<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="14">
<package pkgid="ad4d0994dd67076406165b432595d64140dc2b9fbd165711657970ffbb06d105" name="MozillaFirefox" arch="i686">
  <version epoch="0" ver="101.99" rel="4.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1643544000">- disable ccache, this adds about 1 minute of build time and
  over 2 GB of disk space usage without benefit on OBS builds
- build with rust-simd like upstream does
- use -g1 for debuginfo generation as this is what upstream
  does as well and it saves ~ 2GB of writes
- use %limit on x86_64 to scale down to less capable workers
- disable install stripping so that debuginfo is useful
- use autopatch
- cleanup constraints to specify only jobs, physicalmemory
  and memoryperjob to be more flexible on which host to build
  on</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644235200">- remove memoryperjob and use %limit instead. this allows to
  adapt to more worker types, and lowers the time the package
  is stuck in "scheduling". raising memory above 8 to lower
  risk for LTO jobs to run OOM
- add hack to disable -Wl,--gc-section which avoids a binutils
  segfault on x86
- change mozilla-reduce-rust-debuginfo.patch: use -g1 everywhere</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1644321600">- Mozilla Firefox 97.0
  MFSA 2022-04 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during update
  * CVE-2022-22755 (bmo#1309630)
    XSL could have allowed JavaScript execution after a tab was closed
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22757 (bmo#1720098)
    Remote Agent did not prevent local websites from connecting
  * CVE-2022-22758 (bmo#1728742)
    tel: links could have sent USSD codes to the dialer on
    Firefox for Android
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22762 (bmo#1743931)
    JavaScript Dialogs could have been displayed over other
    domains on Firefox for Android
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6
  * CVE-2022-0511 (bmo#1713579, bmo#1735448, bmo#1743821, bmo#1746313,
    bmo#1746314, bmo#1746316, bmo#1746321, bmo#1746322, bmo#1746323,
    bmo#1746412, bmo#1746430, bmo#1746451, bmo#1746488, bmo#1746875,
    bmo#1746898, bmo#1746905, bmo#1746907, bmo#1746917, bmo#1747128,
    bmo#1747137, bmo#1747331, bmo#1747346, bmo#1747439, bmo#1747457,
    bmo#1747870, bmo#1749051, bmo#1749274, bmo#1749831)
    Memory safety bugs fixed in Firefox 97
- requires NSS 3.74
- requires rust 1.57</changelog>
  <changelog author="Luciano Santos &lt;luc14n0@opensuse.org&gt;" date="1644840000">- Remove bashisms ("source" and "function" keywords) from
  mozilla.sh.in to ally with the #!/bin/sh shebang. If the end user
  has either dash-sh package or busybox-sh to handle Bourn Shell
  scripts rather than having bash-sh package, the script would
  fail. Using "." instead of "source" and "create_langpack_link()"
  function definition is enough to keep both sides sane,
  behavior-wise.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645185600">- Mozilla Firefox 97.0.1
  * Fixed: Fixed an issue where TikTok videos would fail to load
    when selected from a user's profile page (bmo#1750973)
  * Fixed: Fixed an issue which led to Picture-in-Picture mode
    being unable to be toggled on Hulu (bmo#1753401)
  * Fixed: Works around problems with WebRoot SecureAnywhere
    antivirus rendering Firefox unusable in some situations
    (bmo#1752466)
  * Fixed: Fixed an issue causing users to see the Restore
    Session screen unexpectedly when starting Firefox
    (bmo#1749996)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1646740800">- Mozilla Firefox 98.0
  * Firefox has a new optimized download flow
  * other changes as documented here
    https://www.mozilla.org/en-US/firefox/98.0/releasenotes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26382 (bmo#1741888)
    Autofill Text could be exfiltrated via side-channel attacks
  * CVE-2022-26385 (bmo#1747526)
    Use-after-free in thread shutdown
  * CVE-2022-0843 (bmo#1746523, bmo#1749062, bmo#1749164, bmo#1749214,
    bmo#1749610, bmo#1750032, bmo#1752100, bmo#1752405, bmo#1753612,
    bmo#1754508)
    Memory safety bugs fixed in Firefox 98
- requires NSS 3.75
- add mozilla-bmo1756347.patch to fix i586 build</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1647259200">- Mozilla Firefox 98.0.1:
  * Yandex and Mail.ru have been removed as optional search
    providers in the drop-down search menu in Firefox</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647518401">- exclude slow cpus for building</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1647950400">- Add patch to fix start-up on aarch64:
  * mozilla-bmo1757571.patch</changelog>
  <changelog author="Simon Vogl &lt;simon.vogl@gmx.net&gt;" date="1648036800">- Change mozilla-kde.patch to follow the GNOME registry
  behavior for new MIME types to avoid opening downloaded files
  without any inquiries (bsc#1197319)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1648123200">- MozillaFirefox 98.0.2:
  * Fixed: Fixed an issue preventing users from typing in Address
    Bar after opening new tab and pressing cmd + enter
    (bmo#1757376)
  * Fixed: Fixed an issue causing some users to crash in out-of-
    memory conditions (bmo#1757618)
  * Fixed: Fixed an issue in session history which caused some
    sites to fail to load (bmo#1758664)
  * Fixed: Fixed an add-on specific compatibility issue
    (bmo#1759162)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1649073600">- Mozilla Firefox 99.0
  * You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  * You can find added support for search?with or without
    diacritics?in the PDF viewer.
  * The Linux sandbox has been strengthened: processes exposed to web
    content no longer have access to the X Window system (X11).
  * Firefox now supports credit card autofill and capture in
    Germany and France.
  MFSA 2022-13 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28283 (bmo#1754066)
    Missing security checks for fetching sourceMapURL
  * CVE-2022-28284 (bmo#1754522)
    Script could be executed via svg's use element
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-28287 (bmo#1741515)
    Text Selection could crash Firefox
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8
  * CVE-2022-28288 (bmo#1746415, bmo#1746495, bmo#1746500,
    bmo#1747282, bmo#1748759, bmo#1749056, bmo#1749786,
    bmo#1751679, bmo#1752120, bmo#1756010, bmo#1756017,
    bmo#1757213, bmo#1757258, bmo#1757427)
    Memory safety bugs fixed in Firefox 99
- requires NSS &gt;= 3.76.1
- remove obsolete patch
  * mozilla-bmo1756347.patch
  * mozilla-bmo1757571.patch
- update create-tar.sh</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1649764800">- Mozilla Firefox 99.0.1
  * Fixed an issue with text rendering in Bengali (bmo#1763368)
  * Fixed a selection issue in the Download panel with drag and
    drop (bmo#1762723)
  * Fixed: Fixed an issue preventing Zoom gallery mode for users
    who go to zoom.us URLs instead of subdomain.zoom.us URLs
    (bmo#1763801)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1651406400">- Mozilla Firefox 100.0
  * subtitle support in PiP
  * spell checking supports multiple languages in parallel
  * more details here
    https://www.mozilla.org/en-US/firefox/100.0/releasenotes
  MFSA 2022-16 (boo#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29910 (bmo#1757138)
    Firefox for Android forgot HTTP Strict Transport Security
    settings
  * CVE-2022-29915 (bmo#1751678)
    Leaking cross-origin redirect through the Performance API
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9
  * CVE-2022-29918 (bmo#1744043, bmo#1747178, bmo#1753535,
    bmo#1754017, bmo#1755847, bmo#1756172, bmo#1757477,
    bmo#1758223, bmo#1760160, bmo#1761481, bmo#1761771)
    Memory safety bugs fixed in Firefox 100
- requires NSS 3.77</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1652875200">- Mozilla Firefox 100.0.1:
  * Fixed: Fixed an issue with subtitles in Picture-in-Picture
    mode while using Netflix (bmo#1768818)
  * Fixed: Fixed an issue where some commands were unavailable in
    the Picture-in-Picture window (bmo#1768201)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653048000">- Mozilla Firefox 100.0.2
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653825600">- Mozilla Firefox 101.0
  * Reading is now easier with the prefers-contrast media query,
    which allows sites to detect if the user has requested that web
    content is presented with a higher (or lower) contrast
  * All non-configured MIME types can now be assigned a custom
    action upon download completion
  * allows users to use as many microphones as you want, at the
    same time, during video conferencing. The most exciting benefit
    is that you can easily switch your microphones at any time
    (if your conferencing service provider enables this flexibility)
  MFSA 2022-20 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of allowCredential
    entries may have leaked cross-origin information
  * CVE-2022-31743 (bmo#1747388)
    HTML Parsing incorrectly ended HTML comments prematurely
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-31745 (bmo#1760944)
    Incorrect Assertion caused by unoptimized array shift operations
  * CVE-2022-1919 (bmo#1761275)
    Memory Corruption when manipulating webp images
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10
  * CVE-2022-31748 (bmo#1713773, bmo#1762201, bmo#1762469,
    bmo#1762770, bmo#1764878, bmo#1765226, bmo#1765782, bmo#1765973,
    bmo#1767177, bmo#1767181, bmo#1768232, bmo#1768251, bmo#1769869)
    Memory safety bugs fixed in Firefox 101
- requires
  * NSS 3.78.1
  * rust-cbindgen 0.23.0
  * rust 1.59</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1654862400">- Mozilla Firefox 101.0.1:
  * Fixed context menus not appearing when right-clicking
    Picture-in-Picture windows on some Linux systems (bmo#1771914)
  * Various stability fixes</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1655812800">- Firefox 102.0 (build1)
- requires
  NSPR &gt;= 4.34
  NSS &gt;= 3.79
  rust = 1.60</changelog>
</package>
<package pkgid="ed394124849413d73335a872eba4d6cfd3ea1e52a40fef334c9bd20409247a8c" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="101.99" rel="4.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1643544000">- disable ccache, this adds about 1 minute of build time and
  over 2 GB of disk space usage without benefit on OBS builds
- build with rust-simd like upstream does
- use -g1 for debuginfo generation as this is what upstream
  does as well and it saves ~ 2GB of writes
- use %limit on x86_64 to scale down to less capable workers
- disable install stripping so that debuginfo is useful
- use autopatch
- cleanup constraints to specify only jobs, physicalmemory
  and memoryperjob to be more flexible on which host to build
  on</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644235200">- remove memoryperjob and use %limit instead. this allows to
  adapt to more worker types, and lowers the time the package
  is stuck in "scheduling". raising memory above 8 to lower
  risk for LTO jobs to run OOM
- add hack to disable -Wl,--gc-section which avoids a binutils
  segfault on x86
- change mozilla-reduce-rust-debuginfo.patch: use -g1 everywhere</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1644321600">- Mozilla Firefox 97.0
  MFSA 2022-04 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during update
  * CVE-2022-22755 (bmo#1309630)
    XSL could have allowed JavaScript execution after a tab was closed
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22757 (bmo#1720098)
    Remote Agent did not prevent local websites from connecting
  * CVE-2022-22758 (bmo#1728742)
    tel: links could have sent USSD codes to the dialer on
    Firefox for Android
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22762 (bmo#1743931)
    JavaScript Dialogs could have been displayed over other
    domains on Firefox for Android
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6
  * CVE-2022-0511 (bmo#1713579, bmo#1735448, bmo#1743821, bmo#1746313,
    bmo#1746314, bmo#1746316, bmo#1746321, bmo#1746322, bmo#1746323,
    bmo#1746412, bmo#1746430, bmo#1746451, bmo#1746488, bmo#1746875,
    bmo#1746898, bmo#1746905, bmo#1746907, bmo#1746917, bmo#1747128,
    bmo#1747137, bmo#1747331, bmo#1747346, bmo#1747439, bmo#1747457,
    bmo#1747870, bmo#1749051, bmo#1749274, bmo#1749831)
    Memory safety bugs fixed in Firefox 97
- requires NSS 3.74
- requires rust 1.57</changelog>
  <changelog author="Luciano Santos &lt;luc14n0@opensuse.org&gt;" date="1644840000">- Remove bashisms ("source" and "function" keywords) from
  mozilla.sh.in to ally with the #!/bin/sh shebang. If the end user
  has either dash-sh package or busybox-sh to handle Bourn Shell
  scripts rather than having bash-sh package, the script would
  fail. Using "." instead of "source" and "create_langpack_link()"
  function definition is enough to keep both sides sane,
  behavior-wise.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645185600">- Mozilla Firefox 97.0.1
  * Fixed: Fixed an issue where TikTok videos would fail to load
    when selected from a user's profile page (bmo#1750973)
  * Fixed: Fixed an issue which led to Picture-in-Picture mode
    being unable to be toggled on Hulu (bmo#1753401)
  * Fixed: Works around problems with WebRoot SecureAnywhere
    antivirus rendering Firefox unusable in some situations
    (bmo#1752466)
  * Fixed: Fixed an issue causing users to see the Restore
    Session screen unexpectedly when starting Firefox
    (bmo#1749996)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1646740800">- Mozilla Firefox 98.0
  * Firefox has a new optimized download flow
  * other changes as documented here
    https://www.mozilla.org/en-US/firefox/98.0/releasenotes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26382 (bmo#1741888)
    Autofill Text could be exfiltrated via side-channel attacks
  * CVE-2022-26385 (bmo#1747526)
    Use-after-free in thread shutdown
  * CVE-2022-0843 (bmo#1746523, bmo#1749062, bmo#1749164, bmo#1749214,
    bmo#1749610, bmo#1750032, bmo#1752100, bmo#1752405, bmo#1753612,
    bmo#1754508)
    Memory safety bugs fixed in Firefox 98
- requires NSS 3.75
- add mozilla-bmo1756347.patch to fix i586 build</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1647259200">- Mozilla Firefox 98.0.1:
  * Yandex and Mail.ru have been removed as optional search
    providers in the drop-down search menu in Firefox</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647518401">- exclude slow cpus for building</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1647950400">- Add patch to fix start-up on aarch64:
  * mozilla-bmo1757571.patch</changelog>
  <changelog author="Simon Vogl &lt;simon.vogl@gmx.net&gt;" date="1648036800">- Change mozilla-kde.patch to follow the GNOME registry
  behavior for new MIME types to avoid opening downloaded files
  without any inquiries (bsc#1197319)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1648123200">- MozillaFirefox 98.0.2:
  * Fixed: Fixed an issue preventing users from typing in Address
    Bar after opening new tab and pressing cmd + enter
    (bmo#1757376)
  * Fixed: Fixed an issue causing some users to crash in out-of-
    memory conditions (bmo#1757618)
  * Fixed: Fixed an issue in session history which caused some
    sites to fail to load (bmo#1758664)
  * Fixed: Fixed an add-on specific compatibility issue
    (bmo#1759162)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1649073600">- Mozilla Firefox 99.0
  * You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  * You can find added support for search?with or without
    diacritics?in the PDF viewer.
  * The Linux sandbox has been strengthened: processes exposed to web
    content no longer have access to the X Window system (X11).
  * Firefox now supports credit card autofill and capture in
    Germany and France.
  MFSA 2022-13 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28283 (bmo#1754066)
    Missing security checks for fetching sourceMapURL
  * CVE-2022-28284 (bmo#1754522)
    Script could be executed via svg's use element
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-28287 (bmo#1741515)
    Text Selection could crash Firefox
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8
  * CVE-2022-28288 (bmo#1746415, bmo#1746495, bmo#1746500,
    bmo#1747282, bmo#1748759, bmo#1749056, bmo#1749786,
    bmo#1751679, bmo#1752120, bmo#1756010, bmo#1756017,
    bmo#1757213, bmo#1757258, bmo#1757427)
    Memory safety bugs fixed in Firefox 99
- requires NSS &gt;= 3.76.1
- remove obsolete patch
  * mozilla-bmo1756347.patch
  * mozilla-bmo1757571.patch
- update create-tar.sh</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1649764800">- Mozilla Firefox 99.0.1
  * Fixed an issue with text rendering in Bengali (bmo#1763368)
  * Fixed a selection issue in the Download panel with drag and
    drop (bmo#1762723)
  * Fixed: Fixed an issue preventing Zoom gallery mode for users
    who go to zoom.us URLs instead of subdomain.zoom.us URLs
    (bmo#1763801)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1651406400">- Mozilla Firefox 100.0
  * subtitle support in PiP
  * spell checking supports multiple languages in parallel
  * more details here
    https://www.mozilla.org/en-US/firefox/100.0/releasenotes
  MFSA 2022-16 (boo#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29910 (bmo#1757138)
    Firefox for Android forgot HTTP Strict Transport Security
    settings
  * CVE-2022-29915 (bmo#1751678)
    Leaking cross-origin redirect through the Performance API
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9
  * CVE-2022-29918 (bmo#1744043, bmo#1747178, bmo#1753535,
    bmo#1754017, bmo#1755847, bmo#1756172, bmo#1757477,
    bmo#1758223, bmo#1760160, bmo#1761481, bmo#1761771)
    Memory safety bugs fixed in Firefox 100
- requires NSS 3.77</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1652875200">- Mozilla Firefox 100.0.1:
  * Fixed: Fixed an issue with subtitles in Picture-in-Picture
    mode while using Netflix (bmo#1768818)
  * Fixed: Fixed an issue where some commands were unavailable in
    the Picture-in-Picture window (bmo#1768201)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653048000">- Mozilla Firefox 100.0.2
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653825600">- Mozilla Firefox 101.0
  * Reading is now easier with the prefers-contrast media query,
    which allows sites to detect if the user has requested that web
    content is presented with a higher (or lower) contrast
  * All non-configured MIME types can now be assigned a custom
    action upon download completion
  * allows users to use as many microphones as you want, at the
    same time, during video conferencing. The most exciting benefit
    is that you can easily switch your microphones at any time
    (if your conferencing service provider enables this flexibility)
  MFSA 2022-20 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of allowCredential
    entries may have leaked cross-origin information
  * CVE-2022-31743 (bmo#1747388)
    HTML Parsing incorrectly ended HTML comments prematurely
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-31745 (bmo#1760944)
    Incorrect Assertion caused by unoptimized array shift operations
  * CVE-2022-1919 (bmo#1761275)
    Memory Corruption when manipulating webp images
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10
  * CVE-2022-31748 (bmo#1713773, bmo#1762201, bmo#1762469,
    bmo#1762770, bmo#1764878, bmo#1765226, bmo#1765782, bmo#1765973,
    bmo#1767177, bmo#1767181, bmo#1768232, bmo#1768251, bmo#1769869)
    Memory safety bugs fixed in Firefox 101
- requires
  * NSS 3.78.1
  * rust-cbindgen 0.23.0
  * rust 1.59</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1654862400">- Mozilla Firefox 101.0.1:
  * Fixed context menus not appearing when right-clicking
    Picture-in-Picture windows on some Linux systems (bmo#1771914)
  * Various stability fixes</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1655812800">- Firefox 102.0 (build1)
- requires
  NSPR &gt;= 4.34
  NSS &gt;= 3.79
  rust = 1.60</changelog>
</package>
<package pkgid="9df3e436a2d23445dc4610595c0c92997bd49bdf583a173b37d79af781ceff35" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="101.99" rel="4.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1643544000">- disable ccache, this adds about 1 minute of build time and
  over 2 GB of disk space usage without benefit on OBS builds
- build with rust-simd like upstream does
- use -g1 for debuginfo generation as this is what upstream
  does as well and it saves ~ 2GB of writes
- use %limit on x86_64 to scale down to less capable workers
- disable install stripping so that debuginfo is useful
- use autopatch
- cleanup constraints to specify only jobs, physicalmemory
  and memoryperjob to be more flexible on which host to build
  on</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644235200">- remove memoryperjob and use %limit instead. this allows to
  adapt to more worker types, and lowers the time the package
  is stuck in "scheduling". raising memory above 8 to lower
  risk for LTO jobs to run OOM
- add hack to disable -Wl,--gc-section which avoids a binutils
  segfault on x86
- change mozilla-reduce-rust-debuginfo.patch: use -g1 everywhere</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1644321600">- Mozilla Firefox 97.0
  MFSA 2022-04 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during update
  * CVE-2022-22755 (bmo#1309630)
    XSL could have allowed JavaScript execution after a tab was closed
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22757 (bmo#1720098)
    Remote Agent did not prevent local websites from connecting
  * CVE-2022-22758 (bmo#1728742)
    tel: links could have sent USSD codes to the dialer on
    Firefox for Android
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22762 (bmo#1743931)
    JavaScript Dialogs could have been displayed over other
    domains on Firefox for Android
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6
  * CVE-2022-0511 (bmo#1713579, bmo#1735448, bmo#1743821, bmo#1746313,
    bmo#1746314, bmo#1746316, bmo#1746321, bmo#1746322, bmo#1746323,
    bmo#1746412, bmo#1746430, bmo#1746451, bmo#1746488, bmo#1746875,
    bmo#1746898, bmo#1746905, bmo#1746907, bmo#1746917, bmo#1747128,
    bmo#1747137, bmo#1747331, bmo#1747346, bmo#1747439, bmo#1747457,
    bmo#1747870, bmo#1749051, bmo#1749274, bmo#1749831)
    Memory safety bugs fixed in Firefox 97
- requires NSS 3.74
- requires rust 1.57</changelog>
  <changelog author="Luciano Santos &lt;luc14n0@opensuse.org&gt;" date="1644840000">- Remove bashisms ("source" and "function" keywords) from
  mozilla.sh.in to ally with the #!/bin/sh shebang. If the end user
  has either dash-sh package or busybox-sh to handle Bourn Shell
  scripts rather than having bash-sh package, the script would
  fail. Using "." instead of "source" and "create_langpack_link()"
  function definition is enough to keep both sides sane,
  behavior-wise.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645185600">- Mozilla Firefox 97.0.1
  * Fixed: Fixed an issue where TikTok videos would fail to load
    when selected from a user's profile page (bmo#1750973)
  * Fixed: Fixed an issue which led to Picture-in-Picture mode
    being unable to be toggled on Hulu (bmo#1753401)
  * Fixed: Works around problems with WebRoot SecureAnywhere
    antivirus rendering Firefox unusable in some situations
    (bmo#1752466)
  * Fixed: Fixed an issue causing users to see the Restore
    Session screen unexpectedly when starting Firefox
    (bmo#1749996)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1646740800">- Mozilla Firefox 98.0
  * Firefox has a new optimized download flow
  * other changes as documented here
    https://www.mozilla.org/en-US/firefox/98.0/releasenotes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26382 (bmo#1741888)
    Autofill Text could be exfiltrated via side-channel attacks
  * CVE-2022-26385 (bmo#1747526)
    Use-after-free in thread shutdown
  * CVE-2022-0843 (bmo#1746523, bmo#1749062, bmo#1749164, bmo#1749214,
    bmo#1749610, bmo#1750032, bmo#1752100, bmo#1752405, bmo#1753612,
    bmo#1754508)
    Memory safety bugs fixed in Firefox 98
- requires NSS 3.75
- add mozilla-bmo1756347.patch to fix i586 build</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1647259200">- Mozilla Firefox 98.0.1:
  * Yandex and Mail.ru have been removed as optional search
    providers in the drop-down search menu in Firefox</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647518401">- exclude slow cpus for building</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1647950400">- Add patch to fix start-up on aarch64:
  * mozilla-bmo1757571.patch</changelog>
  <changelog author="Simon Vogl &lt;simon.vogl@gmx.net&gt;" date="1648036800">- Change mozilla-kde.patch to follow the GNOME registry
  behavior for new MIME types to avoid opening downloaded files
  without any inquiries (bsc#1197319)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1648123200">- MozillaFirefox 98.0.2:
  * Fixed: Fixed an issue preventing users from typing in Address
    Bar after opening new tab and pressing cmd + enter
    (bmo#1757376)
  * Fixed: Fixed an issue causing some users to crash in out-of-
    memory conditions (bmo#1757618)
  * Fixed: Fixed an issue in session history which caused some
    sites to fail to load (bmo#1758664)
  * Fixed: Fixed an add-on specific compatibility issue
    (bmo#1759162)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1649073600">- Mozilla Firefox 99.0
  * You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  * You can find added support for search?with or without
    diacritics?in the PDF viewer.
  * The Linux sandbox has been strengthened: processes exposed to web
    content no longer have access to the X Window system (X11).
  * Firefox now supports credit card autofill and capture in
    Germany and France.
  MFSA 2022-13 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28283 (bmo#1754066)
    Missing security checks for fetching sourceMapURL
  * CVE-2022-28284 (bmo#1754522)
    Script could be executed via svg's use element
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-28287 (bmo#1741515)
    Text Selection could crash Firefox
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8
  * CVE-2022-28288 (bmo#1746415, bmo#1746495, bmo#1746500,
    bmo#1747282, bmo#1748759, bmo#1749056, bmo#1749786,
    bmo#1751679, bmo#1752120, bmo#1756010, bmo#1756017,
    bmo#1757213, bmo#1757258, bmo#1757427)
    Memory safety bugs fixed in Firefox 99
- requires NSS &gt;= 3.76.1
- remove obsolete patch
  * mozilla-bmo1756347.patch
  * mozilla-bmo1757571.patch
- update create-tar.sh</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1649764800">- Mozilla Firefox 99.0.1
  * Fixed an issue with text rendering in Bengali (bmo#1763368)
  * Fixed a selection issue in the Download panel with drag and
    drop (bmo#1762723)
  * Fixed: Fixed an issue preventing Zoom gallery mode for users
    who go to zoom.us URLs instead of subdomain.zoom.us URLs
    (bmo#1763801)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1651406400">- Mozilla Firefox 100.0
  * subtitle support in PiP
  * spell checking supports multiple languages in parallel
  * more details here
    https://www.mozilla.org/en-US/firefox/100.0/releasenotes
  MFSA 2022-16 (boo#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29910 (bmo#1757138)
    Firefox for Android forgot HTTP Strict Transport Security
    settings
  * CVE-2022-29915 (bmo#1751678)
    Leaking cross-origin redirect through the Performance API
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9
  * CVE-2022-29918 (bmo#1744043, bmo#1747178, bmo#1753535,
    bmo#1754017, bmo#1755847, bmo#1756172, bmo#1757477,
    bmo#1758223, bmo#1760160, bmo#1761481, bmo#1761771)
    Memory safety bugs fixed in Firefox 100
- requires NSS 3.77</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1652875200">- Mozilla Firefox 100.0.1:
  * Fixed: Fixed an issue with subtitles in Picture-in-Picture
    mode while using Netflix (bmo#1768818)
  * Fixed: Fixed an issue where some commands were unavailable in
    the Picture-in-Picture window (bmo#1768201)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653048000">- Mozilla Firefox 100.0.2
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653825600">- Mozilla Firefox 101.0
  * Reading is now easier with the prefers-contrast media query,
    which allows sites to detect if the user has requested that web
    content is presented with a higher (or lower) contrast
  * All non-configured MIME types can now be assigned a custom
    action upon download completion
  * allows users to use as many microphones as you want, at the
    same time, during video conferencing. The most exciting benefit
    is that you can easily switch your microphones at any time
    (if your conferencing service provider enables this flexibility)
  MFSA 2022-20 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of allowCredential
    entries may have leaked cross-origin information
  * CVE-2022-31743 (bmo#1747388)
    HTML Parsing incorrectly ended HTML comments prematurely
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-31745 (bmo#1760944)
    Incorrect Assertion caused by unoptimized array shift operations
  * CVE-2022-1919 (bmo#1761275)
    Memory Corruption when manipulating webp images
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10
  * CVE-2022-31748 (bmo#1713773, bmo#1762201, bmo#1762469,
    bmo#1762770, bmo#1764878, bmo#1765226, bmo#1765782, bmo#1765973,
    bmo#1767177, bmo#1767181, bmo#1768232, bmo#1768251, bmo#1769869)
    Memory safety bugs fixed in Firefox 101
- requires
  * NSS 3.78.1
  * rust-cbindgen 0.23.0
  * rust 1.59</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1654862400">- Mozilla Firefox 101.0.1:
  * Fixed context menus not appearing when right-clicking
    Picture-in-Picture windows on some Linux systems (bmo#1771914)
  * Various stability fixes</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1655812800">- Firefox 102.0 (build1)
- requires
  NSPR &gt;= 4.34
  NSS &gt;= 3.79
  rust = 1.60</changelog>
</package>
<package pkgid="11a4117a9cf96b46a01a7c2b7545971045a5394431a09acf4bbf4aa985707689" name="MozillaFirefox-branding-upstream" arch="i686">
  <version epoch="0" ver="101.99" rel="4.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1643544000">- disable ccache, this adds about 1 minute of build time and
  over 2 GB of disk space usage without benefit on OBS builds
- build with rust-simd like upstream does
- use -g1 for debuginfo generation as this is what upstream
  does as well and it saves ~ 2GB of writes
- use %limit on x86_64 to scale down to less capable workers
- disable install stripping so that debuginfo is useful
- use autopatch
- cleanup constraints to specify only jobs, physicalmemory
  and memoryperjob to be more flexible on which host to build
  on</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644235200">- remove memoryperjob and use %limit instead. this allows to
  adapt to more worker types, and lowers the time the package
  is stuck in "scheduling". raising memory above 8 to lower
  risk for LTO jobs to run OOM
- add hack to disable -Wl,--gc-section which avoids a binutils
  segfault on x86
- change mozilla-reduce-rust-debuginfo.patch: use -g1 everywhere</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1644321600">- Mozilla Firefox 97.0
  MFSA 2022-04 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during update
  * CVE-2022-22755 (bmo#1309630)
    XSL could have allowed JavaScript execution after a tab was closed
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22757 (bmo#1720098)
    Remote Agent did not prevent local websites from connecting
  * CVE-2022-22758 (bmo#1728742)
    tel: links could have sent USSD codes to the dialer on
    Firefox for Android
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22762 (bmo#1743931)
    JavaScript Dialogs could have been displayed over other
    domains on Firefox for Android
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6
  * CVE-2022-0511 (bmo#1713579, bmo#1735448, bmo#1743821, bmo#1746313,
    bmo#1746314, bmo#1746316, bmo#1746321, bmo#1746322, bmo#1746323,
    bmo#1746412, bmo#1746430, bmo#1746451, bmo#1746488, bmo#1746875,
    bmo#1746898, bmo#1746905, bmo#1746907, bmo#1746917, bmo#1747128,
    bmo#1747137, bmo#1747331, bmo#1747346, bmo#1747439, bmo#1747457,
    bmo#1747870, bmo#1749051, bmo#1749274, bmo#1749831)
    Memory safety bugs fixed in Firefox 97
- requires NSS 3.74
- requires rust 1.57</changelog>
  <changelog author="Luciano Santos &lt;luc14n0@opensuse.org&gt;" date="1644840000">- Remove bashisms ("source" and "function" keywords) from
  mozilla.sh.in to ally with the #!/bin/sh shebang. If the end user
  has either dash-sh package or busybox-sh to handle Bourn Shell
  scripts rather than having bash-sh package, the script would
  fail. Using "." instead of "source" and "create_langpack_link()"
  function definition is enough to keep both sides sane,
  behavior-wise.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645185600">- Mozilla Firefox 97.0.1
  * Fixed: Fixed an issue where TikTok videos would fail to load
    when selected from a user's profile page (bmo#1750973)
  * Fixed: Fixed an issue which led to Picture-in-Picture mode
    being unable to be toggled on Hulu (bmo#1753401)
  * Fixed: Works around problems with WebRoot SecureAnywhere
    antivirus rendering Firefox unusable in some situations
    (bmo#1752466)
  * Fixed: Fixed an issue causing users to see the Restore
    Session screen unexpectedly when starting Firefox
    (bmo#1749996)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1646740800">- Mozilla Firefox 98.0
  * Firefox has a new optimized download flow
  * other changes as documented here
    https://www.mozilla.org/en-US/firefox/98.0/releasenotes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26382 (bmo#1741888)
    Autofill Text could be exfiltrated via side-channel attacks
  * CVE-2022-26385 (bmo#1747526)
    Use-after-free in thread shutdown
  * CVE-2022-0843 (bmo#1746523, bmo#1749062, bmo#1749164, bmo#1749214,
    bmo#1749610, bmo#1750032, bmo#1752100, bmo#1752405, bmo#1753612,
    bmo#1754508)
    Memory safety bugs fixed in Firefox 98
- requires NSS 3.75
- add mozilla-bmo1756347.patch to fix i586 build</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1647259200">- Mozilla Firefox 98.0.1:
  * Yandex and Mail.ru have been removed as optional search
    providers in the drop-down search menu in Firefox</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647518401">- exclude slow cpus for building</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1647950400">- Add patch to fix start-up on aarch64:
  * mozilla-bmo1757571.patch</changelog>
  <changelog author="Simon Vogl &lt;simon.vogl@gmx.net&gt;" date="1648036800">- Change mozilla-kde.patch to follow the GNOME registry
  behavior for new MIME types to avoid opening downloaded files
  without any inquiries (bsc#1197319)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1648123200">- MozillaFirefox 98.0.2:
  * Fixed: Fixed an issue preventing users from typing in Address
    Bar after opening new tab and pressing cmd + enter
    (bmo#1757376)
  * Fixed: Fixed an issue causing some users to crash in out-of-
    memory conditions (bmo#1757618)
  * Fixed: Fixed an issue in session history which caused some
    sites to fail to load (bmo#1758664)
  * Fixed: Fixed an add-on specific compatibility issue
    (bmo#1759162)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1649073600">- Mozilla Firefox 99.0
  * You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  * You can find added support for search?with or without
    diacritics?in the PDF viewer.
  * The Linux sandbox has been strengthened: processes exposed to web
    content no longer have access to the X Window system (X11).
  * Firefox now supports credit card autofill and capture in
    Germany and France.
  MFSA 2022-13 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28283 (bmo#1754066)
    Missing security checks for fetching sourceMapURL
  * CVE-2022-28284 (bmo#1754522)
    Script could be executed via svg's use element
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-28287 (bmo#1741515)
    Text Selection could crash Firefox
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8
  * CVE-2022-28288 (bmo#1746415, bmo#1746495, bmo#1746500,
    bmo#1747282, bmo#1748759, bmo#1749056, bmo#1749786,
    bmo#1751679, bmo#1752120, bmo#1756010, bmo#1756017,
    bmo#1757213, bmo#1757258, bmo#1757427)
    Memory safety bugs fixed in Firefox 99
- requires NSS &gt;= 3.76.1
- remove obsolete patch
  * mozilla-bmo1756347.patch
  * mozilla-bmo1757571.patch
- update create-tar.sh</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1649764800">- Mozilla Firefox 99.0.1
  * Fixed an issue with text rendering in Bengali (bmo#1763368)
  * Fixed a selection issue in the Download panel with drag and
    drop (bmo#1762723)
  * Fixed: Fixed an issue preventing Zoom gallery mode for users
    who go to zoom.us URLs instead of subdomain.zoom.us URLs
    (bmo#1763801)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1651406400">- Mozilla Firefox 100.0
  * subtitle support in PiP
  * spell checking supports multiple languages in parallel
  * more details here
    https://www.mozilla.org/en-US/firefox/100.0/releasenotes
  MFSA 2022-16 (boo#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29910 (bmo#1757138)
    Firefox for Android forgot HTTP Strict Transport Security
    settings
  * CVE-2022-29915 (bmo#1751678)
    Leaking cross-origin redirect through the Performance API
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9
  * CVE-2022-29918 (bmo#1744043, bmo#1747178, bmo#1753535,
    bmo#1754017, bmo#1755847, bmo#1756172, bmo#1757477,
    bmo#1758223, bmo#1760160, bmo#1761481, bmo#1761771)
    Memory safety bugs fixed in Firefox 100
- requires NSS 3.77</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1652875200">- Mozilla Firefox 100.0.1:
  * Fixed: Fixed an issue with subtitles in Picture-in-Picture
    mode while using Netflix (bmo#1768818)
  * Fixed: Fixed an issue where some commands were unavailable in
    the Picture-in-Picture window (bmo#1768201)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653048000">- Mozilla Firefox 100.0.2
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653825600">- Mozilla Firefox 101.0
  * Reading is now easier with the prefers-contrast media query,
    which allows sites to detect if the user has requested that web
    content is presented with a higher (or lower) contrast
  * All non-configured MIME types can now be assigned a custom
    action upon download completion
  * allows users to use as many microphones as you want, at the
    same time, during video conferencing. The most exciting benefit
    is that you can easily switch your microphones at any time
    (if your conferencing service provider enables this flexibility)
  MFSA 2022-20 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of allowCredential
    entries may have leaked cross-origin information
  * CVE-2022-31743 (bmo#1747388)
    HTML Parsing incorrectly ended HTML comments prematurely
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-31745 (bmo#1760944)
    Incorrect Assertion caused by unoptimized array shift operations
  * CVE-2022-1919 (bmo#1761275)
    Memory Corruption when manipulating webp images
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10
  * CVE-2022-31748 (bmo#1713773, bmo#1762201, bmo#1762469,
    bmo#1762770, bmo#1764878, bmo#1765226, bmo#1765782, bmo#1765973,
    bmo#1767177, bmo#1767181, bmo#1768232, bmo#1768251, bmo#1769869)
    Memory safety bugs fixed in Firefox 101
- requires
  * NSS 3.78.1
  * rust-cbindgen 0.23.0
  * rust 1.59</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1654862400">- Mozilla Firefox 101.0.1:
  * Fixed context menus not appearing when right-clicking
    Picture-in-Picture windows on some Linux systems (bmo#1771914)
  * Various stability fixes</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1655812800">- Firefox 102.0 (build1)
- requires
  NSPR &gt;= 4.34
  NSS &gt;= 3.79
  rust = 1.60</changelog>
</package>
<package pkgid="080188ebb969b0bb0d8ffb534ab6c6e099c52071884570ea3985581ce4fdf8e9" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="101.99" rel="4.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1643544000">- disable ccache, this adds about 1 minute of build time and
  over 2 GB of disk space usage without benefit on OBS builds
- build with rust-simd like upstream does
- use -g1 for debuginfo generation as this is what upstream
  does as well and it saves ~ 2GB of writes
- use %limit on x86_64 to scale down to less capable workers
- disable install stripping so that debuginfo is useful
- use autopatch
- cleanup constraints to specify only jobs, physicalmemory
  and memoryperjob to be more flexible on which host to build
  on</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644235200">- remove memoryperjob and use %limit instead. this allows to
  adapt to more worker types, and lowers the time the package
  is stuck in "scheduling". raising memory above 8 to lower
  risk for LTO jobs to run OOM
- add hack to disable -Wl,--gc-section which avoids a binutils
  segfault on x86
- change mozilla-reduce-rust-debuginfo.patch: use -g1 everywhere</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1644321600">- Mozilla Firefox 97.0
  MFSA 2022-04 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during update
  * CVE-2022-22755 (bmo#1309630)
    XSL could have allowed JavaScript execution after a tab was closed
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22757 (bmo#1720098)
    Remote Agent did not prevent local websites from connecting
  * CVE-2022-22758 (bmo#1728742)
    tel: links could have sent USSD codes to the dialer on
    Firefox for Android
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22762 (bmo#1743931)
    JavaScript Dialogs could have been displayed over other
    domains on Firefox for Android
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6
  * CVE-2022-0511 (bmo#1713579, bmo#1735448, bmo#1743821, bmo#1746313,
    bmo#1746314, bmo#1746316, bmo#1746321, bmo#1746322, bmo#1746323,
    bmo#1746412, bmo#1746430, bmo#1746451, bmo#1746488, bmo#1746875,
    bmo#1746898, bmo#1746905, bmo#1746907, bmo#1746917, bmo#1747128,
    bmo#1747137, bmo#1747331, bmo#1747346, bmo#1747439, bmo#1747457,
    bmo#1747870, bmo#1749051, bmo#1749274, bmo#1749831)
    Memory safety bugs fixed in Firefox 97
- requires NSS 3.74
- requires rust 1.57</changelog>
  <changelog author="Luciano Santos &lt;luc14n0@opensuse.org&gt;" date="1644840000">- Remove bashisms ("source" and "function" keywords) from
  mozilla.sh.in to ally with the #!/bin/sh shebang. If the end user
  has either dash-sh package or busybox-sh to handle Bourn Shell
  scripts rather than having bash-sh package, the script would
  fail. Using "." instead of "source" and "create_langpack_link()"
  function definition is enough to keep both sides sane,
  behavior-wise.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645185600">- Mozilla Firefox 97.0.1
  * Fixed: Fixed an issue where TikTok videos would fail to load
    when selected from a user's profile page (bmo#1750973)
  * Fixed: Fixed an issue which led to Picture-in-Picture mode
    being unable to be toggled on Hulu (bmo#1753401)
  * Fixed: Works around problems with WebRoot SecureAnywhere
    antivirus rendering Firefox unusable in some situations
    (bmo#1752466)
  * Fixed: Fixed an issue causing users to see the Restore
    Session screen unexpectedly when starting Firefox
    (bmo#1749996)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1646740800">- Mozilla Firefox 98.0
  * Firefox has a new optimized download flow
  * other changes as documented here
    https://www.mozilla.org/en-US/firefox/98.0/releasenotes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26382 (bmo#1741888)
    Autofill Text could be exfiltrated via side-channel attacks
  * CVE-2022-26385 (bmo#1747526)
    Use-after-free in thread shutdown
  * CVE-2022-0843 (bmo#1746523, bmo#1749062, bmo#1749164, bmo#1749214,
    bmo#1749610, bmo#1750032, bmo#1752100, bmo#1752405, bmo#1753612,
    bmo#1754508)
    Memory safety bugs fixed in Firefox 98
- requires NSS 3.75
- add mozilla-bmo1756347.patch to fix i586 build</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1647259200">- Mozilla Firefox 98.0.1:
  * Yandex and Mail.ru have been removed as optional search
    providers in the drop-down search menu in Firefox</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647518401">- exclude slow cpus for building</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1647950400">- Add patch to fix start-up on aarch64:
  * mozilla-bmo1757571.patch</changelog>
  <changelog author="Simon Vogl &lt;simon.vogl@gmx.net&gt;" date="1648036800">- Change mozilla-kde.patch to follow the GNOME registry
  behavior for new MIME types to avoid opening downloaded files
  without any inquiries (bsc#1197319)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1648123200">- MozillaFirefox 98.0.2:
  * Fixed: Fixed an issue preventing users from typing in Address
    Bar after opening new tab and pressing cmd + enter
    (bmo#1757376)
  * Fixed: Fixed an issue causing some users to crash in out-of-
    memory conditions (bmo#1757618)
  * Fixed: Fixed an issue in session history which caused some
    sites to fail to load (bmo#1758664)
  * Fixed: Fixed an add-on specific compatibility issue
    (bmo#1759162)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1649073600">- Mozilla Firefox 99.0
  * You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  * You can find added support for search?with or without
    diacritics?in the PDF viewer.
  * The Linux sandbox has been strengthened: processes exposed to web
    content no longer have access to the X Window system (X11).
  * Firefox now supports credit card autofill and capture in
    Germany and France.
  MFSA 2022-13 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28283 (bmo#1754066)
    Missing security checks for fetching sourceMapURL
  * CVE-2022-28284 (bmo#1754522)
    Script could be executed via svg's use element
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-28287 (bmo#1741515)
    Text Selection could crash Firefox
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8
  * CVE-2022-28288 (bmo#1746415, bmo#1746495, bmo#1746500,
    bmo#1747282, bmo#1748759, bmo#1749056, bmo#1749786,
    bmo#1751679, bmo#1752120, bmo#1756010, bmo#1756017,
    bmo#1757213, bmo#1757258, bmo#1757427)
    Memory safety bugs fixed in Firefox 99
- requires NSS &gt;= 3.76.1
- remove obsolete patch
  * mozilla-bmo1756347.patch
  * mozilla-bmo1757571.patch
- update create-tar.sh</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1649764800">- Mozilla Firefox 99.0.1
  * Fixed an issue with text rendering in Bengali (bmo#1763368)
  * Fixed a selection issue in the Download panel with drag and
    drop (bmo#1762723)
  * Fixed: Fixed an issue preventing Zoom gallery mode for users
    who go to zoom.us URLs instead of subdomain.zoom.us URLs
    (bmo#1763801)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1651406400">- Mozilla Firefox 100.0
  * subtitle support in PiP
  * spell checking supports multiple languages in parallel
  * more details here
    https://www.mozilla.org/en-US/firefox/100.0/releasenotes
  MFSA 2022-16 (boo#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29910 (bmo#1757138)
    Firefox for Android forgot HTTP Strict Transport Security
    settings
  * CVE-2022-29915 (bmo#1751678)
    Leaking cross-origin redirect through the Performance API
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9
  * CVE-2022-29918 (bmo#1744043, bmo#1747178, bmo#1753535,
    bmo#1754017, bmo#1755847, bmo#1756172, bmo#1757477,
    bmo#1758223, bmo#1760160, bmo#1761481, bmo#1761771)
    Memory safety bugs fixed in Firefox 100
- requires NSS 3.77</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1652875200">- Mozilla Firefox 100.0.1:
  * Fixed: Fixed an issue with subtitles in Picture-in-Picture
    mode while using Netflix (bmo#1768818)
  * Fixed: Fixed an issue where some commands were unavailable in
    the Picture-in-Picture window (bmo#1768201)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653048000">- Mozilla Firefox 100.0.2
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653825600">- Mozilla Firefox 101.0
  * Reading is now easier with the prefers-contrast media query,
    which allows sites to detect if the user has requested that web
    content is presented with a higher (or lower) contrast
  * All non-configured MIME types can now be assigned a custom
    action upon download completion
  * allows users to use as many microphones as you want, at the
    same time, during video conferencing. The most exciting benefit
    is that you can easily switch your microphones at any time
    (if your conferencing service provider enables this flexibility)
  MFSA 2022-20 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of allowCredential
    entries may have leaked cross-origin information
  * CVE-2022-31743 (bmo#1747388)
    HTML Parsing incorrectly ended HTML comments prematurely
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-31745 (bmo#1760944)
    Incorrect Assertion caused by unoptimized array shift operations
  * CVE-2022-1919 (bmo#1761275)
    Memory Corruption when manipulating webp images
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10
  * CVE-2022-31748 (bmo#1713773, bmo#1762201, bmo#1762469,
    bmo#1762770, bmo#1764878, bmo#1765226, bmo#1765782, bmo#1765973,
    bmo#1767177, bmo#1767181, bmo#1768232, bmo#1768251, bmo#1769869)
    Memory safety bugs fixed in Firefox 101
- requires
  * NSS 3.78.1
  * rust-cbindgen 0.23.0
  * rust 1.59</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1654862400">- Mozilla Firefox 101.0.1:
  * Fixed context menus not appearing when right-clicking
    Picture-in-Picture windows on some Linux systems (bmo#1771914)
  * Various stability fixes</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1655812800">- Firefox 102.0 (build1)
- requires
  NSPR &gt;= 4.34
  NSS &gt;= 3.79
  rust = 1.60</changelog>
</package>
<package pkgid="cb7b68ee664ee6b8b934ba974abbafff14094055913c3cbeb10ea143cf7cdaaa" name="MozillaFirefox-debuginfo" arch="i686">
  <version epoch="0" ver="101.99" rel="4.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1643544000">- disable ccache, this adds about 1 minute of build time and
  over 2 GB of disk space usage without benefit on OBS builds
- build with rust-simd like upstream does
- use -g1 for debuginfo generation as this is what upstream
  does as well and it saves ~ 2GB of writes
- use %limit on x86_64 to scale down to less capable workers
- disable install stripping so that debuginfo is useful
- use autopatch
- cleanup constraints to specify only jobs, physicalmemory
  and memoryperjob to be more flexible on which host to build
  on</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644235200">- remove memoryperjob and use %limit instead. this allows to
  adapt to more worker types, and lowers the time the package
  is stuck in "scheduling". raising memory above 8 to lower
  risk for LTO jobs to run OOM
- add hack to disable -Wl,--gc-section which avoids a binutils
  segfault on x86
- change mozilla-reduce-rust-debuginfo.patch: use -g1 everywhere</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1644321600">- Mozilla Firefox 97.0
  MFSA 2022-04 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during update
  * CVE-2022-22755 (bmo#1309630)
    XSL could have allowed JavaScript execution after a tab was closed
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22757 (bmo#1720098)
    Remote Agent did not prevent local websites from connecting
  * CVE-2022-22758 (bmo#1728742)
    tel: links could have sent USSD codes to the dialer on
    Firefox for Android
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22762 (bmo#1743931)
    JavaScript Dialogs could have been displayed over other
    domains on Firefox for Android
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6
  * CVE-2022-0511 (bmo#1713579, bmo#1735448, bmo#1743821, bmo#1746313,
    bmo#1746314, bmo#1746316, bmo#1746321, bmo#1746322, bmo#1746323,
    bmo#1746412, bmo#1746430, bmo#1746451, bmo#1746488, bmo#1746875,
    bmo#1746898, bmo#1746905, bmo#1746907, bmo#1746917, bmo#1747128,
    bmo#1747137, bmo#1747331, bmo#1747346, bmo#1747439, bmo#1747457,
    bmo#1747870, bmo#1749051, bmo#1749274, bmo#1749831)
    Memory safety bugs fixed in Firefox 97
- requires NSS 3.74
- requires rust 1.57</changelog>
  <changelog author="Luciano Santos &lt;luc14n0@opensuse.org&gt;" date="1644840000">- Remove bashisms ("source" and "function" keywords) from
  mozilla.sh.in to ally with the #!/bin/sh shebang. If the end user
  has either dash-sh package or busybox-sh to handle Bourn Shell
  scripts rather than having bash-sh package, the script would
  fail. Using "." instead of "source" and "create_langpack_link()"
  function definition is enough to keep both sides sane,
  behavior-wise.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645185600">- Mozilla Firefox 97.0.1
  * Fixed: Fixed an issue where TikTok videos would fail to load
    when selected from a user's profile page (bmo#1750973)
  * Fixed: Fixed an issue which led to Picture-in-Picture mode
    being unable to be toggled on Hulu (bmo#1753401)
  * Fixed: Works around problems with WebRoot SecureAnywhere
    antivirus rendering Firefox unusable in some situations
    (bmo#1752466)
  * Fixed: Fixed an issue causing users to see the Restore
    Session screen unexpectedly when starting Firefox
    (bmo#1749996)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1646740800">- Mozilla Firefox 98.0
  * Firefox has a new optimized download flow
  * other changes as documented here
    https://www.mozilla.org/en-US/firefox/98.0/releasenotes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26382 (bmo#1741888)
    Autofill Text could be exfiltrated via side-channel attacks
  * CVE-2022-26385 (bmo#1747526)
    Use-after-free in thread shutdown
  * CVE-2022-0843 (bmo#1746523, bmo#1749062, bmo#1749164, bmo#1749214,
    bmo#1749610, bmo#1750032, bmo#1752100, bmo#1752405, bmo#1753612,
    bmo#1754508)
    Memory safety bugs fixed in Firefox 98
- requires NSS 3.75
- add mozilla-bmo1756347.patch to fix i586 build</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1647259200">- Mozilla Firefox 98.0.1:
  * Yandex and Mail.ru have been removed as optional search
    providers in the drop-down search menu in Firefox</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647518401">- exclude slow cpus for building</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1647950400">- Add patch to fix start-up on aarch64:
  * mozilla-bmo1757571.patch</changelog>
  <changelog author="Simon Vogl &lt;simon.vogl@gmx.net&gt;" date="1648036800">- Change mozilla-kde.patch to follow the GNOME registry
  behavior for new MIME types to avoid opening downloaded files
  without any inquiries (bsc#1197319)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1648123200">- MozillaFirefox 98.0.2:
  * Fixed: Fixed an issue preventing users from typing in Address
    Bar after opening new tab and pressing cmd + enter
    (bmo#1757376)
  * Fixed: Fixed an issue causing some users to crash in out-of-
    memory conditions (bmo#1757618)
  * Fixed: Fixed an issue in session history which caused some
    sites to fail to load (bmo#1758664)
  * Fixed: Fixed an add-on specific compatibility issue
    (bmo#1759162)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1649073600">- Mozilla Firefox 99.0
  * You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  * You can find added support for search?with or without
    diacritics?in the PDF viewer.
  * The Linux sandbox has been strengthened: processes exposed to web
    content no longer have access to the X Window system (X11).
  * Firefox now supports credit card autofill and capture in
    Germany and France.
  MFSA 2022-13 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28283 (bmo#1754066)
    Missing security checks for fetching sourceMapURL
  * CVE-2022-28284 (bmo#1754522)
    Script could be executed via svg's use element
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-28287 (bmo#1741515)
    Text Selection could crash Firefox
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8
  * CVE-2022-28288 (bmo#1746415, bmo#1746495, bmo#1746500,
    bmo#1747282, bmo#1748759, bmo#1749056, bmo#1749786,
    bmo#1751679, bmo#1752120, bmo#1756010, bmo#1756017,
    bmo#1757213, bmo#1757258, bmo#1757427)
    Memory safety bugs fixed in Firefox 99
- requires NSS &gt;= 3.76.1
- remove obsolete patch
  * mozilla-bmo1756347.patch
  * mozilla-bmo1757571.patch
- update create-tar.sh</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1649764800">- Mozilla Firefox 99.0.1
  * Fixed an issue with text rendering in Bengali (bmo#1763368)
  * Fixed a selection issue in the Download panel with drag and
    drop (bmo#1762723)
  * Fixed: Fixed an issue preventing Zoom gallery mode for users
    who go to zoom.us URLs instead of subdomain.zoom.us URLs
    (bmo#1763801)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1651406400">- Mozilla Firefox 100.0
  * subtitle support in PiP
  * spell checking supports multiple languages in parallel
  * more details here
    https://www.mozilla.org/en-US/firefox/100.0/releasenotes
  MFSA 2022-16 (boo#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29910 (bmo#1757138)
    Firefox for Android forgot HTTP Strict Transport Security
    settings
  * CVE-2022-29915 (bmo#1751678)
    Leaking cross-origin redirect through the Performance API
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9
  * CVE-2022-29918 (bmo#1744043, bmo#1747178, bmo#1753535,
    bmo#1754017, bmo#1755847, bmo#1756172, bmo#1757477,
    bmo#1758223, bmo#1760160, bmo#1761481, bmo#1761771)
    Memory safety bugs fixed in Firefox 100
- requires NSS 3.77</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1652875200">- Mozilla Firefox 100.0.1:
  * Fixed: Fixed an issue with subtitles in Picture-in-Picture
    mode while using Netflix (bmo#1768818)
  * Fixed: Fixed an issue where some commands were unavailable in
    the Picture-in-Picture window (bmo#1768201)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653048000">- Mozilla Firefox 100.0.2
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653825600">- Mozilla Firefox 101.0
  * Reading is now easier with the prefers-contrast media query,
    which allows sites to detect if the user has requested that web
    content is presented with a higher (or lower) contrast
  * All non-configured MIME types can now be assigned a custom
    action upon download completion
  * allows users to use as many microphones as you want, at the
    same time, during video conferencing. The most exciting benefit
    is that you can easily switch your microphones at any time
    (if your conferencing service provider enables this flexibility)
  MFSA 2022-20 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of allowCredential
    entries may have leaked cross-origin information
  * CVE-2022-31743 (bmo#1747388)
    HTML Parsing incorrectly ended HTML comments prematurely
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-31745 (bmo#1760944)
    Incorrect Assertion caused by unoptimized array shift operations
  * CVE-2022-1919 (bmo#1761275)
    Memory Corruption when manipulating webp images
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10
  * CVE-2022-31748 (bmo#1713773, bmo#1762201, bmo#1762469,
    bmo#1762770, bmo#1764878, bmo#1765226, bmo#1765782, bmo#1765973,
    bmo#1767177, bmo#1767181, bmo#1768232, bmo#1768251, bmo#1769869)
    Memory safety bugs fixed in Firefox 101
- requires
  * NSS 3.78.1
  * rust-cbindgen 0.23.0
  * rust 1.59</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1654862400">- Mozilla Firefox 101.0.1:
  * Fixed context menus not appearing when right-clicking
    Picture-in-Picture windows on some Linux systems (bmo#1771914)
  * Various stability fixes</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1655812800">- Firefox 102.0 (build1)
- requires
  NSPR &gt;= 4.34
  NSS &gt;= 3.79
  rust = 1.60</changelog>
</package>
<package pkgid="914fb3d2c060d12e908032997153bafa59768045a38e79f1165f358344372a7f" name="MozillaFirefox-debuginfo" arch="x86_64">
  <version epoch="0" ver="101.99" rel="4.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1643544000">- disable ccache, this adds about 1 minute of build time and
  over 2 GB of disk space usage without benefit on OBS builds
- build with rust-simd like upstream does
- use -g1 for debuginfo generation as this is what upstream
  does as well and it saves ~ 2GB of writes
- use %limit on x86_64 to scale down to less capable workers
- disable install stripping so that debuginfo is useful
- use autopatch
- cleanup constraints to specify only jobs, physicalmemory
  and memoryperjob to be more flexible on which host to build
  on</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644235200">- remove memoryperjob and use %limit instead. this allows to
  adapt to more worker types, and lowers the time the package
  is stuck in "scheduling". raising memory above 8 to lower
  risk for LTO jobs to run OOM
- add hack to disable -Wl,--gc-section which avoids a binutils
  segfault on x86
- change mozilla-reduce-rust-debuginfo.patch: use -g1 everywhere</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1644321600">- Mozilla Firefox 97.0
  MFSA 2022-04 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during update
  * CVE-2022-22755 (bmo#1309630)
    XSL could have allowed JavaScript execution after a tab was closed
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22757 (bmo#1720098)
    Remote Agent did not prevent local websites from connecting
  * CVE-2022-22758 (bmo#1728742)
    tel: links could have sent USSD codes to the dialer on
    Firefox for Android
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22762 (bmo#1743931)
    JavaScript Dialogs could have been displayed over other
    domains on Firefox for Android
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6
  * CVE-2022-0511 (bmo#1713579, bmo#1735448, bmo#1743821, bmo#1746313,
    bmo#1746314, bmo#1746316, bmo#1746321, bmo#1746322, bmo#1746323,
    bmo#1746412, bmo#1746430, bmo#1746451, bmo#1746488, bmo#1746875,
    bmo#1746898, bmo#1746905, bmo#1746907, bmo#1746917, bmo#1747128,
    bmo#1747137, bmo#1747331, bmo#1747346, bmo#1747439, bmo#1747457,
    bmo#1747870, bmo#1749051, bmo#1749274, bmo#1749831)
    Memory safety bugs fixed in Firefox 97
- requires NSS 3.74
- requires rust 1.57</changelog>
  <changelog author="Luciano Santos &lt;luc14n0@opensuse.org&gt;" date="1644840000">- Remove bashisms ("source" and "function" keywords) from
  mozilla.sh.in to ally with the #!/bin/sh shebang. If the end user
  has either dash-sh package or busybox-sh to handle Bourn Shell
  scripts rather than having bash-sh package, the script would
  fail. Using "." instead of "source" and "create_langpack_link()"
  function definition is enough to keep both sides sane,
  behavior-wise.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645185600">- Mozilla Firefox 97.0.1
  * Fixed: Fixed an issue where TikTok videos would fail to load
    when selected from a user's profile page (bmo#1750973)
  * Fixed: Fixed an issue which led to Picture-in-Picture mode
    being unable to be toggled on Hulu (bmo#1753401)
  * Fixed: Works around problems with WebRoot SecureAnywhere
    antivirus rendering Firefox unusable in some situations
    (bmo#1752466)
  * Fixed: Fixed an issue causing users to see the Restore
    Session screen unexpectedly when starting Firefox
    (bmo#1749996)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1646740800">- Mozilla Firefox 98.0
  * Firefox has a new optimized download flow
  * other changes as documented here
    https://www.mozilla.org/en-US/firefox/98.0/releasenotes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26382 (bmo#1741888)
    Autofill Text could be exfiltrated via side-channel attacks
  * CVE-2022-26385 (bmo#1747526)
    Use-after-free in thread shutdown
  * CVE-2022-0843 (bmo#1746523, bmo#1749062, bmo#1749164, bmo#1749214,
    bmo#1749610, bmo#1750032, bmo#1752100, bmo#1752405, bmo#1753612,
    bmo#1754508)
    Memory safety bugs fixed in Firefox 98
- requires NSS 3.75
- add mozilla-bmo1756347.patch to fix i586 build</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1647259200">- Mozilla Firefox 98.0.1:
  * Yandex and Mail.ru have been removed as optional search
    providers in the drop-down search menu in Firefox</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647518401">- exclude slow cpus for building</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1647950400">- Add patch to fix start-up on aarch64:
  * mozilla-bmo1757571.patch</changelog>
  <changelog author="Simon Vogl &lt;simon.vogl@gmx.net&gt;" date="1648036800">- Change mozilla-kde.patch to follow the GNOME registry
  behavior for new MIME types to avoid opening downloaded files
  without any inquiries (bsc#1197319)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1648123200">- MozillaFirefox 98.0.2:
  * Fixed: Fixed an issue preventing users from typing in Address
    Bar after opening new tab and pressing cmd + enter
    (bmo#1757376)
  * Fixed: Fixed an issue causing some users to crash in out-of-
    memory conditions (bmo#1757618)
  * Fixed: Fixed an issue in session history which caused some
    sites to fail to load (bmo#1758664)
  * Fixed: Fixed an add-on specific compatibility issue
    (bmo#1759162)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1649073600">- Mozilla Firefox 99.0
  * You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  * You can find added support for search?with or without
    diacritics?in the PDF viewer.
  * The Linux sandbox has been strengthened: processes exposed to web
    content no longer have access to the X Window system (X11).
  * Firefox now supports credit card autofill and capture in
    Germany and France.
  MFSA 2022-13 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28283 (bmo#1754066)
    Missing security checks for fetching sourceMapURL
  * CVE-2022-28284 (bmo#1754522)
    Script could be executed via svg's use element
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-28287 (bmo#1741515)
    Text Selection could crash Firefox
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8
  * CVE-2022-28288 (bmo#1746415, bmo#1746495, bmo#1746500,
    bmo#1747282, bmo#1748759, bmo#1749056, bmo#1749786,
    bmo#1751679, bmo#1752120, bmo#1756010, bmo#1756017,
    bmo#1757213, bmo#1757258, bmo#1757427)
    Memory safety bugs fixed in Firefox 99
- requires NSS &gt;= 3.76.1
- remove obsolete patch
  * mozilla-bmo1756347.patch
  * mozilla-bmo1757571.patch
- update create-tar.sh</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1649764800">- Mozilla Firefox 99.0.1
  * Fixed an issue with text rendering in Bengali (bmo#1763368)
  * Fixed a selection issue in the Download panel with drag and
    drop (bmo#1762723)
  * Fixed: Fixed an issue preventing Zoom gallery mode for users
    who go to zoom.us URLs instead of subdomain.zoom.us URLs
    (bmo#1763801)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1651406400">- Mozilla Firefox 100.0
  * subtitle support in PiP
  * spell checking supports multiple languages in parallel
  * more details here
    https://www.mozilla.org/en-US/firefox/100.0/releasenotes
  MFSA 2022-16 (boo#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29910 (bmo#1757138)
    Firefox for Android forgot HTTP Strict Transport Security
    settings
  * CVE-2022-29915 (bmo#1751678)
    Leaking cross-origin redirect through the Performance API
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9
  * CVE-2022-29918 (bmo#1744043, bmo#1747178, bmo#1753535,
    bmo#1754017, bmo#1755847, bmo#1756172, bmo#1757477,
    bmo#1758223, bmo#1760160, bmo#1761481, bmo#1761771)
    Memory safety bugs fixed in Firefox 100
- requires NSS 3.77</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1652875200">- Mozilla Firefox 100.0.1:
  * Fixed: Fixed an issue with subtitles in Picture-in-Picture
    mode while using Netflix (bmo#1768818)
  * Fixed: Fixed an issue where some commands were unavailable in
    the Picture-in-Picture window (bmo#1768201)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653048000">- Mozilla Firefox 100.0.2
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653825600">- Mozilla Firefox 101.0
  * Reading is now easier with the prefers-contrast media query,
    which allows sites to detect if the user has requested that web
    content is presented with a higher (or lower) contrast
  * All non-configured MIME types can now be assigned a custom
    action upon download completion
  * allows users to use as many microphones as you want, at the
    same time, during video conferencing. The most exciting benefit
    is that you can easily switch your microphones at any time
    (if your conferencing service provider enables this flexibility)
  MFSA 2022-20 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of allowCredential
    entries may have leaked cross-origin information
  * CVE-2022-31743 (bmo#1747388)
    HTML Parsing incorrectly ended HTML comments prematurely
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-31745 (bmo#1760944)
    Incorrect Assertion caused by unoptimized array shift operations
  * CVE-2022-1919 (bmo#1761275)
    Memory Corruption when manipulating webp images
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10
  * CVE-2022-31748 (bmo#1713773, bmo#1762201, bmo#1762469,
    bmo#1762770, bmo#1764878, bmo#1765226, bmo#1765782, bmo#1765973,
    bmo#1767177, bmo#1767181, bmo#1768232, bmo#1768251, bmo#1769869)
    Memory safety bugs fixed in Firefox 101
- requires
  * NSS 3.78.1
  * rust-cbindgen 0.23.0
  * rust 1.59</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1654862400">- Mozilla Firefox 101.0.1:
  * Fixed context menus not appearing when right-clicking
    Picture-in-Picture windows on some Linux systems (bmo#1771914)
  * Various stability fixes</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1655812800">- Firefox 102.0 (build1)
- requires
  NSPR &gt;= 4.34
  NSS &gt;= 3.79
  rust = 1.60</changelog>
</package>
<package pkgid="67153d507157b2656eaef2398f2ff0090de8c0ffec9c1d327cec22ecaeb21fd9" name="MozillaFirefox-debugsource" arch="x86_64">
  <version epoch="0" ver="101.99" rel="4.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1643544000">- disable ccache, this adds about 1 minute of build time and
  over 2 GB of disk space usage without benefit on OBS builds
- build with rust-simd like upstream does
- use -g1 for debuginfo generation as this is what upstream
  does as well and it saves ~ 2GB of writes
- use %limit on x86_64 to scale down to less capable workers
- disable install stripping so that debuginfo is useful
- use autopatch
- cleanup constraints to specify only jobs, physicalmemory
  and memoryperjob to be more flexible on which host to build
  on</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644235200">- remove memoryperjob and use %limit instead. this allows to
  adapt to more worker types, and lowers the time the package
  is stuck in "scheduling". raising memory above 8 to lower
  risk for LTO jobs to run OOM
- add hack to disable -Wl,--gc-section which avoids a binutils
  segfault on x86
- change mozilla-reduce-rust-debuginfo.patch: use -g1 everywhere</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1644321600">- Mozilla Firefox 97.0
  MFSA 2022-04 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during update
  * CVE-2022-22755 (bmo#1309630)
    XSL could have allowed JavaScript execution after a tab was closed
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22757 (bmo#1720098)
    Remote Agent did not prevent local websites from connecting
  * CVE-2022-22758 (bmo#1728742)
    tel: links could have sent USSD codes to the dialer on
    Firefox for Android
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22762 (bmo#1743931)
    JavaScript Dialogs could have been displayed over other
    domains on Firefox for Android
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6
  * CVE-2022-0511 (bmo#1713579, bmo#1735448, bmo#1743821, bmo#1746313,
    bmo#1746314, bmo#1746316, bmo#1746321, bmo#1746322, bmo#1746323,
    bmo#1746412, bmo#1746430, bmo#1746451, bmo#1746488, bmo#1746875,
    bmo#1746898, bmo#1746905, bmo#1746907, bmo#1746917, bmo#1747128,
    bmo#1747137, bmo#1747331, bmo#1747346, bmo#1747439, bmo#1747457,
    bmo#1747870, bmo#1749051, bmo#1749274, bmo#1749831)
    Memory safety bugs fixed in Firefox 97
- requires NSS 3.74
- requires rust 1.57</changelog>
  <changelog author="Luciano Santos &lt;luc14n0@opensuse.org&gt;" date="1644840000">- Remove bashisms ("source" and "function" keywords) from
  mozilla.sh.in to ally with the #!/bin/sh shebang. If the end user
  has either dash-sh package or busybox-sh to handle Bourn Shell
  scripts rather than having bash-sh package, the script would
  fail. Using "." instead of "source" and "create_langpack_link()"
  function definition is enough to keep both sides sane,
  behavior-wise.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645185600">- Mozilla Firefox 97.0.1
  * Fixed: Fixed an issue where TikTok videos would fail to load
    when selected from a user's profile page (bmo#1750973)
  * Fixed: Fixed an issue which led to Picture-in-Picture mode
    being unable to be toggled on Hulu (bmo#1753401)
  * Fixed: Works around problems with WebRoot SecureAnywhere
    antivirus rendering Firefox unusable in some situations
    (bmo#1752466)
  * Fixed: Fixed an issue causing users to see the Restore
    Session screen unexpectedly when starting Firefox
    (bmo#1749996)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1646740800">- Mozilla Firefox 98.0
  * Firefox has a new optimized download flow
  * other changes as documented here
    https://www.mozilla.org/en-US/firefox/98.0/releasenotes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26382 (bmo#1741888)
    Autofill Text could be exfiltrated via side-channel attacks
  * CVE-2022-26385 (bmo#1747526)
    Use-after-free in thread shutdown
  * CVE-2022-0843 (bmo#1746523, bmo#1749062, bmo#1749164, bmo#1749214,
    bmo#1749610, bmo#1750032, bmo#1752100, bmo#1752405, bmo#1753612,
    bmo#1754508)
    Memory safety bugs fixed in Firefox 98
- requires NSS 3.75
- add mozilla-bmo1756347.patch to fix i586 build</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1647259200">- Mozilla Firefox 98.0.1:
  * Yandex and Mail.ru have been removed as optional search
    providers in the drop-down search menu in Firefox</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647518401">- exclude slow cpus for building</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1647950400">- Add patch to fix start-up on aarch64:
  * mozilla-bmo1757571.patch</changelog>
  <changelog author="Simon Vogl &lt;simon.vogl@gmx.net&gt;" date="1648036800">- Change mozilla-kde.patch to follow the GNOME registry
  behavior for new MIME types to avoid opening downloaded files
  without any inquiries (bsc#1197319)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1648123200">- MozillaFirefox 98.0.2:
  * Fixed: Fixed an issue preventing users from typing in Address
    Bar after opening new tab and pressing cmd + enter
    (bmo#1757376)
  * Fixed: Fixed an issue causing some users to crash in out-of-
    memory conditions (bmo#1757618)
  * Fixed: Fixed an issue in session history which caused some
    sites to fail to load (bmo#1758664)
  * Fixed: Fixed an add-on specific compatibility issue
    (bmo#1759162)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1649073600">- Mozilla Firefox 99.0
  * You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  * You can find added support for search?with or without
    diacritics?in the PDF viewer.
  * The Linux sandbox has been strengthened: processes exposed to web
    content no longer have access to the X Window system (X11).
  * Firefox now supports credit card autofill and capture in
    Germany and France.
  MFSA 2022-13 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28283 (bmo#1754066)
    Missing security checks for fetching sourceMapURL
  * CVE-2022-28284 (bmo#1754522)
    Script could be executed via svg's use element
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-28287 (bmo#1741515)
    Text Selection could crash Firefox
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8
  * CVE-2022-28288 (bmo#1746415, bmo#1746495, bmo#1746500,
    bmo#1747282, bmo#1748759, bmo#1749056, bmo#1749786,
    bmo#1751679, bmo#1752120, bmo#1756010, bmo#1756017,
    bmo#1757213, bmo#1757258, bmo#1757427)
    Memory safety bugs fixed in Firefox 99
- requires NSS &gt;= 3.76.1
- remove obsolete patch
  * mozilla-bmo1756347.patch
  * mozilla-bmo1757571.patch
- update create-tar.sh</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1649764800">- Mozilla Firefox 99.0.1
  * Fixed an issue with text rendering in Bengali (bmo#1763368)
  * Fixed a selection issue in the Download panel with drag and
    drop (bmo#1762723)
  * Fixed: Fixed an issue preventing Zoom gallery mode for users
    who go to zoom.us URLs instead of subdomain.zoom.us URLs
    (bmo#1763801)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1651406400">- Mozilla Firefox 100.0
  * subtitle support in PiP
  * spell checking supports multiple languages in parallel
  * more details here
    https://www.mozilla.org/en-US/firefox/100.0/releasenotes
  MFSA 2022-16 (boo#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29910 (bmo#1757138)
    Firefox for Android forgot HTTP Strict Transport Security
    settings
  * CVE-2022-29915 (bmo#1751678)
    Leaking cross-origin redirect through the Performance API
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9
  * CVE-2022-29918 (bmo#1744043, bmo#1747178, bmo#1753535,
    bmo#1754017, bmo#1755847, bmo#1756172, bmo#1757477,
    bmo#1758223, bmo#1760160, bmo#1761481, bmo#1761771)
    Memory safety bugs fixed in Firefox 100
- requires NSS 3.77</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1652875200">- Mozilla Firefox 100.0.1:
  * Fixed: Fixed an issue with subtitles in Picture-in-Picture
    mode while using Netflix (bmo#1768818)
  * Fixed: Fixed an issue where some commands were unavailable in
    the Picture-in-Picture window (bmo#1768201)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653048000">- Mozilla Firefox 100.0.2
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653825600">- Mozilla Firefox 101.0
  * Reading is now easier with the prefers-contrast media query,
    which allows sites to detect if the user has requested that web
    content is presented with a higher (or lower) contrast
  * All non-configured MIME types can now be assigned a custom
    action upon download completion
  * allows users to use as many microphones as you want, at the
    same time, during video conferencing. The most exciting benefit
    is that you can easily switch your microphones at any time
    (if your conferencing service provider enables this flexibility)
  MFSA 2022-20 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of allowCredential
    entries may have leaked cross-origin information
  * CVE-2022-31743 (bmo#1747388)
    HTML Parsing incorrectly ended HTML comments prematurely
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-31745 (bmo#1760944)
    Incorrect Assertion caused by unoptimized array shift operations
  * CVE-2022-1919 (bmo#1761275)
    Memory Corruption when manipulating webp images
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10
  * CVE-2022-31748 (bmo#1713773, bmo#1762201, bmo#1762469,
    bmo#1762770, bmo#1764878, bmo#1765226, bmo#1765782, bmo#1765973,
    bmo#1767177, bmo#1767181, bmo#1768232, bmo#1768251, bmo#1769869)
    Memory safety bugs fixed in Firefox 101
- requires
  * NSS 3.78.1
  * rust-cbindgen 0.23.0
  * rust 1.59</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1654862400">- Mozilla Firefox 101.0.1:
  * Fixed context menus not appearing when right-clicking
    Picture-in-Picture windows on some Linux systems (bmo#1771914)
  * Various stability fixes</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1655812800">- Firefox 102.0 (build1)
- requires
  NSPR &gt;= 4.34
  NSS &gt;= 3.79
  rust = 1.60</changelog>
</package>
<package pkgid="754a72f0c527cf635c9acf2329a458e94eea58c38c116dc6c6716918000c4187" name="MozillaFirefox-devel" arch="i686">
  <version epoch="0" ver="101.99" rel="4.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1643544000">- disable ccache, this adds about 1 minute of build time and
  over 2 GB of disk space usage without benefit on OBS builds
- build with rust-simd like upstream does
- use -g1 for debuginfo generation as this is what upstream
  does as well and it saves ~ 2GB of writes
- use %limit on x86_64 to scale down to less capable workers
- disable install stripping so that debuginfo is useful
- use autopatch
- cleanup constraints to specify only jobs, physicalmemory
  and memoryperjob to be more flexible on which host to build
  on</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644235200">- remove memoryperjob and use %limit instead. this allows to
  adapt to more worker types, and lowers the time the package
  is stuck in "scheduling". raising memory above 8 to lower
  risk for LTO jobs to run OOM
- add hack to disable -Wl,--gc-section which avoids a binutils
  segfault on x86
- change mozilla-reduce-rust-debuginfo.patch: use -g1 everywhere</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1644321600">- Mozilla Firefox 97.0
  MFSA 2022-04 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during update
  * CVE-2022-22755 (bmo#1309630)
    XSL could have allowed JavaScript execution after a tab was closed
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22757 (bmo#1720098)
    Remote Agent did not prevent local websites from connecting
  * CVE-2022-22758 (bmo#1728742)
    tel: links could have sent USSD codes to the dialer on
    Firefox for Android
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22762 (bmo#1743931)
    JavaScript Dialogs could have been displayed over other
    domains on Firefox for Android
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6
  * CVE-2022-0511 (bmo#1713579, bmo#1735448, bmo#1743821, bmo#1746313,
    bmo#1746314, bmo#1746316, bmo#1746321, bmo#1746322, bmo#1746323,
    bmo#1746412, bmo#1746430, bmo#1746451, bmo#1746488, bmo#1746875,
    bmo#1746898, bmo#1746905, bmo#1746907, bmo#1746917, bmo#1747128,
    bmo#1747137, bmo#1747331, bmo#1747346, bmo#1747439, bmo#1747457,
    bmo#1747870, bmo#1749051, bmo#1749274, bmo#1749831)
    Memory safety bugs fixed in Firefox 97
- requires NSS 3.74
- requires rust 1.57</changelog>
  <changelog author="Luciano Santos &lt;luc14n0@opensuse.org&gt;" date="1644840000">- Remove bashisms ("source" and "function" keywords) from
  mozilla.sh.in to ally with the #!/bin/sh shebang. If the end user
  has either dash-sh package or busybox-sh to handle Bourn Shell
  scripts rather than having bash-sh package, the script would
  fail. Using "." instead of "source" and "create_langpack_link()"
  function definition is enough to keep both sides sane,
  behavior-wise.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645185600">- Mozilla Firefox 97.0.1
  * Fixed: Fixed an issue where TikTok videos would fail to load
    when selected from a user's profile page (bmo#1750973)
  * Fixed: Fixed an issue which led to Picture-in-Picture mode
    being unable to be toggled on Hulu (bmo#1753401)
  * Fixed: Works around problems with WebRoot SecureAnywhere
    antivirus rendering Firefox unusable in some situations
    (bmo#1752466)
  * Fixed: Fixed an issue causing users to see the Restore
    Session screen unexpectedly when starting Firefox
    (bmo#1749996)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1646740800">- Mozilla Firefox 98.0
  * Firefox has a new optimized download flow
  * other changes as documented here
    https://www.mozilla.org/en-US/firefox/98.0/releasenotes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26382 (bmo#1741888)
    Autofill Text could be exfiltrated via side-channel attacks
  * CVE-2022-26385 (bmo#1747526)
    Use-after-free in thread shutdown
  * CVE-2022-0843 (bmo#1746523, bmo#1749062, bmo#1749164, bmo#1749214,
    bmo#1749610, bmo#1750032, bmo#1752100, bmo#1752405, bmo#1753612,
    bmo#1754508)
    Memory safety bugs fixed in Firefox 98
- requires NSS 3.75
- add mozilla-bmo1756347.patch to fix i586 build</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1647259200">- Mozilla Firefox 98.0.1:
  * Yandex and Mail.ru have been removed as optional search
    providers in the drop-down search menu in Firefox</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647518401">- exclude slow cpus for building</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1647950400">- Add patch to fix start-up on aarch64:
  * mozilla-bmo1757571.patch</changelog>
  <changelog author="Simon Vogl &lt;simon.vogl@gmx.net&gt;" date="1648036800">- Change mozilla-kde.patch to follow the GNOME registry
  behavior for new MIME types to avoid opening downloaded files
  without any inquiries (bsc#1197319)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1648123200">- MozillaFirefox 98.0.2:
  * Fixed: Fixed an issue preventing users from typing in Address
    Bar after opening new tab and pressing cmd + enter
    (bmo#1757376)
  * Fixed: Fixed an issue causing some users to crash in out-of-
    memory conditions (bmo#1757618)
  * Fixed: Fixed an issue in session history which caused some
    sites to fail to load (bmo#1758664)
  * Fixed: Fixed an add-on specific compatibility issue
    (bmo#1759162)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1649073600">- Mozilla Firefox 99.0
  * You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  * You can find added support for search?with or without
    diacritics?in the PDF viewer.
  * The Linux sandbox has been strengthened: processes exposed to web
    content no longer have access to the X Window system (X11).
  * Firefox now supports credit card autofill and capture in
    Germany and France.
  MFSA 2022-13 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28283 (bmo#1754066)
    Missing security checks for fetching sourceMapURL
  * CVE-2022-28284 (bmo#1754522)
    Script could be executed via svg's use element
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-28287 (bmo#1741515)
    Text Selection could crash Firefox
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8
  * CVE-2022-28288 (bmo#1746415, bmo#1746495, bmo#1746500,
    bmo#1747282, bmo#1748759, bmo#1749056, bmo#1749786,
    bmo#1751679, bmo#1752120, bmo#1756010, bmo#1756017,
    bmo#1757213, bmo#1757258, bmo#1757427)
    Memory safety bugs fixed in Firefox 99
- requires NSS &gt;= 3.76.1
- remove obsolete patch
  * mozilla-bmo1756347.patch
  * mozilla-bmo1757571.patch
- update create-tar.sh</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1649764800">- Mozilla Firefox 99.0.1
  * Fixed an issue with text rendering in Bengali (bmo#1763368)
  * Fixed a selection issue in the Download panel with drag and
    drop (bmo#1762723)
  * Fixed: Fixed an issue preventing Zoom gallery mode for users
    who go to zoom.us URLs instead of subdomain.zoom.us URLs
    (bmo#1763801)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1651406400">- Mozilla Firefox 100.0
  * subtitle support in PiP
  * spell checking supports multiple languages in parallel
  * more details here
    https://www.mozilla.org/en-US/firefox/100.0/releasenotes
  MFSA 2022-16 (boo#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29910 (bmo#1757138)
    Firefox for Android forgot HTTP Strict Transport Security
    settings
  * CVE-2022-29915 (bmo#1751678)
    Leaking cross-origin redirect through the Performance API
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9
  * CVE-2022-29918 (bmo#1744043, bmo#1747178, bmo#1753535,
    bmo#1754017, bmo#1755847, bmo#1756172, bmo#1757477,
    bmo#1758223, bmo#1760160, bmo#1761481, bmo#1761771)
    Memory safety bugs fixed in Firefox 100
- requires NSS 3.77</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1652875200">- Mozilla Firefox 100.0.1:
  * Fixed: Fixed an issue with subtitles in Picture-in-Picture
    mode while using Netflix (bmo#1768818)
  * Fixed: Fixed an issue where some commands were unavailable in
    the Picture-in-Picture window (bmo#1768201)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653048000">- Mozilla Firefox 100.0.2
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653825600">- Mozilla Firefox 101.0
  * Reading is now easier with the prefers-contrast media query,
    which allows sites to detect if the user has requested that web
    content is presented with a higher (or lower) contrast
  * All non-configured MIME types can now be assigned a custom
    action upon download completion
  * allows users to use as many microphones as you want, at the
    same time, during video conferencing. The most exciting benefit
    is that you can easily switch your microphones at any time
    (if your conferencing service provider enables this flexibility)
  MFSA 2022-20 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of allowCredential
    entries may have leaked cross-origin information
  * CVE-2022-31743 (bmo#1747388)
    HTML Parsing incorrectly ended HTML comments prematurely
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-31745 (bmo#1760944)
    Incorrect Assertion caused by unoptimized array shift operations
  * CVE-2022-1919 (bmo#1761275)
    Memory Corruption when manipulating webp images
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10
  * CVE-2022-31748 (bmo#1713773, bmo#1762201, bmo#1762469,
    bmo#1762770, bmo#1764878, bmo#1765226, bmo#1765782, bmo#1765973,
    bmo#1767177, bmo#1767181, bmo#1768232, bmo#1768251, bmo#1769869)
    Memory safety bugs fixed in Firefox 101
- requires
  * NSS 3.78.1
  * rust-cbindgen 0.23.0
  * rust 1.59</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1654862400">- Mozilla Firefox 101.0.1:
  * Fixed context menus not appearing when right-clicking
    Picture-in-Picture windows on some Linux systems (bmo#1771914)
  * Various stability fixes</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1655812800">- Firefox 102.0 (build1)
- requires
  NSPR &gt;= 4.34
  NSS &gt;= 3.79
  rust = 1.60</changelog>
</package>
<package pkgid="0fe08939c0111241f2b1cd9d8f7775b8f36b3239ab92ba08cd1f5cb46b794842" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="101.99" rel="4.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1643544000">- disable ccache, this adds about 1 minute of build time and
  over 2 GB of disk space usage without benefit on OBS builds
- build with rust-simd like upstream does
- use -g1 for debuginfo generation as this is what upstream
  does as well and it saves ~ 2GB of writes
- use %limit on x86_64 to scale down to less capable workers
- disable install stripping so that debuginfo is useful
- use autopatch
- cleanup constraints to specify only jobs, physicalmemory
  and memoryperjob to be more flexible on which host to build
  on</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644235200">- remove memoryperjob and use %limit instead. this allows to
  adapt to more worker types, and lowers the time the package
  is stuck in "scheduling". raising memory above 8 to lower
  risk for LTO jobs to run OOM
- add hack to disable -Wl,--gc-section which avoids a binutils
  segfault on x86
- change mozilla-reduce-rust-debuginfo.patch: use -g1 everywhere</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1644321600">- Mozilla Firefox 97.0
  MFSA 2022-04 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during update
  * CVE-2022-22755 (bmo#1309630)
    XSL could have allowed JavaScript execution after a tab was closed
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22757 (bmo#1720098)
    Remote Agent did not prevent local websites from connecting
  * CVE-2022-22758 (bmo#1728742)
    tel: links could have sent USSD codes to the dialer on
    Firefox for Android
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22762 (bmo#1743931)
    JavaScript Dialogs could have been displayed over other
    domains on Firefox for Android
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6
  * CVE-2022-0511 (bmo#1713579, bmo#1735448, bmo#1743821, bmo#1746313,
    bmo#1746314, bmo#1746316, bmo#1746321, bmo#1746322, bmo#1746323,
    bmo#1746412, bmo#1746430, bmo#1746451, bmo#1746488, bmo#1746875,
    bmo#1746898, bmo#1746905, bmo#1746907, bmo#1746917, bmo#1747128,
    bmo#1747137, bmo#1747331, bmo#1747346, bmo#1747439, bmo#1747457,
    bmo#1747870, bmo#1749051, bmo#1749274, bmo#1749831)
    Memory safety bugs fixed in Firefox 97
- requires NSS 3.74
- requires rust 1.57</changelog>
  <changelog author="Luciano Santos &lt;luc14n0@opensuse.org&gt;" date="1644840000">- Remove bashisms ("source" and "function" keywords) from
  mozilla.sh.in to ally with the #!/bin/sh shebang. If the end user
  has either dash-sh package or busybox-sh to handle Bourn Shell
  scripts rather than having bash-sh package, the script would
  fail. Using "." instead of "source" and "create_langpack_link()"
  function definition is enough to keep both sides sane,
  behavior-wise.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645185600">- Mozilla Firefox 97.0.1
  * Fixed: Fixed an issue where TikTok videos would fail to load
    when selected from a user's profile page (bmo#1750973)
  * Fixed: Fixed an issue which led to Picture-in-Picture mode
    being unable to be toggled on Hulu (bmo#1753401)
  * Fixed: Works around problems with WebRoot SecureAnywhere
    antivirus rendering Firefox unusable in some situations
    (bmo#1752466)
  * Fixed: Fixed an issue causing users to see the Restore
    Session screen unexpectedly when starting Firefox
    (bmo#1749996)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1646740800">- Mozilla Firefox 98.0
  * Firefox has a new optimized download flow
  * other changes as documented here
    https://www.mozilla.org/en-US/firefox/98.0/releasenotes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26382 (bmo#1741888)
    Autofill Text could be exfiltrated via side-channel attacks
  * CVE-2022-26385 (bmo#1747526)
    Use-after-free in thread shutdown
  * CVE-2022-0843 (bmo#1746523, bmo#1749062, bmo#1749164, bmo#1749214,
    bmo#1749610, bmo#1750032, bmo#1752100, bmo#1752405, bmo#1753612,
    bmo#1754508)
    Memory safety bugs fixed in Firefox 98
- requires NSS 3.75
- add mozilla-bmo1756347.patch to fix i586 build</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1647259200">- Mozilla Firefox 98.0.1:
  * Yandex and Mail.ru have been removed as optional search
    providers in the drop-down search menu in Firefox</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647518401">- exclude slow cpus for building</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1647950400">- Add patch to fix start-up on aarch64:
  * mozilla-bmo1757571.patch</changelog>
  <changelog author="Simon Vogl &lt;simon.vogl@gmx.net&gt;" date="1648036800">- Change mozilla-kde.patch to follow the GNOME registry
  behavior for new MIME types to avoid opening downloaded files
  without any inquiries (bsc#1197319)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1648123200">- MozillaFirefox 98.0.2:
  * Fixed: Fixed an issue preventing users from typing in Address
    Bar after opening new tab and pressing cmd + enter
    (bmo#1757376)
  * Fixed: Fixed an issue causing some users to crash in out-of-
    memory conditions (bmo#1757618)
  * Fixed: Fixed an issue in session history which caused some
    sites to fail to load (bmo#1758664)
  * Fixed: Fixed an add-on specific compatibility issue
    (bmo#1759162)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1649073600">- Mozilla Firefox 99.0
  * You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  * You can find added support for search?with or without
    diacritics?in the PDF viewer.
  * The Linux sandbox has been strengthened: processes exposed to web
    content no longer have access to the X Window system (X11).
  * Firefox now supports credit card autofill and capture in
    Germany and France.
  MFSA 2022-13 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28283 (bmo#1754066)
    Missing security checks for fetching sourceMapURL
  * CVE-2022-28284 (bmo#1754522)
    Script could be executed via svg's use element
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-28287 (bmo#1741515)
    Text Selection could crash Firefox
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8
  * CVE-2022-28288 (bmo#1746415, bmo#1746495, bmo#1746500,
    bmo#1747282, bmo#1748759, bmo#1749056, bmo#1749786,
    bmo#1751679, bmo#1752120, bmo#1756010, bmo#1756017,
    bmo#1757213, bmo#1757258, bmo#1757427)
    Memory safety bugs fixed in Firefox 99
- requires NSS &gt;= 3.76.1
- remove obsolete patch
  * mozilla-bmo1756347.patch
  * mozilla-bmo1757571.patch
- update create-tar.sh</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1649764800">- Mozilla Firefox 99.0.1
  * Fixed an issue with text rendering in Bengali (bmo#1763368)
  * Fixed a selection issue in the Download panel with drag and
    drop (bmo#1762723)
  * Fixed: Fixed an issue preventing Zoom gallery mode for users
    who go to zoom.us URLs instead of subdomain.zoom.us URLs
    (bmo#1763801)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1651406400">- Mozilla Firefox 100.0
  * subtitle support in PiP
  * spell checking supports multiple languages in parallel
  * more details here
    https://www.mozilla.org/en-US/firefox/100.0/releasenotes
  MFSA 2022-16 (boo#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29910 (bmo#1757138)
    Firefox for Android forgot HTTP Strict Transport Security
    settings
  * CVE-2022-29915 (bmo#1751678)
    Leaking cross-origin redirect through the Performance API
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9
  * CVE-2022-29918 (bmo#1744043, bmo#1747178, bmo#1753535,
    bmo#1754017, bmo#1755847, bmo#1756172, bmo#1757477,
    bmo#1758223, bmo#1760160, bmo#1761481, bmo#1761771)
    Memory safety bugs fixed in Firefox 100
- requires NSS 3.77</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1652875200">- Mozilla Firefox 100.0.1:
  * Fixed: Fixed an issue with subtitles in Picture-in-Picture
    mode while using Netflix (bmo#1768818)
  * Fixed: Fixed an issue where some commands were unavailable in
    the Picture-in-Picture window (bmo#1768201)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653048000">- Mozilla Firefox 100.0.2
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653825600">- Mozilla Firefox 101.0
  * Reading is now easier with the prefers-contrast media query,
    which allows sites to detect if the user has requested that web
    content is presented with a higher (or lower) contrast
  * All non-configured MIME types can now be assigned a custom
    action upon download completion
  * allows users to use as many microphones as you want, at the
    same time, during video conferencing. The most exciting benefit
    is that you can easily switch your microphones at any time
    (if your conferencing service provider enables this flexibility)
  MFSA 2022-20 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of allowCredential
    entries may have leaked cross-origin information
  * CVE-2022-31743 (bmo#1747388)
    HTML Parsing incorrectly ended HTML comments prematurely
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-31745 (bmo#1760944)
    Incorrect Assertion caused by unoptimized array shift operations
  * CVE-2022-1919 (bmo#1761275)
    Memory Corruption when manipulating webp images
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10
  * CVE-2022-31748 (bmo#1713773, bmo#1762201, bmo#1762469,
    bmo#1762770, bmo#1764878, bmo#1765226, bmo#1765782, bmo#1765973,
    bmo#1767177, bmo#1767181, bmo#1768232, bmo#1768251, bmo#1769869)
    Memory safety bugs fixed in Firefox 101
- requires
  * NSS 3.78.1
  * rust-cbindgen 0.23.0
  * rust 1.59</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1654862400">- Mozilla Firefox 101.0.1:
  * Fixed context menus not appearing when right-clicking
    Picture-in-Picture windows on some Linux systems (bmo#1771914)
  * Various stability fixes</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1655812800">- Firefox 102.0 (build1)
- requires
  NSPR &gt;= 4.34
  NSS &gt;= 3.79
  rust = 1.60</changelog>
</package>
<package pkgid="a9a8ea5b369d5ef1585c315f9532248348b0d1f5a02d2e6447bb842d60b47465" name="MozillaFirefox-translations-common" arch="i686">
  <version epoch="0" ver="101.99" rel="4.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1643544000">- disable ccache, this adds about 1 minute of build time and
  over 2 GB of disk space usage without benefit on OBS builds
- build with rust-simd like upstream does
- use -g1 for debuginfo generation as this is what upstream
  does as well and it saves ~ 2GB of writes
- use %limit on x86_64 to scale down to less capable workers
- disable install stripping so that debuginfo is useful
- use autopatch
- cleanup constraints to specify only jobs, physicalmemory
  and memoryperjob to be more flexible on which host to build
  on</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644235200">- remove memoryperjob and use %limit instead. this allows to
  adapt to more worker types, and lowers the time the package
  is stuck in "scheduling". raising memory above 8 to lower
  risk for LTO jobs to run OOM
- add hack to disable -Wl,--gc-section which avoids a binutils
  segfault on x86
- change mozilla-reduce-rust-debuginfo.patch: use -g1 everywhere</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1644321600">- Mozilla Firefox 97.0
  MFSA 2022-04 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during update
  * CVE-2022-22755 (bmo#1309630)
    XSL could have allowed JavaScript execution after a tab was closed
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22757 (bmo#1720098)
    Remote Agent did not prevent local websites from connecting
  * CVE-2022-22758 (bmo#1728742)
    tel: links could have sent USSD codes to the dialer on
    Firefox for Android
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22762 (bmo#1743931)
    JavaScript Dialogs could have been displayed over other
    domains on Firefox for Android
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6
  * CVE-2022-0511 (bmo#1713579, bmo#1735448, bmo#1743821, bmo#1746313,
    bmo#1746314, bmo#1746316, bmo#1746321, bmo#1746322, bmo#1746323,
    bmo#1746412, bmo#1746430, bmo#1746451, bmo#1746488, bmo#1746875,
    bmo#1746898, bmo#1746905, bmo#1746907, bmo#1746917, bmo#1747128,
    bmo#1747137, bmo#1747331, bmo#1747346, bmo#1747439, bmo#1747457,
    bmo#1747870, bmo#1749051, bmo#1749274, bmo#1749831)
    Memory safety bugs fixed in Firefox 97
- requires NSS 3.74
- requires rust 1.57</changelog>
  <changelog author="Luciano Santos &lt;luc14n0@opensuse.org&gt;" date="1644840000">- Remove bashisms ("source" and "function" keywords) from
  mozilla.sh.in to ally with the #!/bin/sh shebang. If the end user
  has either dash-sh package or busybox-sh to handle Bourn Shell
  scripts rather than having bash-sh package, the script would
  fail. Using "." instead of "source" and "create_langpack_link()"
  function definition is enough to keep both sides sane,
  behavior-wise.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645185600">- Mozilla Firefox 97.0.1
  * Fixed: Fixed an issue where TikTok videos would fail to load
    when selected from a user's profile page (bmo#1750973)
  * Fixed: Fixed an issue which led to Picture-in-Picture mode
    being unable to be toggled on Hulu (bmo#1753401)
  * Fixed: Works around problems with WebRoot SecureAnywhere
    antivirus rendering Firefox unusable in some situations
    (bmo#1752466)
  * Fixed: Fixed an issue causing users to see the Restore
    Session screen unexpectedly when starting Firefox
    (bmo#1749996)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1646740800">- Mozilla Firefox 98.0
  * Firefox has a new optimized download flow
  * other changes as documented here
    https://www.mozilla.org/en-US/firefox/98.0/releasenotes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26382 (bmo#1741888)
    Autofill Text could be exfiltrated via side-channel attacks
  * CVE-2022-26385 (bmo#1747526)
    Use-after-free in thread shutdown
  * CVE-2022-0843 (bmo#1746523, bmo#1749062, bmo#1749164, bmo#1749214,
    bmo#1749610, bmo#1750032, bmo#1752100, bmo#1752405, bmo#1753612,
    bmo#1754508)
    Memory safety bugs fixed in Firefox 98
- requires NSS 3.75
- add mozilla-bmo1756347.patch to fix i586 build</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1647259200">- Mozilla Firefox 98.0.1:
  * Yandex and Mail.ru have been removed as optional search
    providers in the drop-down search menu in Firefox</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647518401">- exclude slow cpus for building</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1647950400">- Add patch to fix start-up on aarch64:
  * mozilla-bmo1757571.patch</changelog>
  <changelog author="Simon Vogl &lt;simon.vogl@gmx.net&gt;" date="1648036800">- Change mozilla-kde.patch to follow the GNOME registry
  behavior for new MIME types to avoid opening downloaded files
  without any inquiries (bsc#1197319)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1648123200">- MozillaFirefox 98.0.2:
  * Fixed: Fixed an issue preventing users from typing in Address
    Bar after opening new tab and pressing cmd + enter
    (bmo#1757376)
  * Fixed: Fixed an issue causing some users to crash in out-of-
    memory conditions (bmo#1757618)
  * Fixed: Fixed an issue in session history which caused some
    sites to fail to load (bmo#1758664)
  * Fixed: Fixed an add-on specific compatibility issue
    (bmo#1759162)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1649073600">- Mozilla Firefox 99.0
  * You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  * You can find added support for search?with or without
    diacritics?in the PDF viewer.
  * The Linux sandbox has been strengthened: processes exposed to web
    content no longer have access to the X Window system (X11).
  * Firefox now supports credit card autofill and capture in
    Germany and France.
  MFSA 2022-13 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28283 (bmo#1754066)
    Missing security checks for fetching sourceMapURL
  * CVE-2022-28284 (bmo#1754522)
    Script could be executed via svg's use element
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-28287 (bmo#1741515)
    Text Selection could crash Firefox
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8
  * CVE-2022-28288 (bmo#1746415, bmo#1746495, bmo#1746500,
    bmo#1747282, bmo#1748759, bmo#1749056, bmo#1749786,
    bmo#1751679, bmo#1752120, bmo#1756010, bmo#1756017,
    bmo#1757213, bmo#1757258, bmo#1757427)
    Memory safety bugs fixed in Firefox 99
- requires NSS &gt;= 3.76.1
- remove obsolete patch
  * mozilla-bmo1756347.patch
  * mozilla-bmo1757571.patch
- update create-tar.sh</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1649764800">- Mozilla Firefox 99.0.1
  * Fixed an issue with text rendering in Bengali (bmo#1763368)
  * Fixed a selection issue in the Download panel with drag and
    drop (bmo#1762723)
  * Fixed: Fixed an issue preventing Zoom gallery mode for users
    who go to zoom.us URLs instead of subdomain.zoom.us URLs
    (bmo#1763801)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1651406400">- Mozilla Firefox 100.0
  * subtitle support in PiP
  * spell checking supports multiple languages in parallel
  * more details here
    https://www.mozilla.org/en-US/firefox/100.0/releasenotes
  MFSA 2022-16 (boo#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29910 (bmo#1757138)
    Firefox for Android forgot HTTP Strict Transport Security
    settings
  * CVE-2022-29915 (bmo#1751678)
    Leaking cross-origin redirect through the Performance API
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9
  * CVE-2022-29918 (bmo#1744043, bmo#1747178, bmo#1753535,
    bmo#1754017, bmo#1755847, bmo#1756172, bmo#1757477,
    bmo#1758223, bmo#1760160, bmo#1761481, bmo#1761771)
    Memory safety bugs fixed in Firefox 100
- requires NSS 3.77</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1652875200">- Mozilla Firefox 100.0.1:
  * Fixed: Fixed an issue with subtitles in Picture-in-Picture
    mode while using Netflix (bmo#1768818)
  * Fixed: Fixed an issue where some commands were unavailable in
    the Picture-in-Picture window (bmo#1768201)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653048000">- Mozilla Firefox 100.0.2
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653825600">- Mozilla Firefox 101.0
  * Reading is now easier with the prefers-contrast media query,
    which allows sites to detect if the user has requested that web
    content is presented with a higher (or lower) contrast
  * All non-configured MIME types can now be assigned a custom
    action upon download completion
  * allows users to use as many microphones as you want, at the
    same time, during video conferencing. The most exciting benefit
    is that you can easily switch your microphones at any time
    (if your conferencing service provider enables this flexibility)
  MFSA 2022-20 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of allowCredential
    entries may have leaked cross-origin information
  * CVE-2022-31743 (bmo#1747388)
    HTML Parsing incorrectly ended HTML comments prematurely
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-31745 (bmo#1760944)
    Incorrect Assertion caused by unoptimized array shift operations
  * CVE-2022-1919 (bmo#1761275)
    Memory Corruption when manipulating webp images
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10
  * CVE-2022-31748 (bmo#1713773, bmo#1762201, bmo#1762469,
    bmo#1762770, bmo#1764878, bmo#1765226, bmo#1765782, bmo#1765973,
    bmo#1767177, bmo#1767181, bmo#1768232, bmo#1768251, bmo#1769869)
    Memory safety bugs fixed in Firefox 101
- requires
  * NSS 3.78.1
  * rust-cbindgen 0.23.0
  * rust 1.59</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1654862400">- Mozilla Firefox 101.0.1:
  * Fixed context menus not appearing when right-clicking
    Picture-in-Picture windows on some Linux systems (bmo#1771914)
  * Various stability fixes</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1655812800">- Firefox 102.0 (build1)
- requires
  NSPR &gt;= 4.34
  NSS &gt;= 3.79
  rust = 1.60</changelog>
</package>
<package pkgid="2ce923e39858be37583545d88dd945ae8d9dbd30b3e25bbff4397569c418b9ed" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="101.99" rel="4.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1643544000">- disable ccache, this adds about 1 minute of build time and
  over 2 GB of disk space usage without benefit on OBS builds
- build with rust-simd like upstream does
- use -g1 for debuginfo generation as this is what upstream
  does as well and it saves ~ 2GB of writes
- use %limit on x86_64 to scale down to less capable workers
- disable install stripping so that debuginfo is useful
- use autopatch
- cleanup constraints to specify only jobs, physicalmemory
  and memoryperjob to be more flexible on which host to build
  on</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644235200">- remove memoryperjob and use %limit instead. this allows to
  adapt to more worker types, and lowers the time the package
  is stuck in "scheduling". raising memory above 8 to lower
  risk for LTO jobs to run OOM
- add hack to disable -Wl,--gc-section which avoids a binutils
  segfault on x86
- change mozilla-reduce-rust-debuginfo.patch: use -g1 everywhere</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1644321600">- Mozilla Firefox 97.0
  MFSA 2022-04 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during update
  * CVE-2022-22755 (bmo#1309630)
    XSL could have allowed JavaScript execution after a tab was closed
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22757 (bmo#1720098)
    Remote Agent did not prevent local websites from connecting
  * CVE-2022-22758 (bmo#1728742)
    tel: links could have sent USSD codes to the dialer on
    Firefox for Android
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22762 (bmo#1743931)
    JavaScript Dialogs could have been displayed over other
    domains on Firefox for Android
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6
  * CVE-2022-0511 (bmo#1713579, bmo#1735448, bmo#1743821, bmo#1746313,
    bmo#1746314, bmo#1746316, bmo#1746321, bmo#1746322, bmo#1746323,
    bmo#1746412, bmo#1746430, bmo#1746451, bmo#1746488, bmo#1746875,
    bmo#1746898, bmo#1746905, bmo#1746907, bmo#1746917, bmo#1747128,
    bmo#1747137, bmo#1747331, bmo#1747346, bmo#1747439, bmo#1747457,
    bmo#1747870, bmo#1749051, bmo#1749274, bmo#1749831)
    Memory safety bugs fixed in Firefox 97
- requires NSS 3.74
- requires rust 1.57</changelog>
  <changelog author="Luciano Santos &lt;luc14n0@opensuse.org&gt;" date="1644840000">- Remove bashisms ("source" and "function" keywords) from
  mozilla.sh.in to ally with the #!/bin/sh shebang. If the end user
  has either dash-sh package or busybox-sh to handle Bourn Shell
  scripts rather than having bash-sh package, the script would
  fail. Using "." instead of "source" and "create_langpack_link()"
  function definition is enough to keep both sides sane,
  behavior-wise.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645185600">- Mozilla Firefox 97.0.1
  * Fixed: Fixed an issue where TikTok videos would fail to load
    when selected from a user's profile page (bmo#1750973)
  * Fixed: Fixed an issue which led to Picture-in-Picture mode
    being unable to be toggled on Hulu (bmo#1753401)
  * Fixed: Works around problems with WebRoot SecureAnywhere
    antivirus rendering Firefox unusable in some situations
    (bmo#1752466)
  * Fixed: Fixed an issue causing users to see the Restore
    Session screen unexpectedly when starting Firefox
    (bmo#1749996)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1646740800">- Mozilla Firefox 98.0
  * Firefox has a new optimized download flow
  * other changes as documented here
    https://www.mozilla.org/en-US/firefox/98.0/releasenotes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26382 (bmo#1741888)
    Autofill Text could be exfiltrated via side-channel attacks
  * CVE-2022-26385 (bmo#1747526)
    Use-after-free in thread shutdown
  * CVE-2022-0843 (bmo#1746523, bmo#1749062, bmo#1749164, bmo#1749214,
    bmo#1749610, bmo#1750032, bmo#1752100, bmo#1752405, bmo#1753612,
    bmo#1754508)
    Memory safety bugs fixed in Firefox 98
- requires NSS 3.75
- add mozilla-bmo1756347.patch to fix i586 build</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1647259200">- Mozilla Firefox 98.0.1:
  * Yandex and Mail.ru have been removed as optional search
    providers in the drop-down search menu in Firefox</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647518401">- exclude slow cpus for building</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1647950400">- Add patch to fix start-up on aarch64:
  * mozilla-bmo1757571.patch</changelog>
  <changelog author="Simon Vogl &lt;simon.vogl@gmx.net&gt;" date="1648036800">- Change mozilla-kde.patch to follow the GNOME registry
  behavior for new MIME types to avoid opening downloaded files
  without any inquiries (bsc#1197319)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1648123200">- MozillaFirefox 98.0.2:
  * Fixed: Fixed an issue preventing users from typing in Address
    Bar after opening new tab and pressing cmd + enter
    (bmo#1757376)
  * Fixed: Fixed an issue causing some users to crash in out-of-
    memory conditions (bmo#1757618)
  * Fixed: Fixed an issue in session history which caused some
    sites to fail to load (bmo#1758664)
  * Fixed: Fixed an add-on specific compatibility issue
    (bmo#1759162)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1649073600">- Mozilla Firefox 99.0
  * You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  * You can find added support for search?with or without
    diacritics?in the PDF viewer.
  * The Linux sandbox has been strengthened: processes exposed to web
    content no longer have access to the X Window system (X11).
  * Firefox now supports credit card autofill and capture in
    Germany and France.
  MFSA 2022-13 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28283 (bmo#1754066)
    Missing security checks for fetching sourceMapURL
  * CVE-2022-28284 (bmo#1754522)
    Script could be executed via svg's use element
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-28287 (bmo#1741515)
    Text Selection could crash Firefox
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8
  * CVE-2022-28288 (bmo#1746415, bmo#1746495, bmo#1746500,
    bmo#1747282, bmo#1748759, bmo#1749056, bmo#1749786,
    bmo#1751679, bmo#1752120, bmo#1756010, bmo#1756017,
    bmo#1757213, bmo#1757258, bmo#1757427)
    Memory safety bugs fixed in Firefox 99
- requires NSS &gt;= 3.76.1
- remove obsolete patch
  * mozilla-bmo1756347.patch
  * mozilla-bmo1757571.patch
- update create-tar.sh</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1649764800">- Mozilla Firefox 99.0.1
  * Fixed an issue with text rendering in Bengali (bmo#1763368)
  * Fixed a selection issue in the Download panel with drag and
    drop (bmo#1762723)
  * Fixed: Fixed an issue preventing Zoom gallery mode for users
    who go to zoom.us URLs instead of subdomain.zoom.us URLs
    (bmo#1763801)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1651406400">- Mozilla Firefox 100.0
  * subtitle support in PiP
  * spell checking supports multiple languages in parallel
  * more details here
    https://www.mozilla.org/en-US/firefox/100.0/releasenotes
  MFSA 2022-16 (boo#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29910 (bmo#1757138)
    Firefox for Android forgot HTTP Strict Transport Security
    settings
  * CVE-2022-29915 (bmo#1751678)
    Leaking cross-origin redirect through the Performance API
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9
  * CVE-2022-29918 (bmo#1744043, bmo#1747178, bmo#1753535,
    bmo#1754017, bmo#1755847, bmo#1756172, bmo#1757477,
    bmo#1758223, bmo#1760160, bmo#1761481, bmo#1761771)
    Memory safety bugs fixed in Firefox 100
- requires NSS 3.77</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1652875200">- Mozilla Firefox 100.0.1:
  * Fixed: Fixed an issue with subtitles in Picture-in-Picture
    mode while using Netflix (bmo#1768818)
  * Fixed: Fixed an issue where some commands were unavailable in
    the Picture-in-Picture window (bmo#1768201)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653048000">- Mozilla Firefox 100.0.2
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653825600">- Mozilla Firefox 101.0
  * Reading is now easier with the prefers-contrast media query,
    which allows sites to detect if the user has requested that web
    content is presented with a higher (or lower) contrast
  * All non-configured MIME types can now be assigned a custom
    action upon download completion
  * allows users to use as many microphones as you want, at the
    same time, during video conferencing. The most exciting benefit
    is that you can easily switch your microphones at any time
    (if your conferencing service provider enables this flexibility)
  MFSA 2022-20 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of allowCredential
    entries may have leaked cross-origin information
  * CVE-2022-31743 (bmo#1747388)
    HTML Parsing incorrectly ended HTML comments prematurely
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-31745 (bmo#1760944)
    Incorrect Assertion caused by unoptimized array shift operations
  * CVE-2022-1919 (bmo#1761275)
    Memory Corruption when manipulating webp images
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10
  * CVE-2022-31748 (bmo#1713773, bmo#1762201, bmo#1762469,
    bmo#1762770, bmo#1764878, bmo#1765226, bmo#1765782, bmo#1765973,
    bmo#1767177, bmo#1767181, bmo#1768232, bmo#1768251, bmo#1769869)
    Memory safety bugs fixed in Firefox 101
- requires
  * NSS 3.78.1
  * rust-cbindgen 0.23.0
  * rust 1.59</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1654862400">- Mozilla Firefox 101.0.1:
  * Fixed context menus not appearing when right-clicking
    Picture-in-Picture windows on some Linux systems (bmo#1771914)
  * Various stability fixes</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1655812800">- Firefox 102.0 (build1)
- requires
  NSPR &gt;= 4.34
  NSS &gt;= 3.79
  rust = 1.60</changelog>
</package>
<package pkgid="2b9e32e36ed726170b0a85f3c04094282bd422a86d009e3813881f36c6b7b31f" name="MozillaFirefox-translations-other" arch="i686">
  <version epoch="0" ver="101.99" rel="4.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1643544000">- disable ccache, this adds about 1 minute of build time and
  over 2 GB of disk space usage without benefit on OBS builds
- build with rust-simd like upstream does
- use -g1 for debuginfo generation as this is what upstream
  does as well and it saves ~ 2GB of writes
- use %limit on x86_64 to scale down to less capable workers
- disable install stripping so that debuginfo is useful
- use autopatch
- cleanup constraints to specify only jobs, physicalmemory
  and memoryperjob to be more flexible on which host to build
  on</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644235200">- remove memoryperjob and use %limit instead. this allows to
  adapt to more worker types, and lowers the time the package
  is stuck in "scheduling". raising memory above 8 to lower
  risk for LTO jobs to run OOM
- add hack to disable -Wl,--gc-section which avoids a binutils
  segfault on x86
- change mozilla-reduce-rust-debuginfo.patch: use -g1 everywhere</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1644321600">- Mozilla Firefox 97.0
  MFSA 2022-04 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during update
  * CVE-2022-22755 (bmo#1309630)
    XSL could have allowed JavaScript execution after a tab was closed
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22757 (bmo#1720098)
    Remote Agent did not prevent local websites from connecting
  * CVE-2022-22758 (bmo#1728742)
    tel: links could have sent USSD codes to the dialer on
    Firefox for Android
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22762 (bmo#1743931)
    JavaScript Dialogs could have been displayed over other
    domains on Firefox for Android
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6
  * CVE-2022-0511 (bmo#1713579, bmo#1735448, bmo#1743821, bmo#1746313,
    bmo#1746314, bmo#1746316, bmo#1746321, bmo#1746322, bmo#1746323,
    bmo#1746412, bmo#1746430, bmo#1746451, bmo#1746488, bmo#1746875,
    bmo#1746898, bmo#1746905, bmo#1746907, bmo#1746917, bmo#1747128,
    bmo#1747137, bmo#1747331, bmo#1747346, bmo#1747439, bmo#1747457,
    bmo#1747870, bmo#1749051, bmo#1749274, bmo#1749831)
    Memory safety bugs fixed in Firefox 97
- requires NSS 3.74
- requires rust 1.57</changelog>
  <changelog author="Luciano Santos &lt;luc14n0@opensuse.org&gt;" date="1644840000">- Remove bashisms ("source" and "function" keywords) from
  mozilla.sh.in to ally with the #!/bin/sh shebang. If the end user
  has either dash-sh package or busybox-sh to handle Bourn Shell
  scripts rather than having bash-sh package, the script would
  fail. Using "." instead of "source" and "create_langpack_link()"
  function definition is enough to keep both sides sane,
  behavior-wise.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645185600">- Mozilla Firefox 97.0.1
  * Fixed: Fixed an issue where TikTok videos would fail to load
    when selected from a user's profile page (bmo#1750973)
  * Fixed: Fixed an issue which led to Picture-in-Picture mode
    being unable to be toggled on Hulu (bmo#1753401)
  * Fixed: Works around problems with WebRoot SecureAnywhere
    antivirus rendering Firefox unusable in some situations
    (bmo#1752466)
  * Fixed: Fixed an issue causing users to see the Restore
    Session screen unexpectedly when starting Firefox
    (bmo#1749996)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1646740800">- Mozilla Firefox 98.0
  * Firefox has a new optimized download flow
  * other changes as documented here
    https://www.mozilla.org/en-US/firefox/98.0/releasenotes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26382 (bmo#1741888)
    Autofill Text could be exfiltrated via side-channel attacks
  * CVE-2022-26385 (bmo#1747526)
    Use-after-free in thread shutdown
  * CVE-2022-0843 (bmo#1746523, bmo#1749062, bmo#1749164, bmo#1749214,
    bmo#1749610, bmo#1750032, bmo#1752100, bmo#1752405, bmo#1753612,
    bmo#1754508)
    Memory safety bugs fixed in Firefox 98
- requires NSS 3.75
- add mozilla-bmo1756347.patch to fix i586 build</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1647259200">- Mozilla Firefox 98.0.1:
  * Yandex and Mail.ru have been removed as optional search
    providers in the drop-down search menu in Firefox</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647518401">- exclude slow cpus for building</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1647950400">- Add patch to fix start-up on aarch64:
  * mozilla-bmo1757571.patch</changelog>
  <changelog author="Simon Vogl &lt;simon.vogl@gmx.net&gt;" date="1648036800">- Change mozilla-kde.patch to follow the GNOME registry
  behavior for new MIME types to avoid opening downloaded files
  without any inquiries (bsc#1197319)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1648123200">- MozillaFirefox 98.0.2:
  * Fixed: Fixed an issue preventing users from typing in Address
    Bar after opening new tab and pressing cmd + enter
    (bmo#1757376)
  * Fixed: Fixed an issue causing some users to crash in out-of-
    memory conditions (bmo#1757618)
  * Fixed: Fixed an issue in session history which caused some
    sites to fail to load (bmo#1758664)
  * Fixed: Fixed an add-on specific compatibility issue
    (bmo#1759162)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1649073600">- Mozilla Firefox 99.0
  * You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  * You can find added support for search?with or without
    diacritics?in the PDF viewer.
  * The Linux sandbox has been strengthened: processes exposed to web
    content no longer have access to the X Window system (X11).
  * Firefox now supports credit card autofill and capture in
    Germany and France.
  MFSA 2022-13 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28283 (bmo#1754066)
    Missing security checks for fetching sourceMapURL
  * CVE-2022-28284 (bmo#1754522)
    Script could be executed via svg's use element
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-28287 (bmo#1741515)
    Text Selection could crash Firefox
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8
  * CVE-2022-28288 (bmo#1746415, bmo#1746495, bmo#1746500,
    bmo#1747282, bmo#1748759, bmo#1749056, bmo#1749786,
    bmo#1751679, bmo#1752120, bmo#1756010, bmo#1756017,
    bmo#1757213, bmo#1757258, bmo#1757427)
    Memory safety bugs fixed in Firefox 99
- requires NSS &gt;= 3.76.1
- remove obsolete patch
  * mozilla-bmo1756347.patch
  * mozilla-bmo1757571.patch
- update create-tar.sh</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1649764800">- Mozilla Firefox 99.0.1
  * Fixed an issue with text rendering in Bengali (bmo#1763368)
  * Fixed a selection issue in the Download panel with drag and
    drop (bmo#1762723)
  * Fixed: Fixed an issue preventing Zoom gallery mode for users
    who go to zoom.us URLs instead of subdomain.zoom.us URLs
    (bmo#1763801)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1651406400">- Mozilla Firefox 100.0
  * subtitle support in PiP
  * spell checking supports multiple languages in parallel
  * more details here
    https://www.mozilla.org/en-US/firefox/100.0/releasenotes
  MFSA 2022-16 (boo#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29910 (bmo#1757138)
    Firefox for Android forgot HTTP Strict Transport Security
    settings
  * CVE-2022-29915 (bmo#1751678)
    Leaking cross-origin redirect through the Performance API
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9
  * CVE-2022-29918 (bmo#1744043, bmo#1747178, bmo#1753535,
    bmo#1754017, bmo#1755847, bmo#1756172, bmo#1757477,
    bmo#1758223, bmo#1760160, bmo#1761481, bmo#1761771)
    Memory safety bugs fixed in Firefox 100
- requires NSS 3.77</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1652875200">- Mozilla Firefox 100.0.1:
  * Fixed: Fixed an issue with subtitles in Picture-in-Picture
    mode while using Netflix (bmo#1768818)
  * Fixed: Fixed an issue where some commands were unavailable in
    the Picture-in-Picture window (bmo#1768201)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653048000">- Mozilla Firefox 100.0.2
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653825600">- Mozilla Firefox 101.0
  * Reading is now easier with the prefers-contrast media query,
    which allows sites to detect if the user has requested that web
    content is presented with a higher (or lower) contrast
  * All non-configured MIME types can now be assigned a custom
    action upon download completion
  * allows users to use as many microphones as you want, at the
    same time, during video conferencing. The most exciting benefit
    is that you can easily switch your microphones at any time
    (if your conferencing service provider enables this flexibility)
  MFSA 2022-20 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of allowCredential
    entries may have leaked cross-origin information
  * CVE-2022-31743 (bmo#1747388)
    HTML Parsing incorrectly ended HTML comments prematurely
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-31745 (bmo#1760944)
    Incorrect Assertion caused by unoptimized array shift operations
  * CVE-2022-1919 (bmo#1761275)
    Memory Corruption when manipulating webp images
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10
  * CVE-2022-31748 (bmo#1713773, bmo#1762201, bmo#1762469,
    bmo#1762770, bmo#1764878, bmo#1765226, bmo#1765782, bmo#1765973,
    bmo#1767177, bmo#1767181, bmo#1768232, bmo#1768251, bmo#1769869)
    Memory safety bugs fixed in Firefox 101
- requires
  * NSS 3.78.1
  * rust-cbindgen 0.23.0
  * rust 1.59</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1654862400">- Mozilla Firefox 101.0.1:
  * Fixed context menus not appearing when right-clicking
    Picture-in-Picture windows on some Linux systems (bmo#1771914)
  * Various stability fixes</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1655812800">- Firefox 102.0 (build1)
- requires
  NSPR &gt;= 4.34
  NSS &gt;= 3.79
  rust = 1.60</changelog>
</package>
<package pkgid="655960f616326fff8edfbec067300102dbdcdbc91b1ffa06d05f40d140c0e32c" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="101.99" rel="4.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1643544000">- disable ccache, this adds about 1 minute of build time and
  over 2 GB of disk space usage without benefit on OBS builds
- build with rust-simd like upstream does
- use -g1 for debuginfo generation as this is what upstream
  does as well and it saves ~ 2GB of writes
- use %limit on x86_64 to scale down to less capable workers
- disable install stripping so that debuginfo is useful
- use autopatch
- cleanup constraints to specify only jobs, physicalmemory
  and memoryperjob to be more flexible on which host to build
  on</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644235200">- remove memoryperjob and use %limit instead. this allows to
  adapt to more worker types, and lowers the time the package
  is stuck in "scheduling". raising memory above 8 to lower
  risk for LTO jobs to run OOM
- add hack to disable -Wl,--gc-section which avoids a binutils
  segfault on x86
- change mozilla-reduce-rust-debuginfo.patch: use -g1 everywhere</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1644321600">- Mozilla Firefox 97.0
  MFSA 2022-04 (bsc#1195682)
  * CVE-2022-22753 (bmo#1732435)
    Privilege Escalation to SYSTEM on Windows via Maintenance Service
  * CVE-2022-22754 (bmo#1750565)
    Extensions could have bypassed permission confirmation during update
  * CVE-2022-22755 (bmo#1309630)
    XSL could have allowed JavaScript execution after a tab was closed
  * CVE-2022-22756 (bmo#1317873)
    Drag and dropping an image could have resulted in the dropped
    object being an executable
  * CVE-2022-22757 (bmo#1720098)
    Remote Agent did not prevent local websites from connecting
  * CVE-2022-22758 (bmo#1728742)
    tel: links could have sent USSD codes to the dialer on
    Firefox for Android
  * CVE-2022-22759 (bmo#1739957)
    Sandboxed iframes could have executed script if the parent
    appended elements
  * CVE-2022-22760 (bmo#1740985, bmo#1748503)
    Cross-Origin responses could be distinguished between script
    and non-script content-types
  * CVE-2022-22761 (bmo#1745566)
    frame-ancestors Content Security Policy directive was not
    enforced for framed extension pages
  * CVE-2022-22762 (bmo#1743931)
    JavaScript Dialogs could have been displayed over other
    domains on Firefox for Android
  * CVE-2022-22764 (bmo#1742682, bmo#1744165, bmo#1746545,
    bmo#1748210, bmo#1748279)
    Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6
  * CVE-2022-0511 (bmo#1713579, bmo#1735448, bmo#1743821, bmo#1746313,
    bmo#1746314, bmo#1746316, bmo#1746321, bmo#1746322, bmo#1746323,
    bmo#1746412, bmo#1746430, bmo#1746451, bmo#1746488, bmo#1746875,
    bmo#1746898, bmo#1746905, bmo#1746907, bmo#1746917, bmo#1747128,
    bmo#1747137, bmo#1747331, bmo#1747346, bmo#1747439, bmo#1747457,
    bmo#1747870, bmo#1749051, bmo#1749274, bmo#1749831)
    Memory safety bugs fixed in Firefox 97
- requires NSS 3.74
- requires rust 1.57</changelog>
  <changelog author="Luciano Santos &lt;luc14n0@opensuse.org&gt;" date="1644840000">- Remove bashisms ("source" and "function" keywords) from
  mozilla.sh.in to ally with the #!/bin/sh shebang. If the end user
  has either dash-sh package or busybox-sh to handle Bourn Shell
  scripts rather than having bash-sh package, the script would
  fail. Using "." instead of "source" and "create_langpack_link()"
  function definition is enough to keep both sides sane,
  behavior-wise.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645185600">- Mozilla Firefox 97.0.1
  * Fixed: Fixed an issue where TikTok videos would fail to load
    when selected from a user's profile page (bmo#1750973)
  * Fixed: Fixed an issue which led to Picture-in-Picture mode
    being unable to be toggled on Hulu (bmo#1753401)
  * Fixed: Works around problems with WebRoot SecureAnywhere
    antivirus rendering Firefox unusable in some situations
    (bmo#1752466)
  * Fixed: Fixed an issue causing users to see the Restore
    Session screen unexpectedly when starting Firefox
    (bmo#1749996)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1646740800">- Mozilla Firefox 98.0
  * Firefox has a new optimized download flow
  * other changes as documented here
    https://www.mozilla.org/en-US/firefox/98.0/releasenotes
  MFSA 2022-10 (bsc#1196900)
  * CVE-2022-26383 (bmo#1742421)
    Browser window spoof using fullscreen mode
  * CVE-2022-26384 (bmo#1744352)
    iframe allow-scripts sandbox bypass
  * CVE-2022-26387 (bmo#1752979)
    Time-of-check time-of-use bug when verifying add-on signatures
  * CVE-2022-26381 (bmo#1736243)
    Use-after-free in text reflows
  * CVE-2022-26382 (bmo#1741888)
    Autofill Text could be exfiltrated via side-channel attacks
  * CVE-2022-26385 (bmo#1747526)
    Use-after-free in thread shutdown
  * CVE-2022-0843 (bmo#1746523, bmo#1749062, bmo#1749164, bmo#1749214,
    bmo#1749610, bmo#1750032, bmo#1752100, bmo#1752405, bmo#1753612,
    bmo#1754508)
    Memory safety bugs fixed in Firefox 98
- requires NSS 3.75
- add mozilla-bmo1756347.patch to fix i586 build</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1647259200">- Mozilla Firefox 98.0.1:
  * Yandex and Mail.ru have been removed as optional search
    providers in the drop-down search menu in Firefox</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647518401">- exclude slow cpus for building</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1647950400">- Add patch to fix start-up on aarch64:
  * mozilla-bmo1757571.patch</changelog>
  <changelog author="Simon Vogl &lt;simon.vogl@gmx.net&gt;" date="1648036800">- Change mozilla-kde.patch to follow the GNOME registry
  behavior for new MIME types to avoid opening downloaded files
  without any inquiries (bsc#1197319)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1648123200">- MozillaFirefox 98.0.2:
  * Fixed: Fixed an issue preventing users from typing in Address
    Bar after opening new tab and pressing cmd + enter
    (bmo#1757376)
  * Fixed: Fixed an issue causing some users to crash in out-of-
    memory conditions (bmo#1757618)
  * Fixed: Fixed an issue in session history which caused some
    sites to fail to load (bmo#1758664)
  * Fixed: Fixed an add-on specific compatibility issue
    (bmo#1759162)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1649073600">- Mozilla Firefox 99.0
  * You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  * You can find added support for search?with or without
    diacritics?in the PDF viewer.
  * The Linux sandbox has been strengthened: processes exposed to web
    content no longer have access to the X Window system (X11).
  * Firefox now supports credit card autofill and capture in
    Germany and France.
  MFSA 2022-13 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28283 (bmo#1754066)
    Missing security checks for fetching sourceMapURL
  * CVE-2022-28284 (bmo#1754522)
    Script could be executed via svg's use element
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-28287 (bmo#1741515)
    Text Selection could crash Firefox
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8
  * CVE-2022-28288 (bmo#1746415, bmo#1746495, bmo#1746500,
    bmo#1747282, bmo#1748759, bmo#1749056, bmo#1749786,
    bmo#1751679, bmo#1752120, bmo#1756010, bmo#1756017,
    bmo#1757213, bmo#1757258, bmo#1757427)
    Memory safety bugs fixed in Firefox 99
- requires NSS &gt;= 3.76.1
- remove obsolete patch
  * mozilla-bmo1756347.patch
  * mozilla-bmo1757571.patch
- update create-tar.sh</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1649764800">- Mozilla Firefox 99.0.1
  * Fixed an issue with text rendering in Bengali (bmo#1763368)
  * Fixed a selection issue in the Download panel with drag and
    drop (bmo#1762723)
  * Fixed: Fixed an issue preventing Zoom gallery mode for users
    who go to zoom.us URLs instead of subdomain.zoom.us URLs
    (bmo#1763801)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1651406400">- Mozilla Firefox 100.0
  * subtitle support in PiP
  * spell checking supports multiple languages in parallel
  * more details here
    https://www.mozilla.org/en-US/firefox/100.0/releasenotes
  MFSA 2022-16 (boo#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29910 (bmo#1757138)
    Firefox for Android forgot HTTP Strict Transport Security
    settings
  * CVE-2022-29915 (bmo#1751678)
    Leaking cross-origin redirect through the Performance API
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9
  * CVE-2022-29918 (bmo#1744043, bmo#1747178, bmo#1753535,
    bmo#1754017, bmo#1755847, bmo#1756172, bmo#1757477,
    bmo#1758223, bmo#1760160, bmo#1761481, bmo#1761771)
    Memory safety bugs fixed in Firefox 100
- requires NSS 3.77</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1652875200">- Mozilla Firefox 100.0.1:
  * Fixed: Fixed an issue with subtitles in Picture-in-Picture
    mode while using Netflix (bmo#1768818)
  * Fixed: Fixed an issue where some commands were unavailable in
    the Picture-in-Picture window (bmo#1768201)</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653048000">- Mozilla Firefox 100.0.2
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1653825600">- Mozilla Firefox 101.0
  * Reading is now easier with the prefers-contrast media query,
    which allows sites to detect if the user has requested that web
    content is presented with a higher (or lower) contrast
  * All non-configured MIME types can now be assigned a custom
    action upon download completion
  * allows users to use as many microphones as you want, at the
    same time, during video conferencing. The most exciting benefit
    is that you can easily switch your microphones at any time
    (if your conferencing service provider enables this flexibility)
  MFSA 2022-20 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of allowCredential
    entries may have leaked cross-origin information
  * CVE-2022-31743 (bmo#1747388)
    HTML Parsing incorrectly ended HTML comments prematurely
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-31745 (bmo#1760944)
    Incorrect Assertion caused by unoptimized array shift operations
  * CVE-2022-1919 (bmo#1761275)
    Memory Corruption when manipulating webp images
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10
  * CVE-2022-31748 (bmo#1713773, bmo#1762201, bmo#1762469,
    bmo#1762770, bmo#1764878, bmo#1765226, bmo#1765782, bmo#1765973,
    bmo#1767177, bmo#1767181, bmo#1768232, bmo#1768251, bmo#1769869)
    Memory safety bugs fixed in Firefox 101
- requires
  * NSS 3.78.1
  * rust-cbindgen 0.23.0
  * rust 1.59</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1654862400">- Mozilla Firefox 101.0.1:
  * Fixed context menus not appearing when right-clicking
    Picture-in-Picture windows on some Linux systems (bmo#1771914)
  * Various stability fixes</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1655812800">- Firefox 102.0 (build1)
- requires
  NSPR &gt;= 4.34
  NSS &gt;= 3.79
  rust = 1.60</changelog>
</package>
</otherdata>