Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package MozillaFirefox for openSUSE:Factory
checked in at 2026-10-20 12:34:39
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/MozillaFirefox (Old)
and /work/SRC/openSUSE:Factory/.MozillaFirefox.new.3698736 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "MozillaFirefox"
Tue Oct 20 12:34:39 2026 rev:505 rq:1385946 version:158.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/MozillaFirefox/MozillaFirefox.changes
2026-10-10 14:58:17.344242026 +0200
+++
/work/SRC/openSUSE:Factory/.MozillaFirefox.new.3698736/MozillaFirefox.changes
2026-10-20 12:34:55.174995686 +0200
@@ -1,0 +2,174 @@
+Wed Oct 14 16:51:53 UTC 2026 - Wolfgang Rosenauer <[email protected]>
+
+- Mozilla Firefox 158.0
+ * https://www.firefox.com/en-US/firefox/158.0/releasenotes/
+ MFSA 2026-106 (bsc#1284493)
+ * CVE-2026-109704 (bmo#2037979)
+ Privilege escalation in the Application Update component
+ * CVE-2026-109705 (bmo#2040905)
+ Sandbox escape, site isolation issue due to incorrect boundary
+ conditions, use-after-free in the Networking component
+ * CVE-2026-109706 (bmo#2053649)
+ Use-after-free in the Storage: IndexedDB component
+ * CVE-2026-109707 (bmo#2059150)
+ Sandbox escape due to use-after-free in the Networking component
+ * CVE-2026-109708 (bmo#2059151)
+ Sandbox escape due to incorrect boundary conditions in the
+ Networking component
+ * CVE-2026-109709 (bmo#2067976)
+ Information disclosure, privilege escalation in the Security:
+ Process Sandboxing component
+ * CVE-2026-109710 (bmo#2068338)
+ Use-after-free in the Graphics: Text component
+ * CVE-2026-109711 (bmo#2068344)
+ Use-after-free in the Graphics: Canvas2D component
+ * CVE-2026-109712 (bmo#2068420)
+ Sandbox escape due to uninitialized memory in the Graphics
+ component
+ * CVE-2026-109713 (bmo#2068421)
+ Use-after-free in the Crash Reporting component
+ * CVE-2026-109714 (bmo#2069765)
+ Incorrect boundary conditions in the Layout component
+ * CVE-2026-109715 (bmo#2073267)
+ Incorrect boundary conditions in the JavaScript Engine component
+ * CVE-2026-109716 (bmo#2073269)
+ Incorrect boundary conditions in the JavaScript Engine component
+ * CVE-2026-109717 (bmo#2073647)
+ Use-after-free in the DOM: Bindings (WebIDL) component
+ * CVE-2026-109718 (bmo#2073692)
+ Use-after-free in the XML component
+ * CVE-2026-109719 (bmo#2073969)
+ Race condition, use-after-free in the Graphics: CanvasWebGL
+ component
+ * CVE-2026-109720 (bmo#2074160)
+ JIT miscompilation in the JavaScript: WebAssembly component
+ * CVE-2026-109721 (bmo#2074161)
+ Incorrect boundary conditions in the JavaScript Engine: JIT
+ component
+ * CVE-2026-109722 (bmo#2074164)
+ JIT miscompilation in the JavaScript Engine: JIT component
+ * CVE-2026-109723 (bmo#2074171)
+ Integer overflow in the Layout: Text and Fonts component
+ * CVE-2026-109724 (bmo#2074193)
+ Use-after-free in the DOM: Core & HTML component
+ * CVE-2026-109725 (bmo#2074208)
+ Use-after-free in the DOM: Core & HTML component
+ * CVE-2026-109726 (bmo#2074212)
+ Use-after-free in the SVG component
+ * CVE-2026-109727 (bmo#2074213)
+ Use-after-free in the Audio/Video component
+ * CVE-2026-109728 (bmo#2074625)
+ Use-after-free in the DOM: Animation component
+ * CVE-2026-109729 (bmo#2074632)
+ Use-after-free in the JavaScript Engine: JIT component
+ * CVE-2026-109730 (bmo#2074896)
+ Integer overflow in the Graphics component
+ * CVE-2026-109731 (bmo#2075436)
+ Incorrect boundary conditions in the Graphics: Canvas2D
+ component
+ * CVE-2026-109732 (bmo#2075998)
+ Use-after-free in the DOM: Streams component
+ * CVE-2026-109733 (bmo#2076269)
+ JIT miscompilation in the JavaScript Engine: JIT component
+ * CVE-2026-109734 (bmo#1926318)
+ Mitigation bypass in the DOM: Security component
+ * CVE-2026-109735 (bmo#2028727)
+ Use-after-free in the DOM: Animation component
+ * CVE-2026-109736 (bmo#2029784)
+ Frame poisoning in the Layout component
+ * CVE-2026-109737 (bmo#2044525)
+ Mitigation bypass in the Enterprise Policies component
+ * CVE-2026-109738 (bmo#2047722)
+ Use-after-free in the Audio/Video: Playback component
+ * CVE-2026-109739 (bmo#2049069)
+ Privilege escalation in the WebExtensions component
+ * CVE-2026-109740 (bmo#2057113)
+ Sandbox escape due to incorrect boundary conditions in the
+ Widget: Win32 component
+ * CVE-2026-109741 (bmo#2058651)
+ Use-after-free in the Storage: Bucket File System component
+ * CVE-2026-109742 (bmo#2058800)
+ Information disclosure in the PDF Viewer component
+ * CVE-2026-109743 (bmo#2059195)
+ Privilege escalation in the Panning and Zooming component
+ * CVE-2026-109744 (bmo#2059211)
+ Other issue in the DOM: File component
+ * CVE-2026-109745 (bmo#2061784)
+ Sandbox escape due to uninitialized memory in the DOM: Web
+ Serial component
+ * CVE-2026-109746 (bmo#2063005)
+ Mitigation bypass in the DOM: Security component
+ * CVE-2026-109747 (bmo#2065402)
+ Other issue in the Address Bar component
+ * CVE-2026-109748 (bmo#2067169)
+ Use-after-free in the JavaScript: WebAssembly component
+ * CVE-2026-109749 (bmo#2067174)
+ Use-after-free in the JavaScript: WebAssembly component
+ * CVE-2026-109750 (bmo#2067571)
+ Site isolation issue in the DOM: Web Authentication component
+ * CVE-2026-109751 (bmo#2068372)
+ Information disclosure in the Networking component
+ * CVE-2026-109752 (bmo#2068407)
+ Use-after-free in the DOM: Workers component
+ * CVE-2026-109753 (bmo#2068441)
+ Incorrect boundary conditions in the Layout component
+ * CVE-2026-109754 (bmo#2068443)
+ Incorrect boundary conditions in the DOM: Editor component
+ * CVE-2026-109755 (bmo#2068448)
+ Sandbox escape in the DOM: Content Processes component
+ * CVE-2026-109756 (bmo#2069258)
+ Privilege escalation in the DOM: Navigation component
+ * CVE-2026-109757 (bmo#2069910)
+ Sandbox escape due to race condition in the Networking
+ component
+ * CVE-2026-109759 (bmo#2070252)
+ Site isolation issue in the Networking component
+ * CVE-2026-109760 (bmo#2070633)
+ Mitigation bypass in the Networking: HTTP component
+ * CVE-2026-109761 (bmo#2071764)
+ Use-after-free in the JavaScript: WebAssembly component
+ * CVE-2026-109762 (bmo#2072438)
+ Incorrect boundary conditions in the SVG component
+ * CVE-2026-109763 (bmo#2072501)
+ Mitigation bypass in the File Handling component
+ * CVE-2026-109764 (bmo#2073382)
+ Mitigation bypass in the Enterprise Policies component
+ * CVE-2026-109765 (bmo#2073396)
+ Race condition, use-after-free in the Graphics: Text component
+ * CVE-2026-109766 (bmo#2074406)
+ Mitigation bypass in the Enterprise Policies component
+ * CVE-2026-109767 (bmo#2074963)
+ Information disclosure in the Networking component
+ * CVE-2026-109768 (bmo#2011368)
+ Denial-of-service in the Site Reports component
+ * CVE-2026-109769 (bmo#2050313)
+ Information disclosure in the Networking: Cache component
+ * CVE-2026-109770 (bmo#2059230)
+ Spoofing issue in the DOM: Web Serial component
+ * CVE-2026-109771 (bmo#2059658)
+ Information disclosure in the WebRTC: Networking component
+ * CVE-2026-109772 (bmo#2066063)
+ Same-origin policy bypass in the DevTools component
+ * CVE-2026-109773 (bmo#2066094)
+ Denial-of-service in the Sync component
+ * CVE-2026-109774 (bmo#2067657)
+ Invalid pointer, undefined behavior in the DOM: Notifications
+ component
+ * CVE-2026-109775 (bmo#2068255)
+ Denial-of-service in the WebRTC component
+ * CVE-2026-109776 (bmo#2069395)
+ Race condition in the XPCOM component
+ * CVE-2026-109777 (bmo#2069638)
+ Information disclosure in the Storage: IndexedDB component
+ * CVE-2026-109778 (bmo#2070547)
+ Privilege escalation in the WebExtensions component
+ * CVE-2026-109779 (bmo#2072048)
+ Race condition in the Networking: DNS component
+ * CVE-2026-109780 (bmo#2072775)
+ Mitigation bypass in the DOM: Core & HTML component
+ * CVE-2026-109781 (bmo#2072852)
+ Denial-of-service in the Printing: Output component
+- requires NSS >= 3.130
+- rebased patches
+
+-------------------------------------------------------------------
Old:
----
firefox-157.0.1.source.tar.xz
firefox-157.0.1.source.tar.xz.asc
l10n-157.0.1.tar.xz
New:
----
firefox-158.0.source.tar.xz
firefox-158.0.source.tar.xz.asc
l10n-158.0.tar.xz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ MozillaFirefox.spec ++++++
--- /var/tmp/diff_new_pack.bPplXc/_old 2026-10-20 12:36:01.990781191 +0200
+++ /var/tmp/diff_new_pack.bPplXc/_new 2026-10-20 12:36:01.992781274 +0200
@@ -28,9 +28,9 @@
# orig_suffix b3
# major 69
# mainver %%major.99
-%define major 157
-%define mainver %major.0.1
-%define orig_version 157.0.1
+%define major 158
+%define mainver %major.0
+%define orig_version 158.0
%define orig_suffix %{nil}
%define update_channel release
%define branding 1
@@ -133,7 +133,7 @@
BuildRequires: libproxy-devel
BuildRequires: makeinfo
BuildRequires: mozilla-nspr-devel >= 4.40
-BuildRequires: mozilla-nss-devel >= 3.129
+BuildRequires: mozilla-nss-devel >= 3.130
BuildRequires: nasm >= 2.14
BuildRequires: nodejs >= 12.22.12
%if 0%{?sle_version} >= 120000 && 0%{?sle_version} < 150000
++++++ firefox-157.0.1.source.tar.xz -> firefox-158.0.source.tar.xz ++++++
/work/SRC/openSUSE:Factory/MozillaFirefox/firefox-157.0.1.source.tar.xz
/work/SRC/openSUSE:Factory/.MozillaFirefox.new.3698736/firefox-158.0.source.tar.xz
differ: char 15, line 1
++++++ l10n-157.0.1.tar.xz -> l10n-158.0.tar.xz ++++++
/work/SRC/openSUSE:Factory/MozillaFirefox/l10n-157.0.1.tar.xz
/work/SRC/openSUSE:Factory/.MozillaFirefox.new.3698736/l10n-158.0.tar.xz
differ: char 15, line 1
++++++ mozilla-bmo849632.patch ++++++
--- /var/tmp/diff_new_pack.bPplXc/_old 2026-10-20 12:36:02.696810625 +0200
+++ /var/tmp/diff_new_pack.bPplXc/_new 2026-10-20 12:36:02.704810959 +0200
@@ -1,5 +1,5 @@
# HG changeset patch
-# Parent 669e83ba291d98fea133d2cfd670d04963d456b9
+# Parent 4be640a4a8e7040ddb100806e2058025103ad029
Problem: webGL sites are displayed in the wrong color (usually blue-ish)
Solution: Problem is with skia once again. Output of webgl seems
endian-correct, but skia only
knows how to deal with little endian.
@@ -25,9 +25,9 @@
#include "mozilla/ThreadLocal.h"
#include "mozilla/UniquePtr.h"
#include "mozilla/WeakPtr.h"
+ #include "mozilla/gfx/Point.h"
#include "nsRegionFwd.h"
- #include "nsString.h"
-@@ -1619,16 +1620,23 @@ class GLContext : public GenericAtomicRe
+@@ -1636,16 +1637,23 @@ class GLContext : public GenericAtomicRe
AFTER_GL_CALL;
}
++++++ mozilla-pgo.patch ++++++
--- /var/tmp/diff_new_pack.bPplXc/_old 2026-10-20 12:36:02.756813127 +0200
+++ /var/tmp/diff_new_pack.bPplXc/_new 2026-10-20 12:36:02.766813543 +0200
@@ -1,11 +1,11 @@
# HG changeset patch
# User Wolfgang Rosenauer <[email protected]>
-# Parent 73147e14b378957cdb8516125df34111d2699fe9
+# Parent 4499598efbf786a149279a530d9adfa3e7b59614
diff --git a/build/moz.configure/lto-pgo.configure
b/build/moz.configure/lto-pgo.configure
--- a/build/moz.configure/lto-pgo.configure
+++ b/build/moz.configure/lto-pgo.configure
-@@ -89,22 +89,26 @@ def pgo_profile_path(path, pgo_use, prof
+@@ -98,22 +98,26 @@ def pgo_profile_path(path, pgo_use, prof
return path[0]
@@ -33,7 +33,7 @@
topobjdir = build_env.topobjdir
-@@ -138,17 +142,17 @@ def pgo_flags(
+@@ -147,17 +151,17 @@ def pgo_flags(
target_is_windows,
pgo_temporal,
orderfile,
@@ -52,7 +52,7 @@
if compiler.type == "clang-cl":
prefix = "/clang:"
gen_ldflags = None
-@@ -352,34 +356,34 @@ def lto(
+@@ -361,34 +365,34 @@ def lto(
"configure."
)
@@ -213,7 +213,7 @@
diff --git a/toolkit/components/terminator/nsTerminator.cpp
b/toolkit/components/terminator/nsTerminator.cpp
--- a/toolkit/components/terminator/nsTerminator.cpp
+++ b/toolkit/components/terminator/nsTerminator.cpp
-@@ -333,16 +333,21 @@ void nsTerminator::StartWatchdog() {
+@@ -398,16 +398,21 @@ void nsTerminator::StartWatchdog() {
// Defend against overflow
crashAfterMS = INT32_MAX;
} else {
@@ -227,12 +227,12 @@
+ // silently produce poorly performing binary.
+ crashAfterMS = INT32_MAX;
+
- UniquePtr<Options> options(new Options());
- // Guarantee that crashAfterTicks is non-zero
- options->crashAfterTicks = std::max(1, crashAfterMS /
HEARTBEAT_INTERVAL_MS);
+ // Guarantee that gCrashAfterTicks is non-zero
+ gCrashAfterTicks = std::max(1, crashAfterMS / HEARTBEAT_INTERVAL_MS);
DebugOnly<PRThread*> watchdogThread =
- CreateSystemThread(RunWatchdog, options.release());
+ CreateSystemThread(RunWatchdog, nullptr);
MOZ_ASSERT(watchdogThread);
}
+
++++++ tar_stamps ++++++
--- /var/tmp/diff_new_pack.bPplXc/_old 2026-10-20 12:36:02.923820089 +0200
+++ /var/tmp/diff_new_pack.bPplXc/_new 2026-10-20 12:36:02.927820256 +0200
@@ -1,11 +1,11 @@
PRODUCT="firefox"
CHANNEL="release"
-VERSION="157.0.1"
+VERSION="158.0"
VERSION_SUFFIX=""
-PREV_VERSION="157.0"
+PREV_VERSION="157.0.1"
PREV_VERSION_SUFFIX=""
#SKIP_LOCALES="" # Uncomment to skip l10n and compare-locales-generation
RELEASE_REPO="https://hg.mozilla.org/releases/mozilla-release";
-RELEASE_TAG="737ec77d798755890b062aab541a90d6c75afd19"
-RELEASE_TIMESTAMP="20261005135250"
+RELEASE_TAG="eb9a6e3a736802c8e080a76c44dc81f409d99d54"
+RELEASE_TIMESTAMP="20261007201254"
