Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package firefox-esr for openSUSE:Factory checked in at 2026-10-13 17:49:00 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/firefox-esr (Old) and /work/SRC/openSUSE:Factory/.firefox-esr.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "firefox-esr" Tue Oct 13 17:49:00 2026 rev:45 rq:1384612 version:153.5.0 Changes: -------- --- /work/SRC/openSUSE:Factory/firefox-esr/MozillaFirefox.changes 2026-09-29 18:01:30.279515107 +0200 +++ /work/SRC/openSUSE:Factory/.firefox-esr.new.3698736/MozillaFirefox.changes 2026-10-13 17:49:26.344610530 +0200 @@ -1,0 +2,146 @@ +Tue Oct 13 07:39:04 UTC 2026 - Manfred Hollstein <[email protected]> + +- Firefox Extended Support Release 153.5.0 ESR + * Fixed: Various security fixes. +- Mozilla Firefox ESR 153.5.0 + https://www.mozilla.org/security/advisories/mfsa2026-108 + MFSA 2026-108 (boo#1284493) + * CVE-2026-109704 (bmo#2037979) + Privilege escalation in the Application Update component + * CVE-2026-109705 (bmo#2040905) + Sandbox escape, site isolation issue due to incorrect + boundary conditions, use-after-free in the Networking + component + * CVE-2026-109706 (bmo#2053649) + Use-after-free in the Storage: IndexedDB component + * CVE-2026-109707 (bmo#2059150) + Sandbox escape due to use-after-free in the Networking + component + * CVE-2026-109708 (bmo#2059151) + Sandbox escape due to incorrect boundary conditions in the + Networking component + * CVE-2026-109709 (bmo#2067976) + Information disclosure, privilege escalation in the Security: + Process Sandboxing component + * CVE-2026-109710 (bmo#2068338) + Use-after-free in the Graphics: Text component + * CVE-2026-109711 (bmo#2068344) + Use-after-free in the Graphics: Canvas2D component + * CVE-2026-109712 (bmo#2068420) + Sandbox escape due to uninitialized memory in the Graphics + component + * CVE-2026-109713 (bmo#2068421) + Use-after-free in the Crash Reporting component + * CVE-2026-109715 (bmo#2073267) + Incorrect boundary conditions in the JavaScript Engine + component + * CVE-2026-109716 (bmo#2073269) + Incorrect boundary conditions in the JavaScript Engine + component + * CVE-2026-109717 (bmo#2073647) + Use-after-free in the DOM: Bindings (WebIDL) component + * CVE-2026-109718 (bmo#2073692) + Use-after-free in the XML component + * CVE-2026-109719 (bmo#2073969) + Race condition, use-after-free in the Graphics: CanvasWebGL + component + * CVE-2026-109720 (bmo#2074160) + JIT miscompilation in the JavaScript: WebAssembly component + * CVE-2026-109721 (bmo#2074161) + Incorrect boundary conditions in the JavaScript Engine: JIT + component + * CVE-2026-109722 (bmo#2074164) + JIT miscompilation in the JavaScript Engine: JIT component + * CVE-2026-109723 (bmo#2074171) + Integer overflow in the Layout: Text and Fonts component + * CVE-2026-109724 (bmo#2074193) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-109725 (bmo#2074208) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-109726 (bmo#2074212) + Use-after-free in the SVG component + * CVE-2026-109727 (bmo#2074213) + Use-after-free in the Audio/Video component + * CVE-2026-109728 (bmo#2074625) + Use-after-free in the DOM: Animation component + * CVE-2026-109729 (bmo#2074632) + Use-after-free in the JavaScript Engine: JIT component + * CVE-2026-109730 (bmo#2074896) + Integer overflow in the Graphics component + * CVE-2026-109731 (bmo#2075436) + Incorrect boundary conditions in the Graphics: Canvas2D + component + * CVE-2026-109732 (bmo#2075998) + Use-after-free in the DOM: Streams component + * CVE-2026-109733 (bmo#2076269) + JIT miscompilation in the JavaScript Engine: JIT component + * CVE-2026-109734 (bmo#1926318) + Mitigation bypass in the DOM: Security component + * CVE-2026-109736 (bmo#2029784) + Frame poisoning in the Layout component + * CVE-2026-109737 (bmo#2044525) + Mitigation bypass in the Enterprise Policies component + * CVE-2026-109738 (bmo#2047722) + Use-after-free in the Audio/Video: Playback component + * CVE-2026-109740 (bmo#2057113) + Sandbox escape due to incorrect boundary conditions in the + Widget: Win32 component + * CVE-2026-109741 (bmo#2058651) + Use-after-free in the Storage: Bucket File System component + * CVE-2026-109742 (bmo#2058800) + Information disclosure in the PDF Viewer component + * CVE-2026-109743 (bmo#2059195) + Privilege escalation in the Panning and Zooming component + * CVE-2026-109744 (bmo#2059211) + Other issue in the DOM: File component + * CVE-2026-109745 (bmo#2061784) + Sandbox escape due to uninitialized memory in the DOM: Web + Serial component + * CVE-2026-109782 (bmo#2067465) + Mitigation bypass in the File Handling component + * CVE-2026-109751 (bmo#2068372) + Information disclosure in the Networking component + * CVE-2026-109752 (bmo#2068407) + Use-after-free in the DOM: Workers component + * CVE-2026-109753 (bmo#2068441) + Incorrect boundary conditions in the Layout component + * CVE-2026-109754 (bmo#2068443) + Incorrect boundary conditions in the DOM: Editor component + * CVE-2026-109756 (bmo#2069258) + Privilege escalation in the DOM: Navigation component + * CVE-2026-109757 (bmo#2069910) + Sandbox escape due to race condition in the Networking + component + * CVE-2026-109759 (bmo#2070252) + Site isolation issue in the Networking component + * CVE-2026-109760 (bmo#2070633) + Mitigation bypass in the Networking: HTTP component + * CVE-2026-109762 (bmo#2072438) + Incorrect boundary conditions in the SVG component + * CVE-2026-109763 (bmo#2072501) + Mitigation bypass in the File Handling component + * CVE-2026-109764 (bmo#2073382) + Mitigation bypass in the Enterprise Policies component + * CVE-2026-109765 (bmo#2073396) + Race condition, use-after-free in the Graphics: Text + component + * CVE-2026-109766 (bmo#2074406) + Mitigation bypass in the Enterprise Policies component + * CVE-2026-109767 (bmo#2074963) + Information disclosure in the Networking component + * CVE-2026-109783 (bmo#2075533) + Mitigation bypass in the File Handling component + * CVE-2026-109770 (bmo#2059230) + Spoofing issue in the DOM: Web Serial component + * CVE-2026-109775 (bmo#2068255) + Denial-of-service in the WebRTC component + * CVE-2026-109776 (bmo#2069395) + Race condition in the XPCOM component + * CVE-2026-109777 (bmo#2069638) + Information disclosure in the Storage: IndexedDB component + * CVE-2026-109778 (bmo#2070547) + Privilege escalation in the WebExtensions component + * CVE-2026-109781 (bmo#2072852) + Denial-of-service in the Printing: Output component + +------------------------------------------------------------------- firefox-esr.changes: same change Old: ---- firefox-153.4.0esr.source.tar.xz firefox-153.4.0esr.source.tar.xz.asc l10n-153.4.0esr.tar.xz New: ---- firefox-153.5.0esr.source.tar.xz firefox-153.5.0esr.source.tar.xz.asc l10n-153.5.0esr.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ firefox-esr.spec ++++++ --- /var/tmp/diff_new_pack.cwtBlg/_old 2026-10-13 17:52:26.181144445 +0200 +++ /var/tmp/diff_new_pack.cwtBlg/_new 2026-10-13 17:52:26.184144571 +0200 @@ -41,8 +41,8 @@ # major 69 # mainver %%major.99 %define major 153 -%define mainver %major.4.0 -%define orig_version 153.4.0 +%define mainver %major.5.0 +%define orig_version 153.5.0 %define orig_suffix esr %define update_channel esr %define branding 1 ++++++ MozillaFirefox.changes.txt ++++++ --- /var/tmp/diff_new_pack.cwtBlg/_old 2026-10-13 17:52:26.330150685 +0200 +++ /var/tmp/diff_new_pack.cwtBlg/_new 2026-10-13 17:52:26.336150937 +0200 @@ -1,4 +1,150 @@ ------------------------------------------------------------------- +Tue Oct 13 07:39:04 UTC 2026 - Manfred Hollstein <[email protected]> + +- Firefox Extended Support Release 153.5.0 ESR + * Fixed: Various security fixes. +- Mozilla Firefox ESR 153.5.0 + https://www.mozilla.org/security/advisories/mfsa2026-108 + MFSA 2026-108 (boo#1284493) + * CVE-2026-109704 (bmo#2037979) + Privilege escalation in the Application Update component + * CVE-2026-109705 (bmo#2040905) + Sandbox escape, site isolation issue due to incorrect + boundary conditions, use-after-free in the Networking + component + * CVE-2026-109706 (bmo#2053649) + Use-after-free in the Storage: IndexedDB component + * CVE-2026-109707 (bmo#2059150) + Sandbox escape due to use-after-free in the Networking + component + * CVE-2026-109708 (bmo#2059151) + Sandbox escape due to incorrect boundary conditions in the + Networking component + * CVE-2026-109709 (bmo#2067976) + Information disclosure, privilege escalation in the Security: + Process Sandboxing component + * CVE-2026-109710 (bmo#2068338) + Use-after-free in the Graphics: Text component + * CVE-2026-109711 (bmo#2068344) + Use-after-free in the Graphics: Canvas2D component + * CVE-2026-109712 (bmo#2068420) + Sandbox escape due to uninitialized memory in the Graphics + component + * CVE-2026-109713 (bmo#2068421) + Use-after-free in the Crash Reporting component + * CVE-2026-109715 (bmo#2073267) + Incorrect boundary conditions in the JavaScript Engine + component + * CVE-2026-109716 (bmo#2073269) + Incorrect boundary conditions in the JavaScript Engine + component + * CVE-2026-109717 (bmo#2073647) + Use-after-free in the DOM: Bindings (WebIDL) component + * CVE-2026-109718 (bmo#2073692) + Use-after-free in the XML component + * CVE-2026-109719 (bmo#2073969) + Race condition, use-after-free in the Graphics: CanvasWebGL + component + * CVE-2026-109720 (bmo#2074160) + JIT miscompilation in the JavaScript: WebAssembly component + * CVE-2026-109721 (bmo#2074161) + Incorrect boundary conditions in the JavaScript Engine: JIT + component + * CVE-2026-109722 (bmo#2074164) + JIT miscompilation in the JavaScript Engine: JIT component + * CVE-2026-109723 (bmo#2074171) + Integer overflow in the Layout: Text and Fonts component + * CVE-2026-109724 (bmo#2074193) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-109725 (bmo#2074208) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-109726 (bmo#2074212) + Use-after-free in the SVG component + * CVE-2026-109727 (bmo#2074213) + Use-after-free in the Audio/Video component + * CVE-2026-109728 (bmo#2074625) + Use-after-free in the DOM: Animation component + * CVE-2026-109729 (bmo#2074632) + Use-after-free in the JavaScript Engine: JIT component + * CVE-2026-109730 (bmo#2074896) + Integer overflow in the Graphics component + * CVE-2026-109731 (bmo#2075436) + Incorrect boundary conditions in the Graphics: Canvas2D + component + * CVE-2026-109732 (bmo#2075998) + Use-after-free in the DOM: Streams component + * CVE-2026-109733 (bmo#2076269) + JIT miscompilation in the JavaScript Engine: JIT component + * CVE-2026-109734 (bmo#1926318) + Mitigation bypass in the DOM: Security component + * CVE-2026-109736 (bmo#2029784) + Frame poisoning in the Layout component + * CVE-2026-109737 (bmo#2044525) + Mitigation bypass in the Enterprise Policies component + * CVE-2026-109738 (bmo#2047722) + Use-after-free in the Audio/Video: Playback component + * CVE-2026-109740 (bmo#2057113) + Sandbox escape due to incorrect boundary conditions in the + Widget: Win32 component + * CVE-2026-109741 (bmo#2058651) + Use-after-free in the Storage: Bucket File System component + * CVE-2026-109742 (bmo#2058800) + Information disclosure in the PDF Viewer component + * CVE-2026-109743 (bmo#2059195) + Privilege escalation in the Panning and Zooming component + * CVE-2026-109744 (bmo#2059211) + Other issue in the DOM: File component + * CVE-2026-109745 (bmo#2061784) + Sandbox escape due to uninitialized memory in the DOM: Web + Serial component + * CVE-2026-109782 (bmo#2067465) + Mitigation bypass in the File Handling component + * CVE-2026-109751 (bmo#2068372) + Information disclosure in the Networking component + * CVE-2026-109752 (bmo#2068407) + Use-after-free in the DOM: Workers component + * CVE-2026-109753 (bmo#2068441) + Incorrect boundary conditions in the Layout component + * CVE-2026-109754 (bmo#2068443) + Incorrect boundary conditions in the DOM: Editor component + * CVE-2026-109756 (bmo#2069258) + Privilege escalation in the DOM: Navigation component + * CVE-2026-109757 (bmo#2069910) + Sandbox escape due to race condition in the Networking + component + * CVE-2026-109759 (bmo#2070252) + Site isolation issue in the Networking component + * CVE-2026-109760 (bmo#2070633) + Mitigation bypass in the Networking: HTTP component + * CVE-2026-109762 (bmo#2072438) + Incorrect boundary conditions in the SVG component + * CVE-2026-109763 (bmo#2072501) + Mitigation bypass in the File Handling component + * CVE-2026-109764 (bmo#2073382) + Mitigation bypass in the Enterprise Policies component + * CVE-2026-109765 (bmo#2073396) + Race condition, use-after-free in the Graphics: Text + component + * CVE-2026-109766 (bmo#2074406) + Mitigation bypass in the Enterprise Policies component + * CVE-2026-109767 (bmo#2074963) + Information disclosure in the Networking component + * CVE-2026-109783 (bmo#2075533) + Mitigation bypass in the File Handling component + * CVE-2026-109770 (bmo#2059230) + Spoofing issue in the DOM: Web Serial component + * CVE-2026-109775 (bmo#2068255) + Denial-of-service in the WebRTC component + * CVE-2026-109776 (bmo#2069395) + Race condition in the XPCOM component + * CVE-2026-109777 (bmo#2069638) + Information disclosure in the Storage: IndexedDB component + * CVE-2026-109778 (bmo#2070547) + Privilege escalation in the WebExtensions component + * CVE-2026-109781 (bmo#2072852) + Denial-of-service in the Printing: Output component + +------------------------------------------------------------------- Tue Sep 29 09:13:49 UTC 2026 - Manfred Hollstein <[email protected]> - Firefox Extended Support Release 153.4.0 ESR ++++++ firefox-153.4.0esr.source.tar.xz -> firefox-153.5.0esr.source.tar.xz ++++++ /work/SRC/openSUSE:Factory/firefox-esr/firefox-153.4.0esr.source.tar.xz /work/SRC/openSUSE:Factory/.firefox-esr.new.3698736/firefox-153.5.0esr.source.tar.xz differ: char 15, line 1 ++++++ firefox-esr.changes.txt ++++++ --- /var/tmp/diff_new_pack.cwtBlg/_old 2026-10-13 17:52:26.492157470 +0200 +++ /var/tmp/diff_new_pack.cwtBlg/_new 2026-10-13 17:52:26.497157679 +0200 @@ -1,4 +1,150 @@ ------------------------------------------------------------------- +Tue Oct 13 07:39:04 UTC 2026 - Manfred Hollstein <[email protected]> + +- Firefox Extended Support Release 153.5.0 ESR + * Fixed: Various security fixes. +- Mozilla Firefox ESR 153.5.0 + https://www.mozilla.org/security/advisories/mfsa2026-108 + MFSA 2026-108 (boo#1284493) + * CVE-2026-109704 (bmo#2037979) + Privilege escalation in the Application Update component + * CVE-2026-109705 (bmo#2040905) + Sandbox escape, site isolation issue due to incorrect + boundary conditions, use-after-free in the Networking + component + * CVE-2026-109706 (bmo#2053649) + Use-after-free in the Storage: IndexedDB component + * CVE-2026-109707 (bmo#2059150) + Sandbox escape due to use-after-free in the Networking + component + * CVE-2026-109708 (bmo#2059151) + Sandbox escape due to incorrect boundary conditions in the + Networking component + * CVE-2026-109709 (bmo#2067976) + Information disclosure, privilege escalation in the Security: + Process Sandboxing component + * CVE-2026-109710 (bmo#2068338) + Use-after-free in the Graphics: Text component + * CVE-2026-109711 (bmo#2068344) + Use-after-free in the Graphics: Canvas2D component + * CVE-2026-109712 (bmo#2068420) + Sandbox escape due to uninitialized memory in the Graphics + component + * CVE-2026-109713 (bmo#2068421) + Use-after-free in the Crash Reporting component + * CVE-2026-109715 (bmo#2073267) + Incorrect boundary conditions in the JavaScript Engine + component + * CVE-2026-109716 (bmo#2073269) + Incorrect boundary conditions in the JavaScript Engine + component + * CVE-2026-109717 (bmo#2073647) + Use-after-free in the DOM: Bindings (WebIDL) component + * CVE-2026-109718 (bmo#2073692) + Use-after-free in the XML component + * CVE-2026-109719 (bmo#2073969) + Race condition, use-after-free in the Graphics: CanvasWebGL + component + * CVE-2026-109720 (bmo#2074160) + JIT miscompilation in the JavaScript: WebAssembly component + * CVE-2026-109721 (bmo#2074161) + Incorrect boundary conditions in the JavaScript Engine: JIT + component + * CVE-2026-109722 (bmo#2074164) + JIT miscompilation in the JavaScript Engine: JIT component + * CVE-2026-109723 (bmo#2074171) + Integer overflow in the Layout: Text and Fonts component + * CVE-2026-109724 (bmo#2074193) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-109725 (bmo#2074208) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-109726 (bmo#2074212) + Use-after-free in the SVG component + * CVE-2026-109727 (bmo#2074213) + Use-after-free in the Audio/Video component + * CVE-2026-109728 (bmo#2074625) + Use-after-free in the DOM: Animation component + * CVE-2026-109729 (bmo#2074632) + Use-after-free in the JavaScript Engine: JIT component + * CVE-2026-109730 (bmo#2074896) + Integer overflow in the Graphics component + * CVE-2026-109731 (bmo#2075436) + Incorrect boundary conditions in the Graphics: Canvas2D + component + * CVE-2026-109732 (bmo#2075998) + Use-after-free in the DOM: Streams component + * CVE-2026-109733 (bmo#2076269) + JIT miscompilation in the JavaScript Engine: JIT component + * CVE-2026-109734 (bmo#1926318) + Mitigation bypass in the DOM: Security component + * CVE-2026-109736 (bmo#2029784) + Frame poisoning in the Layout component + * CVE-2026-109737 (bmo#2044525) + Mitigation bypass in the Enterprise Policies component + * CVE-2026-109738 (bmo#2047722) + Use-after-free in the Audio/Video: Playback component + * CVE-2026-109740 (bmo#2057113) + Sandbox escape due to incorrect boundary conditions in the + Widget: Win32 component + * CVE-2026-109741 (bmo#2058651) + Use-after-free in the Storage: Bucket File System component + * CVE-2026-109742 (bmo#2058800) + Information disclosure in the PDF Viewer component + * CVE-2026-109743 (bmo#2059195) + Privilege escalation in the Panning and Zooming component + * CVE-2026-109744 (bmo#2059211) + Other issue in the DOM: File component + * CVE-2026-109745 (bmo#2061784) + Sandbox escape due to uninitialized memory in the DOM: Web + Serial component + * CVE-2026-109782 (bmo#2067465) + Mitigation bypass in the File Handling component + * CVE-2026-109751 (bmo#2068372) + Information disclosure in the Networking component + * CVE-2026-109752 (bmo#2068407) + Use-after-free in the DOM: Workers component + * CVE-2026-109753 (bmo#2068441) + Incorrect boundary conditions in the Layout component + * CVE-2026-109754 (bmo#2068443) + Incorrect boundary conditions in the DOM: Editor component + * CVE-2026-109756 (bmo#2069258) + Privilege escalation in the DOM: Navigation component + * CVE-2026-109757 (bmo#2069910) + Sandbox escape due to race condition in the Networking + component + * CVE-2026-109759 (bmo#2070252) + Site isolation issue in the Networking component + * CVE-2026-109760 (bmo#2070633) + Mitigation bypass in the Networking: HTTP component + * CVE-2026-109762 (bmo#2072438) + Incorrect boundary conditions in the SVG component + * CVE-2026-109763 (bmo#2072501) + Mitigation bypass in the File Handling component + * CVE-2026-109764 (bmo#2073382) + Mitigation bypass in the Enterprise Policies component + * CVE-2026-109765 (bmo#2073396) + Race condition, use-after-free in the Graphics: Text + component + * CVE-2026-109766 (bmo#2074406) + Mitigation bypass in the Enterprise Policies component + * CVE-2026-109767 (bmo#2074963) + Information disclosure in the Networking component + * CVE-2026-109783 (bmo#2075533) + Mitigation bypass in the File Handling component + * CVE-2026-109770 (bmo#2059230) + Spoofing issue in the DOM: Web Serial component + * CVE-2026-109775 (bmo#2068255) + Denial-of-service in the WebRTC component + * CVE-2026-109776 (bmo#2069395) + Race condition in the XPCOM component + * CVE-2026-109777 (bmo#2069638) + Information disclosure in the Storage: IndexedDB component + * CVE-2026-109778 (bmo#2070547) + Privilege escalation in the WebExtensions component + * CVE-2026-109781 (bmo#2072852) + Denial-of-service in the Printing: Output component + +------------------------------------------------------------------- Tue Sep 29 09:13:49 UTC 2026 - Manfred Hollstein <[email protected]> - Firefox Extended Support Release 153.4.0 ESR ++++++ l10n-153.4.0esr.tar.xz -> l10n-153.5.0esr.tar.xz ++++++ ++++++ tar_stamps ++++++ --- /var/tmp/diff_new_pack.cwtBlg/_old 2026-10-13 17:52:26.807170661 +0200 +++ /var/tmp/diff_new_pack.cwtBlg/_new 2026-10-13 17:52:26.810170787 +0200 @@ -1,11 +1,11 @@ PRODUCT="firefox" CHANNEL="esr153" -VERSION="153.4.0" +VERSION="153.5.0" VERSION_SUFFIX="esr" -PREV_VERSION="153.3.0" +PREV_VERSION="153.4.0" PREV_VERSION_SUFFIX="esr" #SKIP_LOCALES="" # Uncomment to skip l10n and compare-locales-generation RELEASE_REPO="https://hg.mozilla.org/releases/mozilla-esr153"; -RELEASE_TAG="ec9c1cc8a5cb6fac9d4d17e4f141fb42a8089b4c" -RELEASE_TIMESTAMP="20260923073912" +RELEASE_TAG="3806652efdaccfd958d04803eddd3fdf131cd0cd" +RELEASE_TIMESTAMP="20261006170429"
