fixed:
+ Fixed an issue with playing Windows Media content
+ MFSA 2006-56 chrome: scheme loading remote content
+ MFSA 2006-55 Crashes with evidence of memory corruption (rv:1.8.0.5)
+ MFSA 2006-54 XSS with XPCNativeWrapper(window).Function(...)
+ MFSA 2006-53 UniversalBrowserRead privilege escalation
+ MFSA 2006-52 PAC privilege escalation using Function.prototype.call
+ MFSA 2006-51 Privilege escalation using named-functions and redefined "new Object()"
+ MFSA 2006-50 JavaScript engine vulnerabilities
+ MFSA 2006-48 JavaScript new Function race condition
+ MFSA 2006-47 Native DOM methods can be hijacked across domains
+ MFSA 2006-46 Memory corruption with simultaneous events
+ MFSA 2006-45 Javascript navigator Object Vulnerability
+ MFSA 2006-44 Code execution through deleted frame reference
* Thu Jun 08 2006 Alexey Gladkov <legion@altlinux.ru> 1.5.0.4-alt1
- New version.
- Fixed:
+ MFSA 2006-43 Privilege escalation using addSelectionListener
+ MFSA 2006-42 Web site XSS using BOM on UTF-8 pages
+ MFSA 2006-41 File stealing by changing input type (variant)
+ MFSA 2006-39 "View Image" local resource linking (Windows)
+ MFSA 2006-38 Buffer overflow in crypto.signText()
+ MFSA 2006-37 Remote compromise via content-defined setter on object prototypes
+ MFSA 2006-36 PLUGINSPAGE privileged JavaScript execution 2
+ MFSA 2006-35 Privilege escalation through XUL persist
+ MFSA 2006-34 XSS viewing javascript: frames or images from context menu
+ MFSA 2006-33 HTTP response smuggling
+ MFSA 2006-32 Fixes for crashes with potential memory corruption
+ MFSA 2006-31 EvalInSandbox escape (Proxy Autoconfig, Greasemonkey)
* Fri May 12 2006 Alexey Gladkov <legion@altlinux.ru> 1.5.0.3-alt1
- New version.
- Build libxul library.
- Fixed:
+ MFSA 2006-30 Deleted object reference when designMode="on".
* Wed Mar 15 2006 Alexey Gladkov <legion@altlinux.ru> 1.5.0.1-alt2
- bugfix build.
- include fix
- plugins directory fix;
* Mon Feb 13 2006 Alexey Gladkov <legion@altlinux.ru> 1.5.0.1-alt1
- New version 1.5.0.1
- Buildrequires updated for xorg-7.0
- run-firefox script bugfix:
* usage update
* plugins search path (x86_64)
* unparseable commands handling
- bugfix: #7334, #7682, #8757, #8784, #9017
* Sun Dec 04 2005 Alexey Gladkov <legion@altlinux.ru> 1.5-alt1
- New version 1.5 .
- Spec cleanup.
- Build with external rpm-build-firefox .
- Build with system NSS and NSPR.
- Unused libraries removed.
- Rpm mascros bugfix.
* fix for new rpm.
* change extension installation sheme (again).
- Default preference tunning.
- Startup script rewritten. Now it is single script.
* command line shortcut added: altfaq:NUM .
- SVG support enabled.
- directory /usr/share/firefox-@version@/extensions was added to extensions search path .
* this location is controled by the option extensions.dir.extensions .
- Bug: #7682, #7801, #7856, #7949 fixed.
* Tue Aug 16 2005 Alexey Gladkov <legion@altlinux.ru> 1.0.6-alt4
- major bugfix.
- build with official branding.
- x86_64 compatibility addon (patch20, patch21).
* Sun Aug 07 2005 Alexey Gladkov <legion@altlinux.ru> 1.0.6-alt3
- release version.
- firsttime script added.
- SVG support disabled.
- Patch #2 bugfix (bug: #7682)
* Sun Jul 24 2005 LAKostis <lakostis at altlinux.ru> 1.0.6-alt2.cvs
- fix -nox patch.
- add gssapi detection and build fixes from mhz@.
* Tue Jul 19 2005 LAKostis <lakostis at altlinux.ru> 1.0.6-alt1.cvs
- new version from aviary branch fixing various bugs:
+ MFSA2005-54
+ Restore API compatibility for extensions and web applications
that did not work in Firefox 1.0.5.
* Mon Jul 11 2005 LAKostis <lakostis at altlinux.ru> 1.0.5-alt2.cvs
- new version from aviary branch;
* Wed Jun 22 2005 LAKostis <lakostis at altlinux.ru> 1.0.5-alt1.cvs
- new version from aviary branch fixing various security bugs;
- fix: #4846, #5101, #7126 (legion).
- if_{with,without} debug - added (legion).
- keyword 'altbug:' added, patch2 updated (legion).
- postin/postun-scripts scripts bugfixes (legion).
- triggers added for trash cleanup (legion).
* Mon Jun 20 2005 LAKostis <lakostis at altlinux.ru> 1.0.5-alt0.cvs
- new version from aviary branch;
- fix #6595;
- add switches for svg/xprint easy builds.
- update alt-prefs-tuning.patch (disable annoying default browser dialog).
* Sun Jun 12 2005 LAKostis <lakostis at altlinux.ru> 1.0.4-alt1
- new version;
- SA15601 security fix;
- BuildRequires cleanup (remove xorg-x11-libs-static).
* Thu Apr 21 2005 Alexey Gladkov <legion@altlinux.ru> 1.0.3-alt1
- new version;
- requires fix;
* Wed Apr 13 2005 Alexey Gladkov <legion@altlinux.ru> 1.0.2-alt1
- new version;
- RPATH fix;
- NoX patch was rewritten;
* Sun Mar 06 2005 Alexey Gladkov <legion@altlinux.ru> 1.0.1-alt2
- rpm macros was updated;
* Fri Feb 25 2005 Alexey Gladkov <legion@altlinux.ru> 1.0.1-alt1
- new version;
- patch9 was added (mozilla Bug #123315);
- patch10, patch11 was added (#6151);
* Mon Feb 14 2005 Alexey Gladkov <legion@altlinux.ru> 1.0-alt7
- plugins path bugfix;
- svg support added;
- x86_64 compatibility added (thx mouse@);
* Tue Feb 01 2005 Alexey Gladkov <legion@altlinux.ru> 1.0-alt6
- update patch firefox-1.0-20050201-alt-nox.patch
* uninstall-global-theme command-line option was added;
* update-register command-line option was added;
- firefox-1.0-alt-rpm-scripts.tar.bz2 bugfix;
* Thu Jan 27 2005 Alexey Gladkov <legion@altlinux.ru> 1.0-alt5
- disable svg support becouse svg layout lead to segfault
when mozilla compile with gcc3.4 .
- search plugins was moved into the standalone rpm package.
* Wed Jan 19 2005 Alexey Gladkov <legion@altlinux.ru> 1.0-alt4
- Rebuilt with libstdc++.so.6.
* Wed Jan 05 2005 Alexey Gladkov <legion@altlinux.ru> 1.0-alt3
- new version;
- browser-plugins-npapi support added;
- new icons default icons(thx shrek@);
- option uninstall-global-extension was fixed;
* Wed Nov 03 2004 Alexey Gladkov <legion@altlinux.ru> 1.0-alt2.rc1
- extension sheme changes;
- postin/preun scripts chenges;
* Mon Oct 18 2004 Alexey Gladkov <legion@altlinux.ru> 1.0-alt2.PR
- new default extensions added;
- protocol 'mailto' external handler added;
- firefox.macro changed;
- postun script changed;
- icons changed;
* Thu Sep 30 2004 Alexey Gladkov <legion@altlinux.ru> 1.0-alt1.PR
- New version 1.0PR;
- New extension scheme;
- Add:
* New option 'run-without-x' added (mouse, legion);
* SVG support added;
* Certificate (ALT Linux CA Root) added;
* ALT Linux BTS search plugin added;
* RPATH added to all binary files;
- bug #4284 fixed;
* Fri May 28 2004 Alexey Gladkov <legion@altlinux.ru> 0.8-alt4
- Move back some changes at alt3 build.
- Bug #4157 fixed.
* Fri Apr 30 2004 Alexey Gladkov <legion@altlinux.ru> 0.8-alt3.1
- viewsource protocol was added.
* Thu Apr 29 2004 Alexey Gladkov <legion@altlinux.ru> 0.8-alt3
- Minimize buildin extensions;
- Disable debug output;
- Disable some options:
+ disable JavaScript debug library;
+ disable LDAP support;
+ disable logging facilities;
- Necko protocols cleanup;
* Tue Feb 24 2004 Alexey Gladkov <legion@altlinux.ru> 0.8-alt2
- Splash screen added (thx sadist@);
- Search plugins added;
- Remove devel package Conflicts;
- Change rebuild-database.sh script. Script must be run only as root;
- Change locale hack.
* Wed Feb 11 2004 Alexey Gladkov <legion@altlinux.ru> 0.8-alt1
- Mozilla Firebird becomes Mozilla Firefox. Mozilla's next
generation browser has changed names (again);
- New version;
* Sun Jan 11 2004 Alexey Gladkov <legion@altlinux.ru> 0.7-alt2
- Spec changes.
- run-mozilla.sh script patch.
* Tue Dec 30 2003 Alexey Gladkov <legion@altlinux.ru> 0.7-alt1
- first build for ALT Linux.
- rpm macro created.
- new scheme loading extensions added (thx force@)