openSUSE Build Service

Overview Details Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo (Revision 1f4972c89440b3f9811d164edb0b7881)

Currently displaying revision 1f4972c89440b3f9811d164edb0b7881 , Show latest

<patchinfo incident="3069">
  <packager>wrosenauer</packager>
  <issue tracker="bnc" id="897890">CVE-2014-1568: mozilla-nss: certificate forgery possible</issue>
  <issue tracker="bnc" id="900941">mozilla firefox 33 security update</issue>
  <issue tracker="cve" id="CVE-2014-1554"></issue>
  <issue tracker="cve" id="CVE-2014-1574"></issue>
  <issue tracker="cve" id="CVE-2014-1575"></issue>
  <issue tracker="cve" id="CVE-2014-1576"></issue>
  <issue tracker="cve" id="CVE-2014-1577"></issue>
  <issue tracker="cve" id="CVE-2014-1578"></issue>
  <issue tracker="cve" id="CVE-2014-1580"></issue>
  <issue tracker="cve" id="CVE-2014-1581"></issue>
  <issue tracker="cve" id="CVE-2014-1582"></issue>
  <issue tracker="cve" id="CVE-2014-1583"></issue>
  <issue tracker="cve" id="CVE-2014-1584"></issue>
  <issue tracker="cve" id="CVE-2014-1585"></issue>
  <issue tracker="cve" id="CVE-2014-1586"></issue>
  <issue tracker="bmo" id="1012609"></issue>
  <issue tracker="bmo" id="1015540"></issue>
  <issue tracker="bmo" id="1041512"></issue>
  <issue tracker="bmo" id="1049095"></issue>
  <issue tracker="bmo" id="1062876"></issue>
  <issue tracker="bmo" id="1062981"></issue>
  <issue tracker="bmo" id="1063327"></issue>
  <issue tracker="bmo" id="1063733"></issue>
  <issue tracker="bmo" id="1063971"></issue>
  <issue tracker="bmo" id="1066190"></issue>
  <issue tracker="bmo" id="1068218"></issue>
  <issue tracker="bnc" id="896624">Firefox/Seamonkey fails to build on i586 on 13.1 and above</issue>
  <issue tracker="bnc" id="901213">firefox fails to build on ppc64</issue>
  <issue tracker="bmo" id="1026129"></issue>
  <issue tracker="bmo" id="1026469"></issue>
  <issue tracker="bmo" id="1034415"></issue>
  <issue tracker="bmo" id="1042408"></issue>
  <issue tracker="bmo" id="1043082"></issue>
  <issue tracker="bmo" id="836658"></issue>
  <issue tracker="bmo" id="979278"></issue>
  <category>security</category>
  <rating>moderate</rating>
  <summary>update for firefox, mozilla-nspr, mozilla-nss</summary>
  <description>

- update to Firefox 33.0 (bnc#900941)
  New features:
  * OpenH264 support (sandboxed)
  * Enhanced Tiles
  * Improved search experience through the location bar
  * Slimmer and faster JavaScript strings
  * New CSP (Content Security Policy) backend
  * Support for connecting to HTTP proxy over HTTPS
  * Improved reliability of the session restoration
  * Proprietary window.crypto properties/functions removed
  Security:
  * MFSA 2014-74/CVE-2014-1574/CVE-2014-1575
    Miscellaneous memory safety hazards
  * MFSA 2014-75/CVE-2014-1576 (bmo#1041512)
    Buffer overflow during CSS manipulation
  * MFSA 2014-76/CVE-2014-1577 (bmo#1012609)
    Web Audio memory corruption issues with custom waveforms
  * MFSA 2014-77/CVE-2014-1578 (bmo#1063327)
    Out-of-bounds write with WebM video
  * MFSA 2014-78/CVE-2014-1580 (bmo#1063733)
    Further uninitialized memory use during GIF rendering
  * MFSA 2014-79/CVE-2014-1581 (bmo#1068218)
    Use-after-free interacting with text directionality
  * MFSA 2014-80/CVE-2014-1582/CVE-2014-1584 (bmo#1049095, bmo#1066190)
    Key pinning bypasses
  * MFSA 2014-81/CVE-2014-1585/CVE-2014-1586 (bmo#1062876, bmo#1062981)
    Inconsistent video sharing within iframe
  * MFSA 2014-82/CVE-2014-1583 (bmo#1015540)
    Accessing cross-origin objects via the Alarms API
    (only relevant for installed web apps)
- requires NSPR 4.10.7
- requires NSS 3.17.1
- removed obsolete patches:
  * mozilla-ppc.patch
  * mozilla-libproxy-compat.patch
- added basic appdata information

Changes in mozilla-nss:
- update to 3.17.1 (bnc#897890)
  * Change library's signature algorithm default to SHA256
  * Add support for draft-ietf-tls-downgrade-scsv
  * Add clang-cl support to the NSS build system
  * Implement TLS 1.3:
    * Part 1. Negotiate TLS 1.3
    * Part 2. Remove deprecated cipher suites andcompression.
  * Add support for little-endian powerpc64

- update to 3.17
  * required for Firefox 33
  New functionality:
  * When using ECDHE, the TLS server code may be configured to generate
    a fresh ephemeral ECDH key for each handshake, by setting the
    SSL_REUSE_SERVER_ECDHE_KEY socket option to PR_FALSE. The
    SSL_REUSE_SERVER_ECDHE_KEY option defaults to PR_TRUE, which means
    the server's ephemeral ECDH key is reused for multiple handshakes.
    This option does not affect the TLS client code, which always
    generates a fresh ephemeral ECDH key for each handshake.
  New Macros
  * SSL_REUSE_SERVER_ECDHE_KEY
  Notable Changes:
  * The manual pages for the certutil and pp tools have been updated to
    document the new parameters that had been added in NSS 3.16.2.
  * On Windows, the new build variable USE_STATIC_RTL can be used to
    specify the static C runtime library should be used. By default the
    dynamic C runtime library is used.
Changes in mozilla-nspr:
- update to version 4.10.7
  * bmo#836658: VC11+ defaults to SSE2 builds by default.
  * bmo#979278: TSan: data race nsprpub/pr/src/threads/prtpd.c:103
                PR_NewThreadPrivateIndex.
  * bmo#1026129: Replace some manual declarations of MSVC intrinsics with
                 #include &lt;intrin.h&gt;.
  * bmo#1026469: Use AC_CHECK_LIB instead of MOZ_CHECK_PTHREADS. Skip
                 compiler checks when using MSVC, even when $CC is
                 not literally "cl".
  * bmo#1034415: NSPR hardcodes the C compiler to cl on Windows.
  * bmo#1042408: Compilation fix for Android &gt; API level 19.
  * bmo#1043082: NSPR's build system hardcodes -MD.
</description>
</patchinfo>

Places

File _patchinfo of Package patchinfo (Revision 1f4972c89440b3f9811d164edb0b7881)

Places