Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Evergreen:11.2
thunderbird-esr
thunderbird-esr.changes
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File thunderbird-esr.changes of Package thunderbird-esr
------------------------------------------------------------------- Mon Oct 28 19:23:51 UTC 2013 - wr@rosenauer.org - update to Thunderbird 17.0.10 (bnc#847708) * require NSS 3.14.4 or higher * MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592 Miscellaneous memory safety hazards * MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation with XSLT and uninitialized data * MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly initialized memory and overflows in some JavaScript functions * MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free when updating offline cache * MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601 (bmo#915210, bmo#915576, bmo#916685) Miscellaneous use-after-free issues found through ASAN fuzzing * MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory corruption in workers ------------------------------------------------------------------- Sat Sep 14 14:20:47 UTC 2013 - wr@rosenauer.org - update to Thunderbird 17.0.9esr (bnc#840485) * MFSA 2013-76/CVE-2013-1718 Miscellaneous memory safety hazards * MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free in Animation Manager during stylesheet cloning * MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope for new Javascript objects can lead to memory corruption * MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment mismatch re-attaching XBL-backed nodes * MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow with multi-column, lists, and floats * MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871, bmo#906301) Memory corruption involving scrolling * MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined properties on DOM proxies get the wrong "this" object ------------------------------------------------------------------- Fri Aug 2 06:55:20 UTC 2013 - wr@rosenauer.org - update to Thunderbird 17.0.8esr (bnc#833389) * MFSA 2013-63/CVE-2013-1701 Miscellaneous memory safety hazards * MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI misrepresentation and masquerading * MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks * MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some Javascript components * MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest * MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397) Local Java applets may read contents of local file system - export MOZ_ESR=1 in the build to get correct branding ------------------------------------------------------------------- Thu Jul 18 10:07:53 UTC 2013 - wr@rosenauer.org - update Enigmail to 1.5.2 * bugfix release ------------------------------------------------------------------- Mon Jun 24 10:17:22 UTC 2013 - wr@rosenauer.org - update to Thunderbird 17.0.7esr (bnc#825935) * MFSA 2013-49/CVE-2013-1682 Miscellaneous memory safety hazards * MFSA 2013-50/CVE-2013-1684/CVE-2013-1685/CVE-2013-1686 Memory corruption found using Address Sanitizer * MFSA 2013-51/CVE-2013-1687 (bmo#863933, bmo#866823) Privileged content access and execution via XBL * MFSA 2013-53/CVE-2013-1690 (bmo#857883) Execution of unmapped memory through onreadystatechange event * MFSA 2013-54/CVE-2013-1692 (bmo#866915) Data in the body of XHR HEAD requests leads to CSRF attacks * MFSA 2013-55/CVE-2013-1693 (bmo#711043) SVG filters can lead to information disclosure * MFSA 2013-56/CVE-2013-1694 (bmo#848535) PreserveWrapper has inconsistent behavior * MFSA 2013-59/CVE-2013-1697 (bmo#858101) XrayWrappers can be bypassed to run user defined methods in a privileged context ------------------------------------------------------------------- Tue Jun 4 20:41:42 UTC 2013 - dvaleev@suse.com - prevent xpc-shell crashing on powerpc ppc-xpcshell.patch ------------------------------------------------------------------- Sun May 12 20:48:12 UTC 2013 - wr@rosenauer.org - update to Thunderbird 17.0.6esr (bnc#819204) * MFSA 2013-41/CVE-2013-0801/CVE-2013-1669 Miscellaneous memory safety hazards * MFSA 2013-42/CVE-2013-1670 (bmo#853709) Privileged access for content level constructor * MFSA 2013-46/CVE-2013-1674 (bmo#860971) Use-after-free with video and onresize event * MFSA 2013-47/CVE-2013-1675 (bmo#866825) Uninitialized functions in DOMSVGZoomEvent * MFSA 2013-48/CVE-2013-1676/CVE-2013-1677/CVE-2013-1678/ CVE-2013-1679/CVE-2013-1680/CVE-2013-1681 Memory corruption found using Address Sanitizer ------------------------------------------------------------------- Fri Mar 29 18:25:38 UTC 2013 - wr@rosenauer.org - update to Thunderbird 17.0.5 (bnc#813026) * requires NSPR 4.9.5 and NSS 3.14.3 * MFSA 2013-30/CVE-2013-0788/CVE-2013-0789 Miscellaneous memory safety hazards * MFSA 2013-31/CVE-2013-0800 (bmo#825721) Out-of-bounds write in Cairo library * MFSA 2013-35/CVE-2013-0796 (bmo#827106) WebGL crash with Mesa graphics driver on Linux * MFSA 2013-36/CVE-2013-0795 (bmo#825697) Bypass of SOW protections allows cloning of protected nodes * MFSA 2013-38/CVE-2013-0793 (bmo#803870) Cross-site scripting (XSS) using timed history navigations ------------------------------------------------------------------- Fri Mar 8 10:35:29 UTC 2013 - wr@rosenauer.org - update to Thunderbird 17.0.4esr (bnc#808243) * MFSA 2013-29/CVE-2013-0787 (bmo#848644) Use-after-free in HTML Editor ------------------------------------------------------------------- Sun Feb 17 12:09:06 UTC 2013 - wr@rosenauer.org - update to Thunderbird 17.0.3esr (bnc#804248) * MFSA 2013-21/CVE-2013-0783 Miscellaneous memory safety hazards * MFSA 2013-24/CVE-2013-0773 (bmo#809652) Web content bypass of COW and SOW security wrappers * MFSA 2013-25/CVE-2013-0774 (bmo#827193) Privacy leak in JavaScript Workers * MFSA 2013-26/CVE-2013-0775 (bmo#831095) Use-after-free in nsImageLoadingContent * MFSA 2013-27/CVE-2013-0776 (bmo#796475) Phishing on HTTPS connection through malicious proxy * MFSA 2013-28/CVE-2013-0780/CVE-2013-0782 Use-after-free, out of bounds read, and buffer overflow issues found using Address Sanitizer ------------------------------------------------------------------- Mon Feb 11 08:29:21 UTC 2013 - wr@rosenauer.org - update Enigmail to 1.5.1 * The release fixes the regressions found in the past few weeks ------------------------------------------------------------------- Sun Jan 13 13:09:43 UTC 2013 - wr@rosenauer.org - fix Enigmail build on SLE11 ------------------------------------------------------------------- Sat Jan 5 13:24:52 UTC 2013 - wr@rosenauer.org - update to Thunderbird 17.0.2esr (bnc#796895) * MFSA 2013-01/CVE-2013-0749/CVE-2013-0769/CVE-2013-0770 Miscellaneous memory safety hazards * MFSA 2013-02/CVE-2013-0760/CVE-2013-0762/CVE-2013-0766/CVE-2013-0767 CVE-2013-0761/CVE-2013-0763/CVE-2013-0771/CVE-2012-5829 Use-after-free and buffer overflow issues found using Address Sanitizer * MFSA 2013-03/CVE-2013-0768 (bmo#815795) Buffer Overflow in Canvas * MFSA 2013-04/CVE-2012-0759 (bmo#802026) URL spoofing in addressbar during page loads * MFSA 2013-05/CVE-2013-0744 (bmo#814713) Use-after-free when displaying table with many columns and column groups * MFSA 2013-07/CVE-2013-0764 (bmo#804237) Crash due to handling of SSL on threads * MFSA 2013-08/CVE-2013-0745 (bmo#794158) AutoWrapperChanger fails to keep objects alive during garbage collection * MFSA 2013-09/CVE-2013-0746 (bmo#816842) Compartment mismatch with quickstubs returned values * MFSA 2013-10/CVE-2013-0747 (bmo#733305) Event manipulation in plugin handler to bypass same-origin policy * MFSA 2013-11/CVE-2013-0748 (bmo#806031) Address space layout leaked in XBL objects * MFSA 2013-12/CVE-2013-0750 (bmo#805121) Buffer overflow in Javascript string concatenation * MFSA 2013-13/CVE-2013-0752 (bmo#805024) Memory corruption in XBL with XML bindings containing SVG * MFSA 2013-14/CVE-2013-0757 (bmo#813901) Chrome Object Wrapper (COW) bypass through changing prototype * MFSA 2013-15/CVE-2013-0758 (bmo#813906) Privilege escalation through plugin objects * MFSA 2013-16/CVE-2013-0753 (bmo#814001) Use-after-free in serializeToStream * MFSA 2013-17/CVE-2013-0754 (bmo#814026) Use-after-free in ListenerManager * MFSA 2013-18/CVE-2013-0755 (bmo#814027) Use-after-free in Vibrate * MFSA 2013-19/CVE-2013-0756 (bmo#814029) Use-after-free in Javascript Proxy objects - requires NSS 3.14.1 (MFSA 2013-20, CVE-2013-0743) - update Enigmail to 1.5.0 ------------------------------------------------------------------- Mon Nov 26 11:09:34 UTC 2012 - wr@rosenauer.org - fix KDE integration for file dialogs ------------------------------------------------------------------- Thu Nov 22 20:49:18 UTC 2012 - wr@rosenauer.org - rebrand to thunderbird-esr ------------------------------------------------------------------- Thu Nov 22 09:09:52 UTC 2012 - wr@rosenauer.org - build on SLE11 * mozilla-gcc43-enums.patch * mozilla-gcc43-template_hacks.patch * mozilla-gcc43-templates_instantiation.patch ------------------------------------------------------------------- Tue Nov 20 20:42:04 UTC 2012 - wr@rosenauer.org - update to Thunderbird 17.0 (bnc#790140) * MFSA 2012-91/CVE-2012-5842/CVE-2012-5843 Miscellaneous memory safety hazards * MFSA 2012-92/CVE-2012-4202 (bmo#758200) Buffer overflow while rendering GIF images * MFSA 2012-93/CVE-2012-4201 (bmo#747607) evalInSanbox location context incorrectly applied * MFSA 2012-94/CVE-2012-5836 (bmo#792857) Crash when combining SVG text on path with CSS * MFSA 2012-96/CVE-2012-4204 (bmo#778603) Memory corruption in str_unescape * MFSA 2012-97/CVE-2012-4205 (bmo#779821) XMLHttpRequest inherits incorrect principal within sandbox * MFSA 2012-99/CVE-2012-4208 (bmo#798264) XrayWrappers exposes chrome-only properties when not in chrome compartment * MFSA 2012-100/CVE-2012-5841 (bmo#805807) Improper security filtering for cross-origin wrappers * MFSA 2012-101/CVE-2012-4207 (bmo#801681) Improper character decoding in HZ-GB-2312 charset * MFSA 2012-102/CVE-2012-5837 (bmo#800363) Script entered into Developer Toolbar runs with chrome privileges * MFSA 2012-103/CVE-2012-4209 (bmo#792405) Frames can shadow top.location * MFSA 2012-105/CVE-2012-4214/CVE-2012-4215/CVE-2012-4216/ CVE-2012-5829/CVE-2012-5839/CVE-2012-5840/CVE-2012-4212/ CVE-2012-4213/CVE-2012-4217/CVE-2012-4218 Use-after-free and buffer overflow issues found using Address Sanitizer * MFSA 2012-106/CVE-2012-5830/CVE-2012-5833/CVE-2012-5835/CVE-2012-5838 Use-after-free, buffer overflow, and memory corruption issues found using Address Sanitizer - rebased patches - disabled WebRTC since build is broken (bmo#776877) - update Enigmail to 1.4.6 ------------------------------------------------------------------- Sat Oct 27 08:58:22 UTC 2012 - wr@rosenauer.org - update to Thunderbird 16.0.2 (bnc#786522) * MFSA 2012-90/CVE-2012-4194/CVE-2012-4195/CVE-2012-4196 (bmo#800666, bmo#793121, bmo#802557) Fixes for Location object issues ------------------------------------------------------------------- Thu Oct 11 03:16:52 UTC 2012 - wr@rosenauer.org - update to Thunderbird 16.0.1 (bnc#783533) * MFSA 2012-88/CVE-2012-4191 (bmo#798045) Miscellaneous memory safety hazards * MFSA 2012-89/CVE-2012-4192/CVE-2012-4193 (bmo#799952, bmo#720619) defaultValue security checks not applied ------------------------------------------------------------------- Mon Oct 8 13:27:10 UTC 2012 - wr@rosenauer.org - update to Thunderbird 16.0 (bnc#783533) * MFSA 2012-74/CVE-2012-3982/CVE-2012-3983 Miscellaneous memory safety hazards * MFSA 2012-75/CVE-2012-3984 (bmo#575294) select element persistance allows for attacks * MFSA 2012-76/CVE-2012-3985 (bmo#655649) Continued access to initial origin after setting document.domain * MFSA 2012-77/CVE-2012-3986 (bmo#775868) Some DOMWindowUtils methods bypass security checks * MFSA 2012-79/CVE-2012-3988 (bmo#725770) DOS and crash with full screen and history navigation * MFSA 2012-80/CVE-2012-3989 (bmo#783867) Crash with invalid cast when using instanceof operator * MFSA 2012-81/CVE-2012-3991 (bmo#783260) GetProperty function can bypass security checks * MFSA 2012-82/CVE-2012-3994 (bmo#765527) top object and location property accessible by plugins * MFSA 2012-83/CVE-2012-3993/CVE-2012-4184 (bmo#768101, bmo#780370) Chrome Object Wrapper (COW) does not disallow acces to privileged functions or properties * MFSA 2012-84/CVE-2012-3992 (bmo#775009) Spoofing and script injection through location.hash * MFSA 2012-85/CVE-2012-3995/CVE-2012-4179/CVE-2012-4180/ CVE-2012-4181/CVE-2012-4182/CVE-2012-4183 Use-after-free, buffer overflow, and out of bounds read issues found using Address Sanitizer * MFSA 2012-86/CVE-2012-4185/CVE-2012-4186/CVE-2012-4187/ CVE-2012-4188 Heap memory corruption issues found using Address Sanitizer * MFSA 2012-87/CVE-2012-3990 (bmo#787704) Use-after-free in the IME State Manager - update Enigmail to version 1.4.5 ------------------------------------------------------------------- Sun Aug 26 14:59:20 UTC 2012 - wr@rosenauer.org - update to Thunderbird 15.0 (bnc#777588) * MFSA 2012-57/CVE-2012-1970 Miscellaneous memory safety hazards * MFSA 2012-58/CVE-2012-1972/CVE-2012-1973/CVE-2012-1974/CVE-2012-1975 CVE-2012-1976/CVE-2012-3956/CVE-2012-3957/CVE-2012-3958/CVE-2012-3959 CVE-2012-3960/CVE-2012-3961/CVE-2012-3962/CVE-2012-3963/CVE-2012-3964 Use-after-free issues found using Address Sanitizer * MFSA 2012-59/CVE-2012-1956 (bmo#756719) Location object can be shadowed using Object.defineProperty * MFSA 2012-61/CVE-2012-3966 (bmo#775794, bmo#775793) Memory corruption with bitmap format images with negative height * MFSA 2012-62/CVE-2012-3967/CVE-2012-3968 WebGL use-after-free and memory corruption * MFSA 2012-63/CVE-2012-3969/CVE-2012-3970 SVG buffer overflow and use-after-free issues * MFSA 2012-64/CVE-2012-3971 Graphite 2 memory corruption * MFSA 2012-65/CVE-2012-3972 (bmo#746855) Out-of-bounds read in format-number in XSLT * MFSA 2012-68/CVE-2012-3975 (bmo#770684) DOMParser loads linked resources in extensions when parsing text/html * MFSA 2012-70/CVE-2012-3978 (bmo#770429) Location object security checks bypassed by chrome code * MFSA 2012-72/CVE-2012-3980 (bmo#771859) Web console eval capable of executing chrome-privileged code - update Enigmail to 1.4.4 ------------------------------------------------------------------- Sun Jul 29 07:22:19 UTC 2012 - aj@suse.de - Fix mozilla-kde.patch to include sys/resource.h for getrlimit etc (glibc 2.16) ------------------------------------------------------------------- Sun Jul 15 08:06:50 UTC 2012 - wr@rosenauer.org - update to Thunderbird 14.0 (bnc#771583) * MFSA 2012-42/CVE-2012-1949/CVE-2012-1948 Miscellaneous memory safety hazards * MFSA 2012-44/CVE-2012-1951/CVE-2012-1954/CVE-2012-1953/CVE-2012-1952 Gecko memory corruption * MFSA 2012-45/CVE-2012-1955 (bmo#757376) Spoofing issue with location * MFSA 2012-47/CVE-2012-1957 (bmo#750096) Improper filtering of javascript in HTML feed-view * MFSA 2012-48/CVE-2012-1958 (bmo#750820) use-after-free in nsGlobalWindow::PageHidden * MFSA 2012-49/CVE-2012-1959 (bmo#754044, bmo#737559) Same-compartment Security Wrappers can be bypassed * MFSA 2012-50/CVE-2012-1960 (bmo#761014) Out of bounds read in QCMS * MFSA 2012-51/CVE-2012-1961 (bmo#761655) X-Frame-Options header ignored when duplicated * MFSA 2012-52/CVE-2012-1962 (bmo#764296) JSDependentString::undepend string conversion results in memory corruption * MFSA 2012-53/CVE-2012-1963 (bmo#767778) Content Security Policy 1.0 implementation errors cause data leakage * MFSA 2012-56/CVE-2012-1967 (bmo#758344) Code execution through javascript: URLs * relicensed to MPL-2.0 - update Enigmail to 1.4.3 ------------------------------------------------------------------- Thu Jul 5 09:58:15 UTC 2012 - adrian@suse.de - no crashreport on %arm, fixing build ------------------------------------------------------------------- Fri Jun 15 07:00:43 UTC 2012 - wr@rosenauer.org - update to Thunderbird 13.0.1 * bugfix release ------------------------------------------------------------------- Sat Jun 2 12:41:08 UTC 2012 - wr@rosenauer.org - update to Thunderbird 13.0 (bnc#765204) * MFSA 2012-34/CVE-2012-1938/CVE-2012-1937/CVE-2011-3101 Miscellaneous memory safety hazards * MFSA 2012-36/CVE-2012-1944 (bmo#751422) Content Security Policy inline-script bypass * MFSA 2012-37/CVE-2012-1945 (bmo#670514) Information disclosure though Windows file shares and shortcut files * MFSA 2012-38/CVE-2012-1946 (bmo#750109) Use-after-free while replacing/inserting a node in a document * MFSA 2012-40/CVE-2012-1947/CVE-2012-1940/CVE-2012-1941 Buffer overflow and use-after-free issues found using Address Sanitizer - require NSS 3.13.4 * MFSA 2012-39/CVE-2012-0441 (bmo#715073) - fix build with system NSPR (mozilla-system-nspr.patch) - add dependentlibs.list for improved XRE startup - update enigmail to 1.4.2 ------------------------------------------------------------------- Wed May 16 05:38:46 UTC 2012 - wr@rosenauer.org - reenabled crashreporter for Factory/12.2 (fix in mozilla-gcc47.patch) ------------------------------------------------------------------- Mon Apr 30 06:43:26 UTC 2012 - wr@rosenauer.org - update to Thunderbird 12.0.1 * fix regressions - POP3 filters (bmo#748090) - Message Body not loaded when using "Fetch Headers Only" (bmo#748865) - Received messages contain parts of other messages with movemail account (bmo#748726) - New mail notification issue (bmo#748997) - crash in nsMsgDatabase::MatchDbName (bmo#748432) ------------------------------------------------------------------- Fri Apr 27 10:22:49 UTC 2012 - wr@rosenauer.org - fixed build with gcc 4.7 ------------------------------------------------------------------- Sat Apr 21 07:39:28 UTC 2012 - wr@rosenauer.org - update to Thunderbird 12.0 (bnc#758408) * MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous memory safety hazards * MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free in IDBKeyRange * MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees causes heap corruption in gfxImageSurface * MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS via multibyte content processing errors * MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory corruption during font rendering using cairo-dwrite * MFSA 2012-26/CVE-2012-0473 (bmo#743475) WebGL.drawElements may read illegal video memory due to FindMaxUshortElement error * MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page load short-circuit can lead to XSS * MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6 in Origin headers may bypass webserver access restrictions * MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues * MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL content using textImage2D * MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error in OpenType Sanitizer * MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP Redirections and remote content can be read by javascript errors * MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site identity spoofing when loading RSS and Atom feeds - update Enigmail to 1.4.1 - added mozilla-revert_621446.patch - added mozilla-libnotify.patch (bmo#737646) - added mailnew-showalert.patch (bmo#739146) - added mozilla-gcc47.patch and mailnews-literals.patch to fix compilation issues with recent gcc 4.7 - disabled crashreporter temporarily for Factory (gcc 4.7 issue) ------------------------------------------------------------------- Tue Mar 27 22:17:05 UTC 2012 - wr@rosenauer.org - update to Thunderbird 11.0.1 (bnc#755060) * Fixing an issue where filters can get messed up (bmo#735940) * Fixes a hang when switching IMAP folders, or doing other imap functions (bmo#733731) ------------------------------------------------------------------- Fri Mar 9 20:42:21 UTC 2012 - wr@rosenauer.org - update to Thunderbird 11.0 (bnc#750044) * MFSA 2012-13/CVE-2012-0455 (bmo#704354) XSS with Drag and Drop and Javascript: URL * MFSA 2012-14/CVE-2012-0456/CVE-2012-0457 (bmo#711653, #720103) SVG issues found with Address Sanitizer * MFSA 2012-15/CVE-2012-0451 (bmo#717511) XSS with multiple Content Security Policy headers * MFSA 2012-16/CVE-2012-0458 Escalation of privilege with Javascript: URL as home page * MFSA 2012-17/CVE-2012-0459 (bmo#723446) Crash when accessing keyframe cssText after dynamic modification * MFSA 2012-18/CVE-2012-0460 (bmo#727303) window.fullScreen writeable by untrusted content * MFSA 2012-19/CVE-2012-0461/CVE-2012-0462/CVE-2012-0464/ CVE-2012-0463 Miscellaneous memory safety hazards - update enigmail to 1.4 - added KDE integration patches (bnc#749440) ------------------------------------------------------------------- Mon Feb 27 17:15:05 CET 2012 - jslaby@suse.de - update enigmail to 1.3.99 (1.4a1pre) ------------------------------------------------------------------- Thu Feb 16 10:54:42 UTC 2012 - wr@rosenauer.org - update to Thunderbird 10.0.2 (bnc#747328) * CVE-2011-3026 (bmo#727401) libpng: integer overflow leading to heap-buffer overflow ------------------------------------------------------------------- Thu Feb 9 08:10:32 UTC 2012 - wr@rosenauer.org - update to version 10.0.1 (bnc#746616) * MFSA 2012-10/CVE-2012-0452 (bmo#724284) use after free in nsXBLDocumentInfo::ReadPrototypeBindings - Use YARR interpreter instead of PCRE on platforms where YARR JIT is not supported, since PCRE doesnt build (bmo#691898) - fix ppc64 build (bmo#703534) ------------------------------------------------------------------- Sun Jan 29 17:31:32 UTC 2012 - wr@rosenauer.org - update to version 10.0 (bnc#744275) * MFSA 2012-01/CVE-2012-0442/CVE-2012-0443 Miscellaneous memory safety hazards * MFSA 2012-03/CVE-2012-0445 (bmo#701071) <iframe> element exposed across domains via name attribute * MFSA 2012-04/CVE-2011-3659 (bmo#708198) Child nodes from nsDOMAttribute still accessible after removal of nodes * MFSA 2012-05/CVE-2012-0446 (bmo#705651) Frame scripts calling into untrusted objects bypass security checks * MFSA 2012-06/CVE-2012-0447 (bmo#710079) Uninitialized memory appended when encoding icon images may cause information disclosure * MFSA 2012-07/CVE-2012-0444 (bmo#719612) Potential Memory Corruption When Decoding Ogg Vorbis files * MFSA 2012-08/CVE-2012-0449 (bmo#701806, bmo#702466) Crash with malformed embedded XSLT stylesheets - update enigmail to 1.3.5 - added mozilla-disable-neon-option.patch to be able to disable neon on ARM - removed obsolete PPC64 patch ------------------------------------------------------------------- Sun Dec 18 09:28:51 UTC 2011 - wr@rosenauer.org - update to version 9.0 (bnc#737533) * MFSA 2011-53/CVE-2011-3660 Miscellaneous memory safety hazards (rv:9.0) * MFSA 2011-54/CVE-2011-3661 (bmo#691299) Potentially exploitable crash in the YARR regular expression library * MFSA 2011-55/CVE-2011-3658 (bmo#708186) nsSVGValue out-of-bounds access * MFSA 2011-56/CVE-2011-3663 (bmo#704482) Key detection without JavaScript via SVG animation * MFSA 2011-58/VE-2011-3665 (bmo#701259) Crash scaling <video> to extreme sizes - fixed accessibility under GNOME 3 (bnc#732898) (mozilla-a11y.patch) - do not show update channel in about box (tb-no-update-channel.patch) ------------------------------------------------------------------- Sun Dec 4 08:20:17 UTC 2011 - wr@rosenauer.org - update enigmail to 1.3.4 (bnc#733002) * fixes several regressions from previous release ------------------------------------------------------------------- Mon Nov 21 21:54:27 UTC 2011 - wr@rosenauer.org - do not disable system addons - fixed enigmail localizations ------------------------------------------------------------------- Mon Nov 21 11:35:56 UTC 2011 - dvaleev@suse.com - fix powerpc build - disable crashreporter on ppc and ppc64 ------------------------------------------------------------------- Mon Nov 7 20:23:30 UTC 2011 - wr@rosenauer.org - update to version 8.0 (bnc#728520) * MFSA 2011-47/CVE-2011-3648 (bmo#690225) Potential XSS against sites using Shift-JIS * MFSA 2011-48/CVE-2011-3651/CVE-2011-3652/CVE-2011-3654 Miscellaneous memory safety hazards * MFSA 2011-49/CVE-2011-3650 (bmo#674776) Memory corruption while profiling using Firebug * MFSA 2011-52/CVE-2011-3655 (bmo#672182) Code execution via NoWaiverWrapper - rebased patches - update enigmail to 1.3.3 - update icon cache after install/removal (bnc#726758) ------------------------------------------------------------------- Fri Sep 30 09:59:15 UTC 2011 - wr@rosenauer.org - update to minor version 7.0.1 * fixed staged addon updates * Disabled the what's new tab for updaters from 7.0 (bmo#690290) * Insert Characters & Symbols fix (bmo#690267) ------------------------------------------------------------------- Mon Sep 26 09:18:56 UTC 2011 - wr@rosenauer.org - update to version 7.0 (bnc#720264) * MFSA 2011-36 Miscellaneous memory safety hazards * MFSA 2011-39/CVE-2011-3000 (bmo#655389) Defense against multiple Location headers due to CRLF Injection * MFSA 2011-40/CVE-2011-2372/CVE-2011-3001 Code installation through holding down Enter * MFSA 2011-42/CVE-2011-3232 Potentially exploitable crash in the YARR regular expression library * MFSA 2011-44/CVE-2011-3005 (bmo#675747) Use after free reading OGG headers - removed obsolete mozilla-cairo-lcd.patch ------------------------------------------------------------------- Tue Sep 13 07:36:50 UTC 2011 - wr@rosenauer.org - update enigmail to 1.3.2 (no changelog available) - add dbus-1-glib-devel to BuildRequires (not pulled automatically anymore with 12.1) ------------------------------------------------------------------- Fri Sep 9 20:42:23 UTC 2011 - wr@rosenauer.org - make enigmail a subversion of Thunderbird to fix %release number tracking issues with the Open Build Service (taken from dmueller's 3.1.x changes) ------------------------------------------------------------------- Wed Sep 7 14:30:34 UTC 2011 - pcerny@suse.com - security update to 6.0.2 (bnc#714931) * Complete blocking of certificates issued by DigiNotar (bmo#683449) ------------------------------------------------------------------- Fri Sep 2 14:40:07 UTC 2011 - pcerny@suse.com - security update to 6.0.1 (bnc#714931) * MFSA 2011-34 Protection against fraudulent DigiNotar certificates (bmo#682927) ------------------------------------------------------------------- Wed Aug 17 08:50:39 CEST 2011 - jslaby@suse.de - update enigmail to 1.3 final ------------------------------------------------------------------- Fri Aug 12 20:40:07 UTC 2011 - wr@rosenauer.org - update to version 6.0 (bnc#712224) including security fixes MFSA 2011-31 * CVE-2011-2989/CVE-2011-2991/CVE-2011-2992/CVE-2011-2985 Miscellaneous memory safety hazards * CVE-2011-2988 (bmo#665936) String crash using WebGL shaders * CVE-2011-2987 (bmo#665934) Heap overflow in ANGLE library * CVE-2011-0084 (bmo#648094) Crash in SVGTextElement.getCharNumAtPosition() * CVE-2011-2986 (bmo#655836) Cross-origin data theft using canvas and Windows D2D - add mozilla-curl.patch to remove dependencies to obsolete curl header ------------------------------------------------------------------- Fri Jul 30 08:30:11 CEST 2011 - jslaby@suse.de - update enigmail to 1.2.99 (1.3a1pre) ------------------------------------------------------------------- Fri Jul 29 21:13:54 UTC 2011 - wr@rosenauer.org - update to version 6.0b2 * removed obsolete patches - mozilla-gio.patch - thunderbird-gio.patch - fix symbol dumper for linux3 platform ------------------------------------------------------------------- Sat Jul 9 11:16:51 UTC 2011 - wr@rosenauer.org - update to version 5.0 - update enigmail to version 1.2 - improved logic for the launcher command - enable gio usage (instead of gnomevfs) for 11.4 and newer - build dump_syms dynamic to build on 12.1 and above ------------------------------------------------------------------- Mon Jun 20 09:36:22 UTC 2011 - wr@rosenauer.org - security update to version 3.1.11 (bnc#701296) * MFSA 2011-19/CVE-2011-2374 CVE-2011-2376 CVE-2011-2364 CVE-2011-2365 Miscellaneous memory safety hazards * MFSA 2011-20/CVE-2011-2373 (bmo#617247) Use-after-free vulnerability when viewing XUL document with script disabled * MFSA 2011-21/CVE-2011-2377 (bmo#638018, bmo#639303) Memory corruption due to multipart/x-mixed-replace images * MFSA 2011-22/CVE-2011-2371 (bmo#664009) Integer overflow and arbitrary code execution in Array.reduceRight() * MFSA 2011-23/CVE-2011-0083 CVE-2011-0085 CVE-2011-2363 Multiple dangling pointer vulnerabilities * MFSA 2011-24/CVE-2011-2362 (bmo#616264) Cookie isolation error - speed up find-external-requires.sh - do not build dump_syms static as it is not needed for us -> fixes build for 12.1 and above ------------------------------------------------------------------- Fri Apr 15 06:24:16 UTC 2011 - wr@rosenauer.org - security update to version 3.1.10 (bnc#689281) * MFSA 2011-12/ CVE-2011-0069 CVE-2011-0070 CVE-2011-0072 CVE-2011-0074 CVE-2011-0075 CVE-2011-0077 CVE-2011-0078 CVE-2011-0080 CVE-2011-0081 Miscellaneous memory safety hazards ------------------------------------------------------------------- Fri Mar 25 08:50:30 UTC 2011 - idoenmez@novell.com - Add mozilla-gcc46.patch: fix compilation with gcc 4.6 See the following bug reports: https://bugzilla.mozilla.org/show_bug.cgi?id=623116 https://bugzilla.mozilla.org/show_bug.cgi?id=623123 https://bugzilla.mozilla.org/show_bug.cgi?id=623126 https://bugzilla.mozilla.org/show_bug.cgi?id=628371 ------------------------------------------------------------------- Tue Feb 22 08:51:12 UTC 2011 - wr@rosenauer.org - security update to version 3.1.8 (build3) (bnc#667155) * MFSA 2011-01/CVE-2011-0053/CVE-2011-0062 Miscellaneous memory safety hazards (rv:1.9.2.14/ 1.9.1.17) * MFSA 2011-08/CVE-2010-1585 (bmo#562547) ParanoidFragmentSink allows javascript: URLs in chrome documents * MFSA 2011-09/CVE-2011-0061 (bmo#610601) Crash caused by corrupted JPEG image ------------------------------------------------------------------- Thu Jan 13 13:08:39 UTC 2011 - wr@rosenauer.org - rename desktop file for 11.4 and above (bnc#664211) ------------------------------------------------------------------- Mon Jan 10 09:30:21 UTC 2011 - wr@rosenauer.org - add x-scheme-handler/mailto as mimetype to the desktop file as needed by newer Gnome environment ------------------------------------------------------------------- Mon Nov 29 13:47:52 UTC 2010 - wr@rosenauer.org - security update to version 3.1.7 (bnc#657016) * MFSA 2010-74/CVE-2010-3776/CVE-2010-3777/CVE-2010-3778 Miscellaneous memory safety hazards (rv:1.9.2.13/ 1.9.1.16) * MFSA 2010-75/CVE-2010-3769 (bmo#608336) Buffer overflow while line breaking after document.write with long string * MFSA 2010-78/CVE-2010-3768 (bmo#527276) Add support for OTS font sanitizer - provide versioned "thunderbird" symbol ------------------------------------------------------------------- Wed Oct 27 10:55:39 CEST 2010 - wr@rosenauer.org - security update to version 3.1.6 (bnc#649492) * MFSA 2010-73/CVE-2010-3765 (bmo#607222) Heap buffer overflow mixing document.write and DOM insertion ------------------------------------------------------------------- Wed Oct 6 23:19:15 CEST 2010 - wr@rosenauer.org - security update to version 3.1.5 (bnc#645315) * MFSA 2010-64/CVE-2010-3174/CVE-2010-3175/CVE-2010-3176 Miscellaneous memory safety hazards * MFSA 2010-65/CVE-2010-3179 (bmo#583077) Buffer overflow and memory corruption using document.write * MFSA 2010-66/CVE-2010-3180 (bmo#588929) Use-after-free error in nsBarProp * MFSA 2010-67/CVE-2010-3183 (bmo#598669) Dangling pointer vulnerability in LookupGetterOrSetter * MFSA 2010-69/CVE-2010-3178 (bmo#576616) Cross-site information disclosure via modal calls * MFSA 2010-70/CVE-2010-3170 (bmo#578697) SSL wildcard certificate matching IP addresses * MFSA 2010-71/CVE-2010-3182 (bmo#590753, bnc#642502) Unsafe library loading vulnerabilities * MFSA 2010-72/CVE-2010-3173 Insecure Diffie-Hellman key exchange * new extra locales * removed upstreamed mozilla-helper-app.patch - require mozilla-nss >= 3.12.8 ------------------------------------------------------------------- Wed Sep 15 08:19:49 CEST 2010 - wr@rosenauer.org - update to version 3.1.4 * fixing startup topcrash ------------------------------------------------------------------- Mon Aug 30 17:40:28 CEST 2010 - wr@rosenauer.org - security update to version 3.1.3 (bnc#637303) * MFSA 2010-49/CVE-2010-3169 Miscellaneous memory safety hazards * MFSA 2010-50/CVE-2010-2765 (bmo#576447) Frameset integer overflow vulnerability * MFSA 2010-51/CVE-2010-2767 (bmo#584512) Dangling pointer vulnerability using DOM plugin array * MFSA 2010-53/CVE-2010-3166 (bmo#579655) Heap buffer overflow in nsTextFrameUtils::TransformText * MFSA 2010-54/CVE-2010-2760 (bmo#585815) Dangling pointer vulnerability in nsTreeSelection * MFSA 2010-55/CVE-2010-3168 (bmo#576075) XUL tree removal crash and remote code execution * MFSA 2010-56/CVE-2010-3167 (bmo#576070) Dangling pointer vulnerability in nsTreeContentView * MFSA 2010-57/CVE-2010-2766 (bmo#580445) Crash and remote code execution in normalizeDocument * MFSA 2010-59/CVE-2010-2762 (bmo#584180) SJOW creates scope chains ending in outer object * MFSA 2010-61/CVE-2010-2768 (bmo#579744) UTF-7 XSS by overriding document charset using <object> type attribute * MFSA 2010-62/CVE-2010-2769 (bmo#520189) Copy-and-paste or drag-and-drop into designMode document allows XSS * MFSA 2010-63/CVE-2010-2764 (bmo#552090) Information leak via XMLHttpRequest statusText - ESD notification sound fix included upstream ------------------------------------------------------------------- Mon Aug 30 17:37:58 CEST 2010 - wr@rosenauer.org - fixed build with latest Gnome (mozilla-gdk-pixbuf.patch) ------------------------------------------------------------------- Sat Jul 24 17:22:58 CEST 2010 - wr@rosenauer.org - update to version 3.1.1 * based on the Gecko 1.9.2 platform * Faster Search Results * Quick Filter Toolbar * New Migration Assistant * Saved Files Manager - update to enigmail 1.1.2 - enable crashreporter and package buildsymbols - fixed esd sound output (notifications) (bmo#576365) ------------------------------------------------------------------- Fri Jul 16 07:19:40 CEST 2010 - wr@rosenauer.org - security update to 3.0.6 (bnc#622506) * MFSA 2010-34/CVE-2010-1211/CVE-2010-1212 Miscellaneous memory safety hazards * MFSA 2010-39/CVE-2010-2752 (bmo#574059) nsCSSValue::Array index integer overflow * MFSA 2010-40/CVE-2010-2753 (bmo#571106) nsTreeSelection dangling pointer remote code execution vulnerability * MFSA 2010-41/CVE-2010-1205 (bmo#570451) Remote code execution using malformed PNG image * MFSA 2010-42/CVE-2010-1213 (bmo#568148) Cross-origin data disclosure via Web Workers and importScripts * MFSA 2010-46/CVE-2010-0654 (bmo#524223) Cross-domain data theft using CSS * MFSA 2010-47/CVE-2010-2754 (bmo#568564) Cross-origin data leakage from script filename in error messages ------------------------------------------------------------------- Fri May 21 07:31:34 CEST 2010 - wr@rosenauer.org - security update to 3.0.5 (bnc#603356) * MFSA 2010-25/CVE-2010-1121 (bmo#555109) Re-use of freed object due to scope confusion * MFSA 2010-26/CVE-2010-1200/CVE-2010-1201/CVE-2010-1202/ CVE-2010-1203 Crashes with evidence of memory corruption (rv:1.9.1.10) * MFSA 2010-29/CVE-2010-1196 (bmo#534666) Heap buffer overflow in nsGenericDOMDataNode::SetTextInternal * MFSA 2010-30/CVE-2010-1199 (bmo#554255) Integer Overflow in XSLT Node Sorting ------------------------------------------------------------------- Mon Apr 12 06:50:16 CEST 2010 - wr@rosenauer.org - do not encode the RPM release number into the useragent to avoid non useful republishing (bnc#593807) ------------------------------------------------------------------- Wed Mar 17 20:07:51 CET 2010 - wr@rosenauer.org - security update to 3.0.4 (bnc#586567) * MFSA 2010-16/CVE-2010-0173/CVE-2010-0174 Crashes with evidence of memory corruption * MFSA 2010-17/CVE-2010-0175 (bmo#540100,375928) Remote code execution with use-after-free in nsTreeSelection * MFSA 2010-18/CVE-2010-0176 (bmo#538308) Dangling pointer vulnerability in nsTreeContentView * MFSA 2010-22/CVE-2009-3555 (bmo#545755) Update NSS to support TLS renegotiation indication * MFSA 2010-24/CVE-2010-0182 (bmo#490790) XMLDocument::load() doesn't check nsIContentPolicy ------------------------------------------------------------------- Sun Feb 28 19:56:44 CET 2010 - wr@rosenauer.org - update to 3.0.3 * Fix for missing folders or empty folder pane after updating to Thunderbird 3.0.2 ------------------------------------------------------------------- Fri Feb 26 17:04:00 CET 2010 - wr@rosenauer.org - security update to 3.0.2 (bnc#576969) * MFSA 2010-01/CVE-2010-0159 Crashes with evidence of memory corruption * MFSA 2010-03/CVE-2009-1571 Use-after-free crash in HTML parser * various stability improvements - update enigmail to 1.0.1 * Czech, Dutch, Polish and Portuguese (Brazilian) languages were added to the release. * there are several fixes related using OpenPGP Smartcards - use system hunspell again (bnc#582276) ------------------------------------------------------------------- Tue Jan 12 00:23:23 CET 2010 - wr@rosenauer.org - update to 3.0.1 * fixed UI issues related to some combinations of installed addons (bmo#398702) - fixed session restore (bnc#528406, bmo#508986) - removed obsolete lightning stuff from spec file - removed obsolete orbit-devel build requirement ------------------------------------------------------------------- Mon Dec 7 10:04:05 CET 2009 - wr@rosenauer.org - update to 3.0 (bnc#559819) - update enigmail to final version 1.0.0 - use --disable-updater and removed obsolete UI patch and pref changes - use internal cairo up to 11.1 (Gecko now requires at least 1.8.8) - added mozilla-clipboard.patch fixing a common crash (bmo#495392) - removed upstreamed patch thunderbird-cs-smtpauth.patch ------------------------------------------------------------------- Wed Oct 7 21:41:15 CEST 2009 - wr@rosenauer.org - fixed startup-notification (bnc#518603) (mozilla-startup-notification.patch) ------------------------------------------------------------------- Tue Sep 29 14:03:51 CEST 2009 - wr@rosenauer.org - fixed CS locale to allow SMTP AUTH sending of mails (bnc#542809) ------------------------------------------------------------------- Tue Sep 15 17:58:56 CEST 2009 - wr@rosenauer.org - update to 3.0b4 * removed upstreamed patches * based on Gecko 1.9.1.3 (inheriting security fixes) * new global search ------------------------------------------------------------------- Tue Aug 25 17:56:36 CEST 2009 - wr@rosenauer.org - reversioned enigmail to 0.96.99 (as it's actually 0.97a and 0.96 has been released already) - fixed RPM group for the translation subpackages ------------------------------------------------------------------- Fri Aug 21 13:58:54 CEST 2009 - wr@rosenauer.org - remove obsolete code for protocol handlers (bmo#389732) (mozilla-protocol_handler.patch) - new enigmail snapshot (20090813) - require pinentry-gui for 11.2 and up (bnc#441084) ------------------------------------------------------------------- Sun Aug 9 09:02:25 CEST 2009 - wr@rosenauer.org - Gtk filechooser allows alternative button order (as used in KDE) (bnc#527418) - translations{,-common} package doesn't provide en-US - split translations into -common and -other packages (bnc#529180) ------------------------------------------------------------------- Tue Jul 28 12:59:23 CEST 2009 - wr@rosenauer.org - fixed wrong %exclude by removing unwanted files at %install stage ------------------------------------------------------------------- Fri Jul 17 13:48:02 CEST 2009 - wr@rosenauer.org - major update to 3.0b3 - update enigmail to 0.96pre - created enigmail subpackage and install to system wide location for Thunderbird and SeaMonkey - define MOZ_APP_LAUNCHER for session management (bmo#453689) (mozilla-app-launcher.patch and mozilla.sh.in) - move opensuse.js prefs to all-opensuse.js prefs to be able to override prefs in all-thunderbird.js - move intl.locale.matchOS to all-opensuse.js - added mozilla-jemalloc_deepbind.patch to fix various possible crashes (bnc#503151, bmo#493541) ------------------------------------------------------------------- Fri Jun 19 10:35:46 CEST 2009 - coolo@novell.com - disable as-needed for this package as it fails to build with it ------------------------------------------------------------------- Tue Jun 2 11:40:59 CEST 2009 - wr@rosenauer.org - Fixed build issue for gcc 4.4 (mozilla-gcc44.patch) ------------------------------------------------------------------- Wed Mar 18 14:52:14 CET 2009 - wr@rosenauer.org - security update to version 2.0.0.21 (bnc#484321) * MFSA 2009-07/CVE-2009-0771, CVE-2009-0772, CVE-2009-0773 CVE-2009-0774: Crashes with evidence of memory corruption (rv:1.9.0.7) * MFSA 2009-09/CVE-2009-0776: XML data theft via RDFXMLDataSource and cross-domain redirect * MFSA 2009-10/CVE-2009-0040: Upgrade PNG library to fix memory safety hazards ------------------------------------------------------------------- Fri Jan 2 13:51:19 EST 2009 - hfiguiere@suse.de - Review and approve changes. ------------------------------------------------------------------- Wed Dec 31 13:33:22 CET 2008 - wr@rosenauer.org - security update to version 2.0.0.19 (bnc#455804) + MFSA 2008-68/CVE-2008-5511 and CVE-2008-5512: XSS and JavaScript privilege escalation + MFSA 2008-67/CVE-2008-5510: Escaped null characters ignored by CSS parser + MFSA 2008-66/CVE-2008-5508: Errors parsing URLs with leading whitespace and control characters + MFSA 2008-65/CVE-2008-5507: Cross-domain data theft via script redirect error message + MFSA 2008-64/CVE-2008-5506: XMLHttpRequest 302 response disclosure + MFSA 2008-61/CVE-2008-5503: Information stealing via loadBindingDocument + MFSA 2008-60/CVE-2008-5500, CVE-2008-5501 and CVE-2008-5502: Crashes with evidence of memory corruption (rv:1.9.0.5/1.8.1.19) - improved mozilla-shared-nss-db.patch and mozilla-system-hunspell.patch to be able to apply them unconditionally ------------------------------------------------------------------- Fri Nov 21 11:26:06 CET 2008 - wr@rosenauer.org - Add mozilla-shared-nss-db.patch which allows migrating to and sharing with other applications using NSS (same functionality as in xulrunner/firefox) (can be disabled completely exporting MOZ_TB_NO_NSSHELPER=1) ------------------------------------------------------------------- Thu Nov 20 18:53:35 CST 2008 - maw@suse.de - Review and approve changes. ------------------------------------------------------------------- Thu Nov 13 11:02:01 CET 2008 - wr@rosenauer.org - security update to version 2.0.0.18 (bnc#439841) * MFSA 2008-48 / CVE-2008-5012 Image stealing via canvas and HTTP redirect * MFSA 2008-50 / CVE-2008-5014 (bmo#436741) Crash and remote code execution via __proto__ tampering * MFSA 2008-52 / CVE-2008-5016 / CVE-2008-5017 / CVE-2008-5018 Crashes with evidence of memory corruption (rv:1.9.0.4/1.8.1.18) * MFSA 2008-55 / CVE-2008-5021 (bmo#456896) Crash and remote code execution in nsFrameManager * MFSA 2008-56 / CVE-2008-5022 (bmo#460002) nsXMLHttpRequest::NotifyEventListeners() same-origin violation * MFSA 2008-58 / CVE-2008-5024 (bmo#453915) Parsing error in E4X default namespace ------------------------------------------------------------------- Wed Oct 15 10:32:09 CDT 2008 - maw@suse.de - Review and approve changes. ------------------------------------------------------------------- Wed Oct 8 09:51:06 CEST 2008 - wr@rosenauer.org - use system hunspell from 11.0 on (bnc#385739) - remove more executable bits from non-executable files ------------------------------------------------------------------- Tue Sep 23 09:42:12 CEST 2008 - wr@rosenauer.org - security update to version 2.0.0.17 (bnc#429179) * MFSA 2008-37 / CVE-2008-0016 UTF-8 URL stack buffer overflow * MFSA 2008-38 / CVE-2008-3835 nsXMLDocument::OnChannelRedirect() same-origin violation * MFSA 2008-41 / CVE-2008-4058 / CVE-2008-4059 / CVE-2008-4060 Privilege escalation via XPCnativeWrapper pollution * MFSA 2008-42 / CVE-2008-4061 / CVE-2008-4062 / CVE-2008-4063 CVE-2008-4064 Crashes with evidence of memory corruption * MFSA 2008-43 / CVE-2008-4065 / CVE-2008-4066 BOM characters, low surrogates stripped from JavaScript before execution * MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068 resource: traversal vulnerabilities * MFSA 2008-46 / CVE-2008-4070 Heap overflow when canceling newsgroup message ------------------------------------------------------------------- Mon Sep 15 13:06:11 CEST 2008 - wr@rosenauer.org - fixed undefined operation in nsMailboxService.cpp (abuild.patch) - cleanup spec a bit while merging from OBS/mozilla * forwarding old fixes to cups-paper.patch, mozilla.sh.in and add-plugins.sh (were fixed long ago in the OBS repo) ------------------------------------------------------------------- Thu Sep 11 21:34:40 CEST 2008 - mauro@suse.de - Update to 2.0.0.16 (fixed bnc#417869), fixes: + MFSA 2008-34 Remote code execution by overflowing CSS reference counter + MFSA 2008-33 Crash and remote code execution in block reflow + MFSA 2008-31 Peer-trusted certs can use alt names to spoof + MFSA 2008-29 Faulty .properties file results in uninitialized memory being used + MFSA 2008-26 Buffer length checks in MIME processing + MFSA 2008-25 Arbitrary code execution in mozIJSSubScriptLoader.loadSubScript() + MFSA 2008-24 Chrome script loading from fastload file + MFSA 2008-21 Crashes with evidence of memory corruption (rv:1.8.1.15) ------------------------------------------------------------------- Wed Jul 23 18:01:05 CEST 2008 - schwab@suse.de - Remove unused includes. ------------------------------------------------------------------- Tue Jun 24 18:43:51 CEST 2008 - maw@suse.de - Security update to version 2.0.0.14 (bnc#390992): + MFSA 2008-15 / CVE-2008-1236 and CVE-2008-1237: Crashes with evidence of memory corruption (rv:1.8.1.13) + MFSA 2008-14 / CVE-2008-1233, CVE-2008-1234, and CVE-2008-1235: JavaScript privilege escalation and arbitrary code execution - Drop the following patches: thunderbird-2.0.0.14-backports.patch, mozilla-missing-decl.patch, and unused-includes.patch - Respin mozilla-gcc4.3-fixes.patch. ------------------------------------------------------------------- Fri May 30 17:27:50 CEST 2008 - maw@suse.de - Add thunderbird-2.0.0.14-backports.patch (bnc390992). ------------------------------------------------------------------- Fri May 16 16:59:40 CEST 2008 - schwab@suse.de - Remove unused includes. ------------------------------------------------------------------- Mon Mar 24 20:17:09 CET 2008 - maw@suse.de - Add mozilla-missing-decl.patch, which is necessary when building against new versions of mozilla-nss (bmo#399589). ------------------------------------------------------------------- Fri Mar 7 18:34:42 CET 2008 - maw@suse.de - Security update to version 2.0.0.12 (bnc#354469) * MFSA 2008-12 Buffer overflow in external MIME bodies - Replace mozilla-maxpathlen.patch with mozilla-path_len.patch, for consistency's sake. ------------------------------------------------------------------- Thu Jan 17 17:56:04 CET 2008 - maw@suse.de - Add mozilla-maxpathlen.patch (#354150 and bmo #412610). ------------------------------------------------------------------- Tue Jan 15 20:36:54 CET 2008 - maw@suse.de - Merge changes from the build service (thanks, Wolfgang) - Update to version 2.0.9.9 (MFSA 2007-29) - Update enigmail to version 0.95.6 - Add a -devel subpackage - Various fixes to enable building with gcc 4.3. ------------------------------------------------------------------- Tue Nov 13 17:50:35 CET 2007 - maw@suse.de - Add thunderbird-gcc4.3-fixes.patch - Add visibility.patch. ------------------------------------------------------------------- Thu Sep 13 17:00:36 CEST 2007 - cthiel@suse.de - recommend gpg instead of requireing a fixed path ------------------------------------------------------------------- Wed Sep 12 18:25:34 CEST 2007 - maw@suse.de - Added gpg/pinentry requirements (#309160). ------------------------------------------------------------------- Tue Sep 4 00:57:26 CEST 2007 - maw@suse.de - Don't run %fdupes on directories where multiple partitions are liable to be mounted. ------------------------------------------------------------------- Mon Sep 3 17:50:50 CEST 2007 - maw@suse.de - Merge some changes from the build service (thanks, Wolfgang): + Provide locale info (#302288) + Update releasedate - Uncomment %clean. ------------------------------------------------------------------- Tue Aug 21 18:45:00 CEST 2007 - maw@suse.de - Use %fdupes. ------------------------------------------------------------------- Tue Aug 21 18:12:36 CEST 2007 - maw@suse.de - Merge updates from the build service: - Update to security release 2.0.0.6: * MFSA 2007-26 Privilege escalation through chrome-loaded about:blank windows * MFSA 2007-27 Unescaped URIs passed to external programs - Update enigmail to version 0.95.3. ------------------------------------------------------------------- Wed Aug 15 15:04:09 CEST 2007 - maw@suse.de - On x86_64, s390, and s390x, deactivate the hidden visibility support, thereby fixing the build. ------------------------------------------------------------------- Wed Jul 25 21:52:23 CEST 2007 - maw@suse.de - Security update to version 2.0.0.5 (#288115) - This new release has fixes for: MFSA 2007-18 CVE-2007-3734 - Browser flaws CVE-2007-3735 - Javascript flaws MFSA 2007-19 CVE-2007-3736 MFSA 2007-20 CVE-2007-3089 MFSA 2007-21 CVE-2007-3737 MFSA 2007-22 CVE-2007-3285 MFSA 2007-23 CVE-2007-3670 MFSA 2007-24 CVE-2007-3656 MFSA 2007-25 CVE-2007-3738 - Update to enigmail 0.95.2. ------------------------------------------------------------------- Thu Jun 21 17:23:18 CEST 2007 - adrian@suse.de - fix changelog entry order ------------------------------------------------------------------- Fri Jun 15 18:09:28 CDT 2007 - maw@suse.de - Merge update to 2.0.0.4 from the build service (thanks, Wolfgang) - Remove some commented out stuff. ------------------------------------------------------------------- Wed Jun 13 23:00:38 CEST 2007 - wr@rosenauer.org - update to maintenance release 2.0.0.4 - update enigmail to 0.95.1 - adopted patches: * fixed cups-paper.patch (copied from FF) * removed obsolete visibility.patch ------------------------------------------------------------------- Tue Jun 12 11:53:55 CDT 2007 - maw@suse.de - Merge chagnges from the build service (thanks, Wolfgang) - Now use l10n-%{version}.tar.bz2 instead of l10n.tar.bz2 as before. ------------------------------------------------------------------- Tue Jun 5 18:20:13 CEST 2007 - maw@suse.de - Security update to version 1.5.0.12 (#271197). ------------------------------------------------------------------- Tue Jun 5 15:55:08 CEST 2007 - sbrabec@suse.cz - Removed invalid desktop category "Application" (#254654). ------------------------------------------------------------------- Thu Apr 19 07:15:36 CEST 2007 - wr@rosenauer.org - update to final version 2.0.0.0 (http://www.mozilla.com/en-US/thunderbird/2.0.0.0/releasenotes/) - update enigmail to 0.95.0 ------------------------------------------------------------------- Wed Apr 18 14:16:44 CEST 2007 - mfabian@suse.de - add Japanese to the languages which get PANGO enabled in the start script to support the Japanese combining characters U+3099 U+309A (see bugzilla #262718 comment #29). ------------------------------------------------------------------- Thu Apr 12 16:35:43 CEST 2007 - wr@rosenauer.org - update to 2.0.0.0rc1 - enabled translations package ------------------------------------------------------------------- Fri Mar 30 11:35:01 CEST 2007 - wr@rosenauer.org - update to snapshot 2.0.0.0pre-20070329 - security update enigmail 0.94.3 (Bugtraq #22758) ------------------------------------------------------------------- Fri Mar 30 10:35:03 CEST 2007 - meissner@suse.de - require unzip ------------------------------------------------------------------- Tue Mar 13 08:36:31 CET 2007 - wr@rosenauer.org - update to snapshot 2.0pre-20060312 - removed implicit NSS version dependency ------------------------------------------------------------------- Thu Mar 8 15:56:56 CET 2007 - meissner@suse.de - Upgraded to 1.5.0.10 security release. - Upgraded to enigmail 0.94.2. ------------------------------------------------------------------- Thu Feb 15 19:47:56 CET 2007 - wr@rosenauer.org - update to snapshot 2.0beta2-20060214 - fixed build on SLES9 ------------------------------------------------------------------- Mon Feb 5 18:56:14 CET 2007 - wr@rosenauer.org - fixed check in add-plugins.sh (#242237) ------------------------------------------------------------------- Tue Jan 30 10:50:51 CST 2007 - maw@suse.de - Add thunderbird-1.5.0.8-uninitalized-vars-232305.patch (#232305). ------------------------------------------------------------------- Thu Jan 18 17:59:26 CST 2007 - maw@suse.de - Add undefined-ops.patch, silencing some warnings. ------------------------------------------------------------------- Thu Nov 9 01:41:19 CET 2006 - jhargadon@suse.de - security update to version 1.5.0.8 ------------------------------------------------------------------- Tue Sep 12 20:51:58 CEST 2006 - stark@suse.de - security update to version 1.5.0.7 ------------------------------------------------------------------- Mon Aug 14 11:37:46 CEST 2006 - stark@suse.de - update enigmail to 0.94.1 * Added support for signing attachments with inline-PGP - update mailredirect to 0.7.4 - added backend patch to allow replies to list with ReplyToListThunderbirdExtension (#199125, bmo #45715) - added mailnews.clobber_list_reply pref which switches "Reply All" to "Reply List" functionality if set ------------------------------------------------------------------- Thu Jul 27 06:50:44 CEST 2006 - stark@suse.de - security update to version 1.5.0.5 (#195043) - fixed overwrite confirmation for GTK filesaver (#179531) ------------------------------------------------------------------- Wed Jun 7 19:52:37 CEST 2006 - stark@suse.de - fixed up BuildRequires ------------------------------------------------------------------- Fri Jun 2 12:18:49 CEST 2006 - mls@suse.de - converted neededforbuild to BuildRequires ------------------------------------------------------------------- Fri Jun 2 12:13:48 CEST 2006 - stark@suse.de - update to security/stability release 1.5.0.4 (#179011) (http://www.mozilla.org/projects/security/known-vulnerabilities.html#Thunderbird) ------------------------------------------------------------------- Mon May 15 07:16:13 CEST 2006 - stark@suse.de - update to version 1.5.0.2 - update mailredirect to 0.7.3 - save printer settings properly (#174082, bmo #324072) - improved postscript output (bmo #334485) - changed defaults for printer properties (#6534) - get available paper sizes from CUPS (#65482) ------------------------------------------------------------------- Sat Mar 18 22:23:49 CET 2006 - stark@suse.de - translations package is suggested now by main package - yet another set of upstream fixes (#148876) ------------------------------------------------------------------- Sun Mar 12 19:52:08 CET 2006 - stark@suse.de - added Khmer (km-*) to pango locales (#157397) - yet another set of upstream fixes (#148876) ------------------------------------------------------------------- Sat Mar 4 21:27:42 CET 2006 - stark@suse.de - latest security fixes from upstream (#148876) - show multiple Reply-To addresses (bmo #106189) ------------------------------------------------------------------- Fri Feb 24 09:00:40 CET 2006 - stark@suse.de - added GTK category to desktop-file - dumpstack.patch is in upstream patches now - get some more patches (#148876) ------------------------------------------------------------------- Tue Feb 14 07:28:48 CET 2006 - stark@suse.de - applied set of security patches (#148876) ------------------------------------------------------------------- Tue Feb 7 20:09:32 CET 2006 - stark@suse.de - fixed disabling of Pango (#148788) ------------------------------------------------------------------- Thu Feb 2 21:50:18 CET 2006 - stark@suse.de - defined gssapi lib explicitely (#147670) ------------------------------------------------------------------- Wed Feb 1 17:34:34 CET 2006 - stark@suse.de - removed additional CA certs from builtin NSS - make it possible to choose $HOME as download directory (#144894, bmo #300856) - cleaned up BuildRequires ------------------------------------------------------------------- Wed Jan 25 21:33:47 CET 2006 - mls@suse.de - converted neededforbuild to BuildRequires ------------------------------------------------------------------- Mon Jan 23 08:39:32 CET 2006 - stark@suse.de - disable Pango if MOZ_ENABLE_PANGO is not set and no typical language which needs Pango is used (#143428) - preload libaoss for plugin sound (#117079) - fix to ignore X composite extension (#135373) ------------------------------------------------------------------- Wed Jan 18 09:38:18 CET 2006 - stark@suse.de - added default (font) settings - tweak useragent - fixed DumpStackToFile() for glibc 2.4 ------------------------------------------------------------------- Thu Jan 12 10:35:03 CET 2006 - stark@suse.de - update to 1.5 (20060111) - added sytem extensions patch - added XUL filechooser patch (MOZ_XUL_PICKER) - update enigmail to 0.94.0 - use -fstack-protector where available - use system NSS since CODE10 ------------------------------------------------------------------- Wed Dec 28 08:35:38 CET 2005 - stark@suse.de - update to 1.5rc2 (20051227) ------------------------------------------------------------------- Sun Dec 11 08:16:01 CET 2005 - stark@suse.de - update to 1.5 (20051211) - update enigmail to 0.93.2 ------------------------------------------------------------------- Tue Nov 29 09:53:05 CET 2005 - stark@suse.de - update enigmail to 0.93.1 - added patch for GTK2 handling (#134831) ------------------------------------------------------------------- Fri Nov 25 10:29:26 CET 2005 - stark@suse.de - update to 1.5 (20051124) ------------------------------------------------------------------- Fri Oct 28 06:47:11 CEST 2005 - stark@suse.de - update to latest 1.5 snapshot (20051027) - added patch to be able to reply to and forward rfc822 messages (bmo #204350) - again don't provide and require NSS stuff - removed disable-gconf patch (no registration needed in build process anymore) - added mailredirect extension - removed update functionality ------------------------------------------------------------------- Mon Oct 10 21:50:36 CEST 2005 - stark@suse.de - update to 1.5b2 (20051008) - preinstall Enigmail (version 0.93.0) as global extension - add all supported locales and use if installed ------------------------------------------------------------------- Tue Oct 4 09:32:11 CEST 2005 - stark@suse.de - update to 1.5b2 (20051003) (RPM version 1.4.1) - prerequire NSPR - prepared translations subpackage - fixed filelist - fixed build with new gcc ------------------------------------------------------------------- Wed Sep 21 14:32:28 CEST 2005 - stark@suse.de - update to 1.5b1 (20050920) - added spellchecker integration with myspell (add-plugins.sh) - removed aviary-install-global patch (not needed anymore, with new EM) - enabled pango font rendering (through cairo hopefully) - fixed GNOME gconf registration (#117851) ------------------------------------------------------------------- Sat Aug 20 20:33:10 CEST 2005 - stark@suse.de - workaround for linking with pangoxft and pangox (broken by gtk 2.8 update) (#105764) ------------------------------------------------------------------- Thu Aug 18 08:48:17 CEST 2005 - stark@suse.de - fixed Gdk-WARNING at startup (gtk.patch) - fixed regression in profile locking change (bmo #303633) - fixed crash with gtk 2.7 (bmo #300226, bnc #104586) ------------------------------------------------------------------- Wed Aug 3 07:23:50 CEST 2005 - stark@suse.de - fixed profile locking (bmo #151188) ------------------------------------------------------------------- Fri Jul 29 07:06:57 CEST 2005 - stark@suse.de - don't require and provide NSS libs (#98002) ------------------------------------------------------------------- Fri Jul 22 11:00:05 CEST 2005 - stark@suse.de - fixed printing patch ------------------------------------------------------------------- Tue Jul 19 10:45:22 CEST 2005 - stark@suse.de - added NSPR to PreReq - disable stripping in specfile ------------------------------------------------------------------- Fri Jul 15 07:01:45 CEST 2005 - stark@suse.de - update to 1.0.6 which restores API compatibility - fixed width calculation in Postscript module (bmo #290292) ------------------------------------------------------------------- Thu Jul 14 12:29:41 CEST 2005 - stark@suse.de - fixed filelist to include icon-file and startscript again ------------------------------------------------------------------- Tue Jul 12 06:28:21 CEST 2005 - stark@suse.de - fixed remote usage behaviour in start script (bnc #41903) - update to 1.0.5 security release - fixed quoting patch - moved desktop file to a Gnome independent location - don't strip explicitely - use RPM_OPT_FLAGS for NSS component - fixed implicit declarations and uninitialized used variables ------------------------------------------------------------------- Thu Apr 28 10:45:51 CEST 2005 - stark@suse.de - updated to current 1.0 branch version - use static NSPR from other location ------------------------------------------------------------------- Sat Apr 23 23:13:52 CEST 2005 - stark@suse.de - activate usage of system NSPR for distributions after 9.3 - add patch to be able to use systen NSPR at all - extended desktop file ------------------------------------------------------------------- Fri Apr 22 12:48:13 CEST 2005 - ro@suse.de - apply mozilla-gcc4.patch ------------------------------------------------------------------- Wed Mar 23 08:28:57 CET 2005 - stark@suse.de - update to 1.0.2 - use system NSPR on SUSE releases after 9.3 - made startscript PIS aware - set g-application-name correctly (bmo #281979) ------------------------------------------------------------------- Mon Mar 7 21:27:33 CET 2005 - stark@suse.de - don't use gconfd in registration phase (#66381) ------------------------------------------------------------------- Fri Feb 25 18:03:31 CET 2005 - stark@suse.de - update to version 1.0.1 ------------------------------------------------------------------- Tue Feb 22 21:59:53 CET 2005 - stark@suse.de - added patch to create Postscript level 2 (instead of 3) (special thanks to Jungshik Shin) - disabled freetype explicitly to be able to use the above patch (freetype wasn't used anymore since some time anyway) ------------------------------------------------------------------- Wed Feb 2 14:02:34 CET 2005 - stark@suse.de - added a JS crasher fix (bmc #268535) ------------------------------------------------------------------- Sat Jan 22 13:17:37 CET 2005 - stark@suse.de - added some backported bugfixes ------------------------------------------------------------------- Tue Dec 7 10:26:15 CET 2004 - stark@suse.de - update to 1.0 - fixed extra lines in replies (bmo #144998) - fixed build on s390/s390x ------------------------------------------------------------------- Wed Nov 24 07:16:17 CET 2004 - stark@suse.de - update to 20041123 snapshot - inherit downloadFolder patch from Firefox ------------------------------------------------------------------- Fri Nov 12 10:58:46 CET 2004 - stark@suse.de - fixed chrome filelist ------------------------------------------------------------------- Thu Nov 4 08:12:51 CET 2004 - stark@suse.de - update to 0.9 - sync patch-set with firefox base - fixed neededforbuild to get GNOME functionalities ------------------------------------------------------------------- Fri Sep 17 10:30:36 CEST 2004 - stark@suse.de - added some missing fixes for official release - synced add-plugins.sh ------------------------------------------------------------------- Sat Sep 11 13:47:50 CEST 2004 - stark@suse.de - update to official 0.8 version (20040911) - fixed enigmail config ------------------------------------------------------------------- Mon Sep 6 08:58:08 CEST 2004 - stark@suse.de - fixed profile directory ------------------------------------------------------------------- Fri Sep 3 21:50:19 CEST 2004 - stark@suse.de - update to thunderbird 0.8 (20040903) - update enigmail to 0.86.0 and ipc to 1.0.8 (deactivated) ------------------------------------------------------------------- Tue Aug 24 08:09:42 CEST 2004 - stark@suse.de - update to thunderbird 0.7.3 - update enigmail to 0.85.0 and ipc to 1.0.7 ------------------------------------------------------------------- Tue Jun 29 11:31:39 CEST 2004 - stark@suse.de - update to thunderbird 0.7.1 - update enigmail to 0.84.1 ------------------------------------------------------------------- Wed May 12 18:16:28 CEST 2004 - ro@suse.de - add some missing return values ------------------------------------------------------------------- Mon May 3 13:16:26 CEST 2004 - stark@suse.de - update to Thunderbird 0.6 (based on 1.7rc1) - use official branding for release builds - added desktop-icon (#39139) ------------------------------------------------------------------- Fri Apr 2 10:32:00 CEST 2004 - stark@suse.de - removing relocation of TEMP directory (#34391) ------------------------------------------------------------------- Fri Mar 26 18:09:27 CET 2004 - uli@suse.de - fixed hang during build on s390* (bug #35440) ------------------------------------------------------------------- Sun Mar 7 23:19:54 CET 2004 - ro@suse.de - match function declaration in enigmail mimedummy.cpp ------------------------------------------------------------------- Fri Mar 5 07:00:23 CET 2004 - stark@suse.de - more fixes for #35179 - added firefox as default handler for its protocols - update enigmail to 0.83.4 ------------------------------------------------------------------- Wed Mar 3 06:52:35 CET 2004 - stark@suse.de - removed unused patches for GTK2 build ------------------------------------------------------------------- Sun Feb 29 14:35:02 CET 2004 - stark@suse.de - improved start-script to interact with firefox and mozilla (#35179) ------------------------------------------------------------------- Fri Feb 27 06:50:16 CET 2004 - stark@suse.de - update to 0.5 - spec-file cleanup ------------------------------------------------------------------- Wed Oct 15 17:08:01 CEST 2003 - stark@suse.de - update to 0.3 (sync with mozilla 1.5) ------------------------------------------------------------------- Tue Jul 15 09:18:45 CEST 2003 - stark@suse.de - initial package (snapshot 20030714)
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
